Slashdot Mirror
Microsoft To Issue Emergency Fix For Windows .LNK Flaw
Trailrunner7 writes "Microsoft will issue an out-of-band patch on Monday for a critical vulnerability in all of the current versions of Windows. The company didn't identify which flaw it will be patching, but the description of the vulnerability is a close match to the LNK flaw that attackers have been exploiting for several weeks now, most notably with the Stuxnet malware. The advance notification from Microsoft on Friday said that the company is patching a critical vulnerability that is being actively exploited in the wild and affects all supported Windows platforms. The LNK flaw in the Windows shell was first identified earlier this month when researchers discovered the Stuxnet worm spreading from infected USB drives to PCs. Stuxnet has turned out to be a rather interesting piece of malware as it not only uses the LNK zero day vulnerability to spread, but it had components that were signed using a legitimate digital certificate belonging to Realtek, a Taiwanese hardware manufacturer."
Microsoft has been suffering and fixing security holes for decades, not that interesting.
Converting anyone who listened to this podcast from Windows to Linux, that is.
followed by Monday-Out-Of-Band-Patch-Day.
http://blogs.technet.com/b/msrc/archive/2010/07/29/out-of-band-release-to-address-microsoft-security-advisory-2286198.aspx
Microsoft To Issue Emergency Fix For Windows .LNK Flaw
LNK flaw that attackers have been exploiting for several weeks now
Umm... maybe my notion of emergency is outdated? Though, I certainly wouldn't like to call 911 and get help several weeks later.
Microsoft malware researchers said on Friday that they had been working with VeriSign to revoke the Realtek certificate, a process that Realtek officials signed off on. The certificate in question actually expired in June. Microsoft oficials also said that they expect other attackers to begin using the techniques utilized by Stuxnet.
In hindsight the vendor certificate is a weakness in the entire process simply because access to the signing key bypasses the controls in place. Hardware vendors aren't likely to be as concious, at least until this incident, of the need to maintain proper security around their singing keys, nor are there requirements enforcing such security. In comparison keys used for financial transactions are generally held in HSMs with strong access controls around them to prevent the revealing of the private key. This particular rootkit was specifically confined to SCADA so the impact was always going to be small, but the malware could've easily been targetted to attack general windows installs .. who knows how much damage it could've caused then?
Luckily this specific certificate was going to expire soon so there was probably less resistance from the vendor in revoking it than there might've been, but if such revokation was going to invalidate significant numbers of drivers then that would've posed the problem of either leaving the certificate valid to be used for other types of malware or revoking it and invalidating however many drivers had already been signed by that key. Unfortunately it's not very likely that hardware manufacturers will ever submit to using HSM-type devices or the processes necessary to ensure key secrecy, so it looks like this will just have to be yet another potential attack vector that's caused by vendor negligence.
What's that Ring -1? Shit, this is terrible, but so is allowing anything that can house it's own driver signature file to be inserted into a SCADA system in the first place. Hell even the army gets this one right. You can buy the answer at any drugstore. And vendors, the nature of USB is such that we NEED to have secure interfaces (or at least dumb ones) like PS2 on our motherboards still.
This is just a copy (minus links) of the article at Threatpost. How about at least crediting the source?
I still haven't understood what this .lnk flaw actually is, or what fun things it might be used for (and how).
The previous discussion about this talked about SCADA systems, so I read the wikipedia article about SCADA but still don't quite get what it really is. And the vulnerability seemed to only be exploited on one particularly stupid system which used a hard-coded password.
And it seemed to also require the use of Autorun/Autoplay which should obviously be disabled anyway. I have 2 files to take care of that on all my USB drives:
Autorun.inf:
[AutoRun]
open=autorun.cmd
shell\open\Command=autorun.cmd
shell\explore\Command=autorun.cmd
And autorun.cmd:
@ECHO OFF
ECHO ALERT: You have autorun enabled on this drive (%~d0)!
ECHO.
ECHO Trying to disable it:
@ECHO ON
REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun" /ve /t REG_DWORD /d 255 /f /ve /d "@SYS:Autorun-Disabled" /f
REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf"
@ECHO OFF
ECHO.
ECHO You may need to reboot.
ECHO.
