4 ms·

Microsoft isn't fixing 8-year-old shortcut exploit abused for spying

33 points by rntn 2y ago

duxup 2y ago
>"We told Microsoft but they consider it a UI issue, not a security issue. So it doesn't meet their bar for servicing as a security update, but it might be fixed in a later OS version, or something along those lines." This reads like someone at Microsoft looked at the issue and decided that this issue is technically "not my job".
- pacifika 2y ago
  Or it’s in use by the good guys?
TeMPOraL 2y ago
There's a long report linked by the source here: https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html https://www.trendmicro.com/en_us/research/25/c/windows-short... Lots and lots of words, but tl;dr seems to be that it's just the .lnk equivalent of someone adding `logout` to your .bashrc, prepending it with a couple hundred spaces, and hoping your favorite editor doesn't have line wrap turned on. Except here, it's a fixed-width one-line GUI textbox, so there's no vertical space for line wrap, and the "hidden" commands are not a prank. If the overall info on exploitation is accurate, it's quite surprising just how far one can go with most trivial of tricks.
- charcircuit 2y ago
  It's more like you downloaded a .desktop file from someone untrusted.
- do_not_redeem 2y ago
  So you can change the icon of a shortcut and rename it to something misleading? That's an awfully weak "exploit". No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE.
  - ziddoap 2y ago
    >No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE. ZDI = Zero Day Initiative. https://www.zerodayinitiative.com/advisories/published/ https://www.zerodayinitiative.com/advisories/published/ I don't particularily agree with some of their philosophy, but they are smart folks and valuable to monitor alongside CVE. It's not like it's some backalley discount version of CVE. They've been around for 20 years, after all.
    - do_not_redeem 2y ago
      Fair, I learned something, thanks for responding in good faith.
AStonesThrow 2y ago
So a .LNK is just a special case of scripting executable file. Now, reading the last line of the article, the quote from the spokesperson, seems to indicate that security warnings are already enabled for an untrusted .LNK downloaded from the Internet. It seems that both iOS and Windows are now flagging any executable that's downloaded as "untrusted", until the user plows through the warnings to run it anyway. So if .LNK is treated as .EXE and .COM and .BAT, then I would say that there is parity there. Unfortunately, typical users aren't sophisticated enough to recognize that a .LNK is an arbitrarily-coded script file, nor to inspect it closely enough when these Evil North Koreans found a way to obfuscate it. We're still at a level where typical troubleshooting instructions include: "destroy all your data/cookies/cache, disable your firewall & anti-malware, and run this with admin privileges" because sure enough, those pesky security measures can indeed interfere with legitimate operations. It's the same thing when you tell users to "check the full URL on preview to make sure it's OK before you click it." Well, bud, I'll show you punycode, and link shortener/redirection, and thousands of legitimate gTLDs, and weighing that against the expertise of a typical consumer on what a "valid URL" looks like, not going to help.
- schroeding 2y ago
  The thing is that Windows does not show the .lnk Ending, same for .pif (which can just be a normal MZ Windows EXE), even if all other endings are shown. So your bill.pdf.lnk is shown as bill.pdf, while bill.pdf is also shown as bill.pdf. (This may have changed with new versions of Windows 11, I'm stopped working in this area a few years back)
  - colejohnson66 2y ago
    No. By default, “bill.pdf” will show as just “bill”. All “known” file extensions (i.e., those with a handler) are hidden.
    - schroeding 2y ago
      Yes, but many companies change this via GPO. And even then, they remain hidden. They are special, compared to normal extensions. Thus users are unlikely to detect that they're LNK files (in Windows), even with enabled extension.

33 points by rntn 2y ago

>"We told Microsoft but they consider it a UI issue, not a security issue. So it doesn't meet their bar for servicing as a security update, but it might be fixed in a later OS version, or something along those lines." This reads like someone at Microsoft looked at the issue and decided that this issue is technically "not my job".

pacifika 2y ago
Or it’s in use by the good guys?

TeMPOraL 2y ago

There's a long report linked by the source here: https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html https://www.trendmicro.com/en_us/research/25/c/windows-short... Lots and lots of words, but tl;dr seems to be that it's just the .lnk equivalent of someone adding `logout` to your .bashrc, prepending it with a couple hundred spaces, and hoping your favorite editor doesn't have line wrap turned on. Except here, it's a fixed-width one-line GUI textbox, so there's no vertical space for line wrap, and the "hidden" commands are not a prank. If the overall info on exploitation is accurate, it's quite surprising just how far one can go with most trivial of tricks.

charcircuit 2y ago
It's more like you downloaded a .desktop file from someone untrusted.
do_not_redeem 2y ago
So you can change the icon of a shortcut and rename it to something misleading? That's an awfully weak "exploit". No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE.
- ziddoap 2y ago
  >No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE. ZDI = Zero Day Initiative. https://www.zerodayinitiative.com/advisories/published/ https://www.zerodayinitiative.com/advisories/published/ I don't particularily agree with some of their philosophy, but they are smart folks and valuable to monitor alongside CVE. It's not like it's some backalley discount version of CVE. They've been around for 20 years, after all.
  - do_not_redeem 2y ago
    Fair, I learned something, thanks for responding in good faith.

AStonesThrow 2y ago

So a .LNK is just a special case of scripting executable file. Now, reading the last line of the article, the quote from the spokesperson, seems to indicate that security warnings are already enabled for an untrusted .LNK downloaded from the Internet. It seems that both iOS and Windows are now flagging any executable that's downloaded as "untrusted", until the user plows through the warnings to run it anyway. So if .LNK is treated as .EXE and .COM and .BAT, then I would say that there is parity there. Unfortunately, typical users aren't sophisticated enough to recognize that a .LNK is an arbitrarily-coded script file, nor to inspect it closely enough when these Evil North Koreans found a way to obfuscate it. We're still at a level where typical troubleshooting instructions include: "destroy all your data/cookies/cache, disable your firewall & anti-malware, and run this with admin privileges" because sure enough, those pesky security measures can indeed interfere with legitimate operations. It's the same thing when you tell users to "check the full URL on preview to make sure it's OK before you click it." Well, bud, I'll show you punycode, and link shortener/redirection, and thousands of legitimate gTLDs, and weighing that against the expertise of a typical consumer on what a "valid URL" looks like, not going to help.

schroeding 2y ago
The thing is that Windows does not show the .lnk Ending, same for .pif (which can just be a normal MZ Windows EXE), even if all other endings are shown. So your bill.pdf.lnk is shown as bill.pdf, while bill.pdf is also shown as bill.pdf. (This may have changed with new versions of Windows 11, I'm stopped working in this area a few years back)
- colejohnson66 2y ago
  No. By default, “bill.pdf” will show as just “bill”. All “known” file extensions (i.e., those with a handler) are hidden.
  - schroeding 2y ago
    Yes, but many companies change this via GPO. And even then, they remain hidden. They are special, compared to normal extensions. Thus users are unlikely to detect that they're LNK files (in Windows), even with enabled extension.