Unpatched Windows 7 vulnerability & stealthy rootkit

[Sednogmah]

As I already mentioned yesterday in the Shoutbawx, there are rumors about a new yet unpatched and unpublished 0-day vulnerability in Windows 7. The exploit seems to target a flaw in Explorer's shortcut file (.LNK) parser. What's really noteworthy though is how it installs rootkit drivers that have valid digital signatures. The keys were probably stolen from developers at RealTek.

The result? You plug in an infected USB stick and a complete rootkit hides itself without any warning whatsoever. Disabling Auto-Play does not help.

Sources:
- Slashdot IT Story | Malware Targets Shortcut Flaw In Windows, SCADA
- News | VirusBlokAda

[Sednogmah]

Microsoft has now confirmed the flaw and there's a PoC exploit for local media like USB thumb drives and a more or less PoC for network shares:

How to use the “Windows Link Icon” Metasploit WebDAV exploit « Sploitboiler.

Be very careful with external media like USB drives and network shares!

Microsoft's official workaround is hilarious:

Who needs icons? *g*