Malware Authors Seem Intent on Weaponizing Windows SettingContent-ms Files (bleepingcomputer.com)

An anonymous reader shares a report: Malware authors are frantically trying to weaponize a new infection vector that was revealed at the start of June. The trick relies on using Windows Settings (.SettingContent-ms) shortcut files in order to achieve code execution on Windows 10 PCs. Ever since SpecterOps security researcher Matt Nelson published his research on the matter three weeks ago, malware authors have been playing around with proof-of-concept code in attempts of crafting an exploit that can deploy weaponized malware on a victim's system. With each passing day, more and more exploits are being uploaded on VirusTotal.

Comments

Doesn't Microsoft hire black hats?

[mykepredko]

Good description of the .SettingContent-ms exploit - I would have thought that this would jump out to a Malware author as soon as the feature was announced (regardless of the fact that there is ASR used by large network sysadmins).

Doesn't Microsoft have a bunch of people on staff that think like black hats (probably because they used to be them) with the task of looking for problems like this? At the very least shouldn't somebody have twigged onto the idea that providing a new way to allow new programs to run (as well as spawn new processes) be something that Microsoft security should review?

Re:Doesn't Microsoft hire black hats?

[JaredOfEuropa]

One really doesn’t have to be a blackhat to spot at least some of the various issues of this feature. This isn’t security expert stuff, but “what the hell were they smoking” territory.

We wouldn’t need these shortcuts in the first place if MS kept the control panel at least somewhat consistent between versions, instead of rearranging the control panel and every damn thing in it on every release. Including Windows Server releases. IIRC some stuff (might have been Exchange related) went from a control panel item to something under the start menu to a double secret (separately downloadable) MMC snap-in (and who came up with that brilliant idea) to a web interface.