@pause
Stuxnet has turned out to be a rather interesting piece of malware as it not only uses the LNK zero day vulnerability to spread, but it had components that were signed using a legitimate digital certificate belonging to Realtek, a Taiwanese hardware manufacturer.
How do you suppose the crackers got a hold of Realtek's digital certificate? Seems to imply a level of sophistication that goes beyond most virus writers, many of whom are industry professionals these days. A government-backed organization maybe or well-funded industrial espionage.
Behold the true face of cyberwar!
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
A friendly warning to all Windows 2000 users out there, your OSs will remain vulnerable (unless you have a private agreement with MS).
Support for you ended two weeks ago.
http://support.microsoft.com/lifecycle/?LN=en-us&x=17&y=3&p1=3071
This virus made it's rounds through my work (Fortune 50 company). Man the clean-up was disruptive. Mcafee was quick with a patch to clean our computers, but I there were petabytes of storage to clean world wide.
For some reason, MS will shy away from mandadory CRL/OCSP checks. Bandwidth issues for 1 kb traffic?
Realtek drivers, as they are software/hardware hybrid (more like softmodem) with unneccesarry junk like an extra control panel weights around 40 MB. Everyone knows it since we have to deal with their aspx powered weirdo site when vendors, including Apple Inc. installs old version of drivers. What kind of harm would Windows do asking certificate vendor (Verisign in this case) if the certificate is real?
This is also a mistake by Apple too, they don't enable ocsp, at least to "best attempt" in fresh OS X install. You gotta do it in keychain utility preferences. Sad that, on OS X way of doing things, that would mean an instant security boost since native OS X apps uses the same framework for SSL comms.
Funny is, this is also a problem on Symbian which doesn't rely on "app store". For example, on Nokia E71, one must live a complete usability hell if he/she enables "online certificate revocation check". They just couldn't fix the freaking UI and disabled online certificate check for signed symbian apps. So what happens if some dumb shareware vendor loses their certificate or they actually freely sign malware? You install AV. All this for saving (!) 1 KB of traffic.
So, even if Verisign revokes it (or hurries, whatever), it won't have any effect until MS/Apple/Symbian (don't know others) wake up and enable certificate revocation checks by default in these days even your heater is connected to the internet.
http://www.realtek.com.tw/
That site would explain a lot of things to you, especially their way of handling things. Stupid Creative and other vendors made them (!) the emperor of sound with their policies. If you find about their marketshare, it will likely surpass Intel vs. AMD.
Companies like Apple, who thinks it is wise to pack up old versions of drivers so "maccie" won't have a decent experience on Windows also adds to the problem.
If Microsoft did their job fine, told Realtek "just don't ship drivers, we will handle it with windows updates as fast as you would post to website", there wouldn't be a need for third party realtek driver site to begin with. It became a common thing to go to realtek site and get/update to latest drivers.
Realtek is an advanced hardware design (IC) house, this is what happens if you force them to do software things. One day, they lose the certificate.
Your fix doesn't matter as 99% of people out there will wonder around with autorun enabled.
MS have to copy Apple's way of doing things. How long it took for Apple to fix the "startup items" flaw? They changed the scheme of doing things, did couple of permission tricks and prompted user with a complete non nerd window saying "Wrong permissions in Startup Items" like thing, with 2 options "fix" "don't fix", "fix" selected by default.
Or, they figured Input Manager functionality which allows running from user's own "Input managers" directory (in $HOME) is flawed, about to get expolited. In next OS X, they made it ignore the Input Managers in Users home dir and allowed only Admin installed input managers. Didn't it create problem on a OS which is advertised as "it just works"? of course it did but it saved a lot of users who otherwise wouldn't have clue how powerful Input Managers can be.
What MS have to do is, tell big vendors of boxed software/drivers/devices "this is it folks, talk to your DTP department to add instructions of installing your software to the box, we are disabling autorun by default". They can also add Windows 95 "install applications/drivers" control panel to a easy to reach place. E.g. right under their precious "Internet: Internet Explorer" start menu item :)
Hotfixes, AV software, reg hacks won't cut it.
I remember everyone laughing at GRC.com for alerting about port 135 being wide open to net. While it can be blamed on his kind of language (nano somethings etc.) to blame, nobody listened to him and Blaster happened.
