Microsoft warns of critical unpatched Windows Shell vulnerability
Microsoft issued a security bulletin on Friday to warn customers of a 0-day exploit involving the Windows Shell.
The vulnerability is caused due to an error in Windows Shell when parsing shortcuts (.lnk). The flaw can be exploited automatically by executing a program via a specially crafted shortcut. Certain parameters of the .lnk are not properly validated on load, resulting in the vulnerability. Microsoft says it has "seen only limited, targeted attacks on this vulnerability."
For the exploit to be successful it requires that users insert removable media (when AutoPlay is enabled) or browse to the removable media (when AutoPlay is disabled). According to Microsoft's advisory, exploitation may also be possible via network shares and WebDAV shares. Microsoft states that the exploit affects all Windows versions since Windows XP, including Windows 7. However, Security Researcher Chester Wisniewski of Sophos, reports that Windows 2000 and Windows XP SP2 (both unsupported by Microsoft) are affected by the flaw.
Sophos explain that the flaw bypasses all Windows 7 security mechanisms, including UAC, and doesn't require administrative privilege to run. In a blog posting, Sophos researchers demonstrate the flaw (see below) on Windows 7, which becomes infected with a rootkit as a result.
Microsoft says users could halt attacks by disabling icons for shortcuts and switching off the WebClient service. Unfortunately the suggestion is far from ideal for most corporate customers, disabling icon shortcuts will likely result in mass confusion for users and turning off the WebClient service will render Microsoft SharePoint useless. Microsoft has not confirmed when a patch will be made available for the issue. The company's next patch Tuesday is scheduled on August 10.
Source
The vulnerability is caused due to an error in Windows Shell when parsing shortcuts (.lnk). The flaw can be exploited automatically by executing a program via a specially crafted shortcut. Certain parameters of the .lnk are not properly validated on load, resulting in the vulnerability. Microsoft says it has "seen only limited, targeted attacks on this vulnerability."
For the exploit to be successful it requires that users insert removable media (when AutoPlay is enabled) or browse to the removable media (when AutoPlay is disabled). According to Microsoft's advisory, exploitation may also be possible via network shares and WebDAV shares. Microsoft states that the exploit affects all Windows versions since Windows XP, including Windows 7. However, Security Researcher Chester Wisniewski of Sophos, reports that Windows 2000 and Windows XP SP2 (both unsupported by Microsoft) are affected by the flaw.
Sophos explain that the flaw bypasses all Windows 7 security mechanisms, including UAC, and doesn't require administrative privilege to run. In a blog posting, Sophos researchers demonstrate the flaw (see below) on Windows 7, which becomes infected with a rootkit as a result.
Microsoft says users could halt attacks by disabling icons for shortcuts and switching off the WebClient service. Unfortunately the suggestion is far from ideal for most corporate customers, disabling icon shortcuts will likely result in mass confusion for users and turning off the WebClient service will render Microsoft SharePoint useless. Microsoft has not confirmed when a patch will be made available for the issue. The company's next patch Tuesday is scheduled on August 10.
Source
How To: Change Chrome's channel
People love Google Chrome, it's as simple as that. But did you know that Google puts out three versions of Chrome? In this How To video, we recap the differences and show you how to jump between builds, also known as channels, in Chrome.
Try jumping between the stable, beta, and developer's channels yourself using the installers for Windows (stable| beta | dev), Mac (stable | beta | dev), and Linux (all versions). Note that at the time of publication, the stable and the beta channels are synchronized, but that's not always the case.
Apple defensive over Consumer Reports findings, deletes forum threads
Can you hear me now?
(Credit: Apple)The seemingly unending saga of the iPhone 4 antenna issues has grown yet again. After a negative report from Consumer Reports, Apple has apparently deleted all threads about the findings from its popular Support Discussions forums. As Kent German reported earlier today, Consumer Reports has issued its official stance on iPhone 4 and it can't recommend the phone.
Moderators for Apple's Support Discussions forums quickly deleted growing threads discussing the Consumer Reports articles. Though these threads are no longer viewable, you can read through cached versions via Bing.
Despite the generally positive reputation that Consumer Reports enjoys, many Apple fans vehemently defend iPhone 4 throughout the thread. It will be interesting to see what sort of fallout this finding will produce in terms of sales for iPhone 4 moving forward. Despite the early reports of these very issues, iPhone 4 still outsold iPhone 3GS by nearly double over its first few days. Not to mention, Consumer Reports has already stated that the issues related to iPhone 4's antenna are not unique to iPhone 4.
Also interesting to note, Consumer Reports does rate iPhone 4 as the best smartphone currently available, sans the antenna issue, which it has now concluded is a hardware flaw inherent to iPhone 4's design. Apple has insisted the issues are a software problem to be fixed in the next release of iOS 4.
The next move will be Apple's, and I have to believe every software engineer available is working on a solution via an iOS 4 update. Should the antenna issue prove to be hardware related, the recall could be devastating to Apple's iPhone future and a huge win for other smartphone developers fighting tooth and nail for market share with the iPhone brand.
Should Apple Support Discussions forum moderators have deleted threads regarding the latest article from Consumer Reports? Is the antenna issue affecting your decision to purchase iPhone 4? Let us know in the comments!
Malware With Real Support - Now I've Seen It All
Is your rogue antimalware product not meeting your expectations? Perhaps you should contact support. Nicolas Brulez of Kaspersky recently blogged about how some of these gangs are offering tech support with their products that has live chat, e-mail, phone, and even multiple languages.
We've truly stepped through the looking glass now, especially when you consider all the legitimate products that don't offer support this good. It says something about how much money is still being made by rogue products. It also says something about how affordable outsourced support using scripted response is.
(click image for larger version.)
(click image for larger version.)
And according to Kaspersky the support, including the live chat, really is with real people, not a bot. If you have trouble with English, the chat tells you (in English) to send your support request to a particular e-mail address, and then you receive support in your native language. Some of the rogues have native language support based on the language of your Windows version. No word on which languages are supported, but put your money on Russian.
COMODO vs Malware Research Group
Malware Research Group video :
MRG Financial Malware Simulator VS Comodo
My Response to MRG/Comodo video
Support For Windows XP SP2 Ends This Coming Tuesday
This coming Patch Tuesday, July 13, will be the last day that security updates for Windows XP Service Pack 2 will be released.
After July 13, the product goes from its "Extended Support Phase" to "Self-Help Online Support." Security updates and non-security hotfixes will no longer be available. What will be left? For at least a year "Microsoft online Knowledge Base articles, FAQs, troubleshooting tools, and other resources, are provided to help customers resolve common issues."
If you feel you must remain on Windows XP, your only practical option is to installService Pack 3. More information about this situation can be found in this entry on the Microsoft Support Lifecycle Blog.
Subscribe to:
Posts (Atom)
Posts
