The Windows Shortcut Exploit, also known as CPLINK, is a zero-day vulnerability in all versions of Windows that allows a Windows shortcut link, known as an .lnk file, to run a malicious DLL file. The dangerous shortcut links can also be embedded on a website or hidden within documents.
This exploit works when you open a device, network share or point carrying an infection—you don't need to click on anything for the exploit to work, even if you have AutoPlay and AutoRun disabled. The exploit appears to be particularly effective with PDF file shorcuts.
Simply opening a Windows directory using Internet Explorer (either the desktop utility or the web browser) can allow the malicious shortcut file to launch its attack—a user does not have to open the shortcut file itself to be compromised. The spread of malicious shortcut files has been especially effective through infected USB memory sticks, although the they can also be distributed through fraudulent e-mails and web sites.
Once the malicious shortcut file compromises a computer, the computer can be accessed by hackers from the Internet. Hackers can then install additional software to remotely control the computer, remove data from the computer, and steal passwords.
Microsoft has discovered that Windows-based SCADA (supervisory control and data acquisition) as well as plant and manufacturing computers running Microsoft Windows are being specifically targeted by hackers exploiting this vulnerability. The attacks are intended to deliberately compromise, disrupt, and damage power utility and supplier control systems.
Microsoft Patch now available via Updates ! http://go.microsoft.com/fwlink/?LinkID=40747Microsoft Bulletin with security fix download for specific Windows versions: http://www.microsoft.com/technet/security/bulletin/MS10-046.mspxMicrosoft Advisory - http://www.microsoft.com/technet/security/advisory/2286198.mspxTool to find and remove this exploit;http://www.sophos.com/products/free-tools/sophos-windows-shortcut-exploit-protection-tool.htmlMore details on this exploit ;http://www.itworld.com/print/114561http://www.sophos.com/security/topic/shortcut.htmlhttp://www.computerworld.com/s/article/9179339/Windows_shortcut_attack_code_goes_public
Author
