Microsoft isn't fixing 8-year-old shortcut exploit abused for spying

https://www.theregister.com/2025/03/18/microsoft_trend_flaw/

by rntn • 1 year ago

33 13 1 year ago

duxup• 1 year ago

"We told Microsoft but they consider it a UI issue, not a security issue. So it doesn't meet their bar for servicing as a security update, but it might be fixed in a later OS version, or something along those lines."

This reads like someone at Microsoft looked at the issue and decided that this issue is technically "not my job".

pacifika• 1 year ago

Or it’s in use by the good guys?

TeMPOraL• 1 year ago

There's a long report linked by the source here: https://www.trendmicro.com/en_us/research/25/c/windows-short...

Lots and lots of words, but tl;dr seems to be that it's just the .lnk equivalent of someone adding `logout` to your .bashrc, prepending it with a couple hundred spaces, and hoping your favorite editor doesn't have line wrap turned on. Except here, it's a fixed-width one-line GUI textbox, so there's no vertical space for line wrap, and the "hidden" commands are not a prank.

If the overall info on exploitation is accurate, it's quite surprising just how far one can go with most trivial of tricks.

charcircuit• 1 year ago

It's more like you downloaded a .desktop file from someone untrusted.

do_not_redeem2• 1 year ago

So you can change the icon of a shortcut and rename it to something misleading? That's an awfully weak "exploit". No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE.

ziddoap• 1 year ago

No wonder it was given a "ZDI-CAN" number (whatever that is) instead of an actual CVE.

ZDI = Zero Day Initiative.

https://www.zerodayinitiative.com/advisories/published/

I don't particularily agree with some of their philosophy, but they are smart folks and valuable to monitor alongside CVE. It's not like it's some backalley discount version of CVE. They've been around for 20 years, after all.

AStonesThrow2• 1 year ago

So a .LNK is just a special case of scripting executable file. Now, reading the last line of the article, the quote from the spokesperson, seems to indicate that security warnings are already enabled for an untrusted .LNK downloaded from the Internet. It seems that both iOS and Windows are now flagging any executable that's downloaded as "untrusted", until the user plows through the warnings to run it anyway.

So if .LNK is treated as .EXE and .COM and .BAT, then I would say that there is parity there. Unfortunately, typical users aren't sophisticated enough to recognize that a .LNK is an arbitrarily-coded script file, nor to inspect it closely enough when these Evil North Koreans found a way to obfuscate it.

We're still at a level where typical troubleshooting instructions include: "destroy all your data/cookies/cache, disable your firewall & anti-malware, and run this with admin privileges" because sure enough, those pesky security measures can indeed interfere with legitimate operations.

It's the same thing when you tell users to "check the full URL on preview to make sure it's OK before you click it." Well, bud, I'll show you punycode, and link shortener/redirection, and thousands of legitimate gTLDs, and weighing that against the expertise of a typical consumer on what a "valid URL" looks like, not going to help.

schroeding2• 1 year ago

The thing is that Windows does not show the .lnk Ending, same for .pif (which can just be a normal MZ Windows EXE), even if all other endings are shown. So your bill.pdf.lnk is shown as bill.pdf, while bill.pdf is also shown as bill.pdf.

(This may have changed with new versions of Windows 11, I'm stopped working in this area a few years back)

colejohnson66• 1 year ago

No. By default, “bill.pdf” will show as just “bill”. All “known” file extensions (i.e., those with a handler) are hidden.

Microsoft isn't fixing 8-year-old shortcut exploit abused for spying

Related Stories