We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Microsoft issues tool to stop Windows Shortcut attacks

Fix it tool makes desktop, taskbar and Start menu almost unusable

Microsoft has released an automated tool to stop exploits of a critical unpatched Windows vulnerability that experts fear will soon be exploited by hackers.

However, the tool, like a manual procedure that Microsoft recommended last week, is only a makeshift defence, one that many users may resist applying since it makes much of Windows, including the desktop, taskbar and Start menu, almost unusable.

The company posted a 'Fix it' tool on its support site that automatically disables the displaying of all Windows shortcut files. Microsoft stepped users through the same technique last week in its initial security advisory, but told them then that they had to edit the Windows registry. Most Windows users are reluctant to monkey with the registry, since a single error can cripple the computer.

Microsoft's single-click Fix it tool simply automates that process. Users must reboot their machines after applying the workaround, but IT administrators can configure the tool to install it while users are out of the office or not at their PCs.

The company admitted that applying the Fix it or the registry-editing workaround would "impact usability" of the machine since both transform the usual graphical icons on the desktop and elsewhere into generic white icons, making it impossible to tell at a glance which represents Internet Explorer, and which stands for, say, Microsoft Word.

Microsoft also revised its security advisory, originally published last Friday, to tell corporate administrators that they could defend against attacks by also blocking downloads of shortcut files - identified by the '.lnk' extension - and '.pif' files at the network perimeter.

The Windows shortcuts vulnerability was first described more than a month ago by VirusBlokAda, a little-known security firm based in Belarus, but first attracted widespread attention after security blogger Brian Krebs< reported on it last week. A day later, Microsoft confirmed the bug and admitted that small-scale attacks were already exploiting the flaw.

All versions of Windows contain the vulnerability, including the preview of Windows 7 Service Pack 1 (SP1), and the recently retired-from-support Windows XP SP2 and Windows 2000.

Hackers can craft malicious shortcut files that in turn automatically execute malware whenever a user simply views the contents of a folder containing the malformed shortcut. Initial reports noted that attacks were using infected USB drives to hijack Windows PCs running Siemens software that manages large-scale industrial control systems in major manufacturing and utility companies.

Siemens has confirmed that one of its customers, a German manufacturer it declined to name, had been victimised by an attack exploiting the shortcut bug.

Microsoft has promised to patch the problem, but has yet to name a date. The next regularly scheduled security updates are to ship in less than three weeks, on August 10.

Researchers are split over Microsoft's expected timetable. But the release of the Fix it tool is little help in parsing Microsoft's plans. The company released a similar tool in mid-June for a zero-day vulnerability that went public the day before, but waited 32 days after that to deliver a patch. In March, however, Microsoft patched a critical Internet Explorer vulnerability just 18 days after issuing a Fix it to block attacks.

See also: Patching shortcut flaw could prove tough for Microsoft


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

Chromebooks: ready for the prime time (but not for everybody)

IDG UK Sites

Hands-on with Sony's latest smartglasses

IDG UK Sites

The 13 most inspirational Tim Cook quotes