WARNING: USB-based malware ignoring Windows AutoRun config

happygeek 0 269 Views

The good news is that security savvy Windows users will, more than likely, have already disabled the AutoRun and AutoPlay features. The bad news is that a new zero-day vulnerability could care less, and executes automatically anyway.

The zero-day vulnerability in question was first spotted by Sergey Ulase, a researcher with security vendor VirusBlokAda, who when "You should take into consideration that virus infects Operation System in unusual way through vulnerability in processing lnk-files (without usage of autorun.inf file). So you just have to open infected USB storage device using Microsoft Explorer or any other file manager which can display icons (for i.e. Total Commander) to infect your Operating System and allow execution of the malware".

Microsoft has eventually picked up on this, yet another Windows vulnerability , and has now issued a Security Advisory (2286198) which confirms it is "investigating reports of limited, targeted attacks exploiting a vulnerability in Windows Shell" then goes on to state that the vulnerability exists "because Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the icon of a specially crafted shortcut is displayed".

According to security experts at Sophos , a new rootkit has been discovered which goes by the name of Stuxnet and exploits this vulnerability to install itself onto even a fully patched Windows PC by running from a USB memory stick even if the user has disabled Windows AutoRun and AutoPlay. It does, however, require the user to browse the device using Windows Explorer in order to be able to do this, rather than just execute automatically upon insertion.

"Threats such as the infamous Conficker worm have spread very successfully via USB devices in the past, but were in part reduced by disabling AutoPlay. The risk is that more malware will take advantage of the zero-day exploit used by the Stuxnet rootkit, taking things to a whole new level" Says Graham Cluley, senior technology consultant at Sophos, adding "the exploit is still being analysed by the security community, but there are disturbing suggestions that the malware could be trying to access data specific to Siemens SCADA systems - software that controls national critical infrastructure".

memstickrun.jpg 15.33 KB

Dani AI

Generated

raised the right alarm. For historical context and to help anyone landing here later: the Windows shortcut parsing bug exploited in the Stuxnet era is tracked as CVE‑2010‑2568 and was fixed in Microsoft’s out‑of‑band bulletin MS10‑046 — apply that update to any still‑vulnerable hosts. (learn.microsoft.com)

If immediate patching isn’t possible, apply Microsoft’s tested workarounds and gateway controls: disable display of shortcut icons (Microsoft “Fix it”), block .LNK/.PIF downloads at network perimeter, consider disabling the WebClient service, enforce strict USB/device policies and least‑privilege accounts, and keep AV signatures current. Those mitigations were recommended by vendor and government guidance when the bug was active. (learn.microsoft.com)

If a machine is suspected of compromise, isolate and image it before cleanup. Use Sysinternals Autoruns to hunt persistence points and Sigcheck to inspect driver signatures; Stuxnet variants used kernel drivers signed with stolen certificates (notably tied to Realtek/JMicron in the original investigations), so unexpected signed drivers are a red flag. (learn.microsoft.com)

Quick helper (PowerShell) to list .lnk files and their resolved targets on a removable drive:

$w = New-Object -ComObject WScript.Shell
Get-ChildItem -Path 'E:\' -Filter *.lnk -Recurse -ErrorAction SilentlyContinue |
  ForEach-Object {
    $s = $w.CreateShortcut($_.FullName)
    [PSCustomObject]@{Shortcut=$_.FullName; Target=$s.TargetPath; Arguments=$s.Arguments}
  } | Format-Table -AutoSize

The COM method above is a common way to resolve .lnk targets for hunting; use it on a read‑only image or isolated host. (waynes-world-it.blogspot.com)

If SCADA/ICS equipment might be affected, elevate to ICS security specialists — industrial control incidents require cautious, coordinated response (do not reconnect USB media or rebuild controllers without vendor/IR guidance). For deeper technical background on the threat and its signatures, see the vendor analyses linked above. (usa.kaspersky.com)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview