LNK Vulnerability is bigger than just USB keys.

Hi there everyone.

I trust this update finds you all well and you are looking forward to a great weekend.

My I offer a piece of advice for this weekend?
AVOID "LNK" FILES LIKE THE PLAGUE!

I was drafting the previous post regarding the fact that a USB key no longer requires an autorun file to perform an infection, but it seems that is now only one small part of the over all issue.

One of our newer staffers here at Trend in Sydney has many security qualification, and certifications, including many industry regulatory compliance advisory certifications as a result of his time with Visa Europe.  As a result of all this knowledge he was able to craft some impromptu internal demonstrations for us to show us the extent and possibilities that this particular vulnerability presents.

Needless to say the outcome is concerning.

Without even so much as a double click, he had complete control of a demo-lab machine remotely, executing commands without hindrance.

As a result of a wonderful flaw in Microsoft a number of articles need to be viewed.

Microsoft Security Advisory - Temporary "Fix It For Me" tool This will be superseded by the patch that Microsoft eventually releases.
Microsoft Security Response Center
Information about the vulnerability
Trend Updates as a result of related Malware

Guys, just be aware - a LNK file can be propagated via any number of vectors.  A web site, an email a USB, and as a result of the way this vulnerability works the user does not need to interact with the LNK file at all.  As a result of Windows rendering the LNK file icon, the contents are executed to perform the exploit.  And as you know an LNK file can point to ANYTHING and in this case, ANY type of exploit!

Be careful, and keep a keen eye out for the impending Microsoft fix since this is going to be the most effective way to protect your customers.

Have a great weekend!