Security Activity Bulletin

Microsoft Windows .lnk File Vulnerability Used for Malware Outbreak Targeting SCADA Systems

 
Threat Type:IntelliShield: Applied Mitigation Bulletin
IntelliShield ID:20915
Version:6
First Published:2010 July 16 15:52 GMT
Last Published:2010 August 27 13:02 GMT
Port: Not available
CVE:CVE-2010-2568
BugTraq ID:41732
Urgency:Possible use
Credibility:Confirmed
Severity:Moderate Damage
CVSS Base:9.3 CVSS Calculator
CVSS Version 2.0
CVSS Temporal:8.1
 
Version Summary:

ICS-CERT has released security advisories to address the vulnerability exploited by malicious software.

 

Description
 

New malware, called W32/Stuxnet-B, has been reported.  This malware propagates using USB drives apparently infected with malformed shortcut (.lnk) files.  F-Secure detects the LNK exploit as Exploit:W32/WormLink.A.  Reports suggest that the malformed shortcuts exploit a remote code execution vulnerability in Microsoft Windows, which has been reported in IntelliShield Alert 20918.

Reports suggest that a successful exploit would require the targeted user to view the contents of the USB drive using Windows Explorer or other applications that display file icons.  However, the malicious link vulnerability could be used to target any Windows systems through removable media.

The malicious code is contained in drivers that appear to be digitally signed by Realtek Semiconductor Corp, which could help the code bypass controls that require drivers to be signed.  The same reports confirm the vulnerability on completely patched Microsoft Windows 7 installations as of July 15, 2010.

Event data from Cisco Remote Management Services has detected intrusion prevention system signature activity related to this vulnerability.  The data, which was captured on July 27, 2010, could indicate that  malicious software distribution is increasing in the wild.

One suggested method of additional propagation is through the SQL facilities in WinCC.  Reports have indicated that the WinCCAdmin and WinCCConnect account passwords for WinCC are hard-coded, allowing potential exploits to run commands on the host operating system through SQL instructions executed using these account credentials.  Further, Siemens forum postings suggest that administrators are advised against changing the passwords.  If these reports are accurate, this could result in a wide exposure for sites that use WinCC, which is human-machine interface software for process control systems used for things like critical infrastructure and manufacturing.

User interaction, if needed, is limited to inserting the USB drive and viewing its contents.  Further user interaction is not needed.

Systems that have disabled AutoRun for USB drives do not appear to be protected from this automatic execution of .lnk files.

Administrators are advised to configure antivirus software to scan media upon insertion.  Administrators may also consider disallowing USB drives or other removable media from sensitive environments.

Users are advised not to plug in USB drives from unknown sources.

Microsoft has released a security bulletin at the following link: MS10-046.  Microsoft customers can obtain updates directly by using the links in the security advisory. These updates are also distributed by Windows automatic update features and available on the Windows Update website. Microsoft Windows Server Update Services (WSUS), Systems Management Server, and System Center Configuration Manager can assist administrators in deploying software updates.

Proof-of-concept code that exploits this vulnerability is publicly available.

Siemens has confirmed that the malicious code exploiting this vulnerability is targeting Siemens WinCC SCADA systems.  Further details are available at the following link: SIMATIC WinCC / SIMATIC PCS 7.  However, software updates are not available.

ICS-CERT has released advisories at the following links: ICSA-10-201-01C and ICSA-10-238-01

US-CERT has released a vulnerability note at the following link: VU#940193


Signatures
 
Cisco Intrusion Prevention System (IPS) 6.0
Signature IDSignature NameReleaseLatest Release Date
2503/0Generic EXE File DownloadS7282013 Jul 18 
2503/1Generic EXE File DownloadS7282013 Jul 18 
27839/0Windows LNK File Code ExecutionS6582012 Jul 19 
27839/1Windows LNK File Code ExecutionS5032010 Jul 27 
27839/2Windows LNK File Code ExecutionS5622011 Apr 27 
27839/3Windows LNK File Code ExecutionS5622011 Apr 27 
27839/5Windows LNK File Code ExecutionS7282013 Jul 18 
 
Alert History
 

Version 5, August 2, 2010, 2:28 PM: Microsoft has released a security bulletin along with software updates to address the vulnerability exploited by malicious software.

Version 4, July 27, 2010, 2:20 PM: Additional information is available regarding increased malware activity.

Version 3, July 20, 2010, 10:48 AM: Siemens has confirmed that its products are being affected by the malware outbreak targeting SCADA systems.

Version 2, July 19, 2010, 10:38 AM: Microsoft has released a security advisory and software updates to address the Microsoft Windows .lnk file vulnerability related to the malware outbreak targeting SCADA systems.

Version 1, July 16, 2010, 11:52 AM: New malware has been detected that appears to rely on an undisclosed vulnerability in Microsoft Windows .lnk file handling. This malware appears to be targeted at Siemens WinCC SCADA installations.



Product Sets
 
The security vulnerability applies to the following combinations of products.

Primary Products:
Microsoft, Inc.Windows 7 for 32-bit systems Base | for x64-based systems Base
Microsoft, Inc.Windows Server 2003 Datacenter Edition Base, SP2 | Datacenter Edition, 64-bit (Itanium) Base, SP2 | Datacenter Edition x64 (AMD/EM64T) Base, SP2 | Enterprise Edition Base, SP2 | Enterprise Edition, 64-bit (Itanium) Base, SP2 | Enterprise Edition x64 (AMD/EM64T) Base, SP2 | Standard Edition Base, SP2 | Standard Edition, 64-bit (Itanium) Base, SP2 | Standard Edition x64 (AMD/EM64T) Base, SP2 | Web Edition Base, SP2
Microsoft, Inc.Windows Server 2008 Datacenter Edition Base, SP2 | Datacenter Edition, 64-bit Base, SP2 | Itanium-Based Systems Edition Base, SP2 | Enterprise Edition Base, SP2 | Enterprise Edition, 64-bit Base, SP2 | Essential Business Server Standard Base, SP2 | Essential Business Server Premium Base, SP2 | Essential Business Server Premium, 64-bit Base, SP2 | Standard Edition Base, SP2 | Standard Edition, 64-bit Base, SP2 | Web Server Base, SP2 | Web Server, 64-bit Base, SP2
Microsoft, Inc.Windows Server 2008 R2 x64-Based Systems Edition Base | Itanium-Based Systems Edition Base
Microsoft, Inc.Windows Vista Home Basic Base, SP1, SP2 | Home Premium Base, SP1, SP2 | Business Base, SP1, SP2 | Enterprise Base, SP1, SP2 | Ultimate Base, SP1, SP2 | Home Basic x64 Edition Base, SP1, SP2 | Home Premium x64 Edition Base, SP1, SP2 | Business x64 Edition Base, SP1, SP2 | Enterprise x64 Edition Base, SP1, SP2 | Ultimate x64 Edition Base, SP1, SP2
Microsoft, Inc.Windows XP Home Edition Base, SP3 | Professional Edition Base, SP3 | Professional Edition, 64-bit (Itanium) Base, SP2 | Professional x64 (AMD/EM64T) Base, SP2

Associated Products:
N/A




Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service. This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment.


LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.
Powered by  IntelliShield