Funny thing is, even a non computer geek can be convinced that autorunning programs in this age is a bad thing in 10 seconds and yet MS doesn't disable it.
You know one of the most dangerous and destructive viruses on MacOS (not OS X) is actually named "autorun"? So, the vendor (Apple) did what? Released "hotfixes", called Verisign? They simply disabled the functionality all together and added a kinda undocumented bit to removable media HFS to "display contents in finder whenever it is inserted" (still works in OS X). So, user could double click thing saying "double click me to install". There, problem fixed. No harm done. MacOS software industry didn't collapse, people didn't look to their newly purchased devices without clue...
As a person in TV industry, I can really relate to "people still running windwos 2000" but, trust me, it is absolutely suicidalif one doesn't run a commercial quality AV actually doing heuristics like Kaspersky or F-Secure.
I am not a shareholder in these companies of course, it is just that they are running way deeper security checks and actually watching what really happens on the OS. People blame them for being heavier than "freeware av" for that reason.
If you can live with pro-active way of doing things, Comodo AV which is freeware, in case it works under Win2K is a good choice too. It is like eSafe end user version (which has been abandoned) which really figures the threats even if it has no clue about them.
While on it, OS X 10.4.11 Tiger doesn't get security updates too. I can only (unfortunately) suggest Intego Virusbarrier which is a bit pricey to them. There is a cost of having to use older commercial operating system. Obviously, I don't think there is a black hat dumb enough to specifically target some poor guy being forced to run 10.4.11 and spend time on it.
An ipad? ROTFL. Let's see you develop SOFTWARE for that ipad... on your ipad.
Apple users need to learn to speak without steve's hand up their anus...
Black hats everywhere would like to thank you for aiding them in their quest to own the internet...
They can revoke keys but then there is a new problem:
-What if the system becomes unusable without a certain driver ( maybe even because the rootkit kills the system deliberate in that case). Who is responisble.
-If the user gets prompted, what are his options? (e.g. in the simple case his system clock is wrong, but the error message is not clear).
-What if revoking disables the sound of 66% of the windows machines and ONLY disable 0,001% the rootkit (but not even the actual virus).
If you think this over, you realize how much issues there are with revoked/expired certificates. The math behind them is correct, but the consequences are much more complicated.
Why is this called an "emergency" fix? Just curious.
The .LNK Binary File Format is an Open Specification provided by Microsoft via the following document:
http://msdn.microsoft.com/en-us/library/dd871305(PROT.13).aspx
~ king
SP2 support ended earlier this month. You know what that means. No patch unless you have a custom support contract. Hasta la vista.
Yes, the drivers would stop working, which would bring the shitstorm against the HW manufacturer. That was my point.
But according to your "sibling" post Windows HW certs don't work like that, so there's nothing Microsoft can do.
Dilbert RSS feed
While they are at it they should remove the functionality to open a .lnk file in media player. My wife had media player as the default player, and she had some .mp3 files on her system. I'm guess she got these from limewire or something. They wouldn't play in itunes, so I tried opening them in media player and it said it was a filetype that didn't match it's extension, open anyways? So I said yes, thinking that it might of been a wma that was renamed by a dummy, and then instantly a web browser window opened up to some website. The file itself was 5 megs, so I'm guessing it had a .lnk header and then either padded the rest with the original mp3 or just dummy data.
Since many Corps still refuse to upgrade to SP3, get ready for swath of news with IT failing to quell SP2 only rootkits and worms.
I suspect it wouldn't work that way anyway. More likely, Microsoft would revoke the certificate, and then everyone would blame them because "My computer doesn't work". Seriously, think of normal people having this problem.
Years ago I bought a CD of American McGee's Alice. This was the only game cd I ever actually paid for, and I even installed XP just to run it. Guess what? It never worked. I tried tracking down support info, I tried several tricks and patches and the goddamn thing never worked. The closest I ever got that damn disk to working was under wine. Oh, the irony.
A 360 does what it does. A 360 is not a desktop with access to all my email and shit. A 360 may be a walled garden but that's fine just so long as it plays a fucking game CD when I bring it home. Why anyone would want to fuck around for hours with making a desktop play games is beyond me.