Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Security Windows

Malware Authors Seem Intent on Weaponizing Windows SettingContent-ms Files (bleepingcomputer.com) 50

An anonymous reader shares a report: Malware authors are frantically trying to weaponize a new infection vector that was revealed at the start of June. The trick relies on using Windows Settings (.SettingContent-ms) shortcut files in order to achieve code execution on Windows 10 PCs. Ever since SpecterOps security researcher Matt Nelson published his research on the matter three weeks ago, malware authors have been playing around with proof-of-concept code in attempts of crafting an exploit that can deploy weaponized malware on a victim's system. With each passing day, more and more exploits are being uploaded on VirusTotal.
This discussion has been archived. No new comments can be posted.

Malware Authors Seem Intent on Weaponizing Windows SettingContent-ms Files

Comments Filter:
  • by mykepredko ( 40154 ) on Tuesday July 03, 2018 @04:58PM (#56889010) Homepage

    Good description of the .SettingContent-ms exploit - I would have thought that this would jump out to a Malware author as soon as the feature was announced (regardless of the fact that there is ASR used by large network sysadmins).

    Doesn't Microsoft have a bunch of people on staff that think like black hats (probably because they used to be them) with the task of looking for problems like this? At the very least shouldn't somebody have twigged onto the idea that providing a new way to allow new programs to run (as well as spawn new processes) be something that Microsoft security should review?

    • by JaredOfEuropa ( 526365 ) on Tuesday July 03, 2018 @05:14PM (#56889084) Journal
      One really doesn’t have to be a blackhat to spot at least some of the various issues of this feature. This isn’t security expert stuff, but “what the hell were they smoking” territory.

      We wouldn’t need these shortcuts in the first place if MS kept the control panel at least somewhat consistent between versions, instead of rearranging the control panel and every damn thing in it on every release. Including Windows Server releases. IIRC some stuff (might have been Exchange related) went from a control panel item to something under the start menu to a double secret (separately downloadable) MMC snap-in (and who came up with that brilliant idea) to a web interface.
    • Re: (Score:2, Interesting)

      by Anonymous Coward

      Doesn't Microsoft have a bunch of people on staff that think like black hats (probably because they used to be them) with the task of looking for problems like this?

      From the article:

      "Nelson contacted Microsoft, but they do not consider this a vulnerability in the OS. "

      • Re: (Score:2, Interesting)

        by LVSlushdat ( 854194 )

        Shit like this makes sooooooo VERY happy I no longer allow ANYthing MS on any network I control...

    • by gweihir ( 88907 )

      Microsoft does not even have real testers anymore....

    • >Doesn't Microsoft have a bunch of people on staff that think like black hats (probably because they used to be them) with the task of looking for problems like this?

      From the looks of Windows 10, they don't even have Quality Assurance reviewers anymore.

    • by DeVilla ( 4563 )

      Doesn't Microsoft have a bunch of people on staff that think like black hats (probably because they used to be them) with the task of looking for problems like this?

      I assumed that was who they had developing the system. I figured it was obvious when the original versions of Win10 would send your wireless credentials to everyone on any contact list it could find.

  • by Anonymous Coward on Tuesday July 03, 2018 @05:48PM (#56889246)

    In case this is news to you and you're wondering about this vulnerability, here's a description.
    Microsoft has introduced a new file format (extension: .SettingContent-ms) to link to settings pages. In this format a <DeepLink> tag contains the application to run in order to display the settings page. So like program information files (.pif), shortcuts (.lnk), batch files (.bat) and so on these should be treated as executable programs, because these files can do anything the author wishes. Just specify "%WINDIR%\System32\cmd.exe /c ..." as the command line.
    But apparently Microsoft itself didn't appropriately mark the new shortcut file type as executable and because it's a new file type, third-party vendors of things like anti-virus software, web browsers and e-mail clients haven't caught up yet either.

    • by RandomFactor ( 22447 ) on Tuesday July 03, 2018 @07:16PM (#56889608)

      It gets better.

      The actual extension name confuses at least one major email protection service and it won't catch an email containing it even if you do add it to your extension/type blocks. Test after blocking.

      Also worthy of note - Chrome warns settingcontent-ms is a potentially dangerous file type if you download one (haven't tried other browsers yet.)

  • by Anonymous Coward

    All those wankers claiming Win10 is inherently safer than Win7 because it is "new" and "supported".

    Fucking idiots the lot of them.

    Just try to imagine all of the new code in Win10 and the as-yet undiscovered exploits, just like this one.

    Code gets stronger/better/safer over time, which is almost the exact opposite of physical goods.

    • by AHuxley ( 892839 )
      But its free from MS for the user.
    • Code gets stronger/better/safer over time

      No it doesn't, it ends up full of kludges and hacks and at some point needs to be rewritten to make it stable again. Sure the new code will contain new bugs, but anything more complex than "Hello World" probably has a bug somewhere. If you want to stick with windows 7 then go for it, when the newer version of xyz software no longer runs on it you will be forced to upgrade - whether you like it or not.

      I am sure there are PC's sitting in some back room somewhere

If you didn't have to work so hard, you'd have more time to be depressed.

Working...