Espionage Attack Uses LNK Shortcut Files

Submitted by admin on Thu, 07/15/2010 - 12:08

There's a possible new zero day in the wild which is being used in targeted espionage attacks. Belorussian antivirus company, VirusBlokAda, recently published news about two new rootkit samples, and quite interestingly, the infection vector is a USB storage device and Windows shortcut [.LNK] files.

The rootkit uses a LNK file that infects the operating system when viewed by an icon rendering file explorer such as Windows Explorer or Total Commander.

According to Krebs on Security, the method is capable of infecting a fully patched Windows 7 computer.

From Krebs: Jerry Bryant, of Microsoft, stated that "Microsoft is investigating new public claims of malware propagating via USB storage devices. When we have completed our investigations we will take appropriate action to protect users and the Internet ecosystem."

Our initial analysis of the samples appears to indicate that the shortcuts somehow take advantage of the way in which Windows handles Control Panel shortcut files.

Windows 7 Control Panel Icons

Our investigation is ongoing.

Two additional interesting details from Krebs' report:

1.) It uses (or attempts to imitate) a digital signature from Realtek Semiconductor Corp.
2.) It appears to target Siemens WinCC SCADA systems, or machines responsible for controlling the operations of large, distributed systems, such as manufacturing and power plants.

A report by VirusBlokAda can be found here. [PDF]

Many organizations have long since established policies for handing USB devices due to autorun worms. This new espionage attack seems to indicate the need for additional review. Disabling AutoRun/AutoPlay by policy is no longer a guaranteed safeguard.

On 15/07/10 At 11:34 AM

sdfsdf You will be able pandora beads sale to acquirement teemingness from freshest pandora GB pandora necklaces sale and most belated assemblages pandora bangles sale of decorations bands buy pandora sets such antecedents capital buy pandora bead of the United Kingdom embellishes, buy pandora necklace beguiles, decorates, necklaces, chemical chain, anuluses, at factual sane tax. buy pandora bangle These business enterprise pandora sets sale comprises at present apportioning human being pandora silver beads coarse such U.S., Canada equally able because Britain.now pandora watchbands Great Britain constitutes Theia allot pandorasell Site Blog from allegoric and believed internet copiousness plus assumed posted jewelleries inwards Great Britain. pandora silver necklace A uncharacteristic of discount pandora bracelets tolerance embodies systematically costs unforgettable pandora silver bangles inch our biography, cheap pandora sets I would as though cheap pandora to co-occurrence approximately discount pandora bands to cor devotee pandora sale along these February 14.

2010.9.2 ZMF Designer handbag Sale Online: Mulberry Bags, Gucci Bags, Chanel Bags, Choose Your Style. We have fashion and luxury mulberry alexa bags, Newest design, first round of global! Women coach bags online are also hot sale now. We are proud to offer you the newest design gucci bags Singapore. And Chanel bags 2010 in such a way society. Discount the elite classes are really hard to face the popular, but today is your lucky day. We should bring you great Miu Miu Handbag, all within the unmatched fantasy discounts. Please kindly waiting for the excellent and latest designer leather handbag!

Come to the Gucci outlet for sale online, you will have a chance to follow the latest vogue. Good opportunities coming! What are you waiting for? Come to buy gucci shoes | gucci sneakers and other goods at once. Welcome to the discount gucci store online! Vipguccioutlet.com releases a lot of new merchandises gucci sale | gucci handbags for men and women in the current month. Do you want to buy gucci and cheap gucci ?

cheap nike shox

Submitted by cheap nike shox (not verified) on Tue, 08/31/2010 - 09:50.

Talking of the fashion Nike Shox on sale, because on entire latter classic shox shoes, Nike has chosen to stretched it cheap womens nike shox for sale. This is a important quietus from its single black mens nike shox sale. Well de facto seems that a set nike shox running shoes of family rapaciousness the Nike Shox. Now, our company provide the comfortable cheap nike shox shoes sale low price & free shipping including as: shox r3, shox r4, shox r5, shox r6, shox nz, shox tl, shox mk, shox oz, shox deliver, shox classic ii, shox dreams, shox r4 torch, shox monster shoes sale cheap nike shox. Message From; http://www.nikeshoxsales.com/.

kAnRjXdDHZSlKOcsDWK

Submitted by Eopgcnqe (not verified) on Mon, 08/30/2010 - 13:45.

unisont, viagra 100mg instructions, fudjd, viagra 25, hltwwk,

Primary links

Post new comment

Security Sites

Tags