Fix or not to fix?

This is an odd one, Microsoft has no plans to fix this issue even though it appears to be being actively exploited and has been for some time.

New Windows zero-day exploited by 11 state hacking groups since 2017 – BleepingComputer

The attack exploits a weakness in the .lnk file – something we all use to link to resources on our computers – by padding extra malicious code into the file. The code is easily obfuscated from casual inspection by the inclusion of white space with the malicious code. Run the link and the malicious code runs.

The links get to the victims in the usual way – phishing, malicious websites, etc..

To quote the BleepingComputer article “[Microsoft] declined to address this vulnerability with a security patch.”

I am sure Microsoft has its reasons for not patching but it does highlight that you and your organisation needs the best technical defences it can afford – don’t get me started on the organisations I meet with who still use “free” anti-virus packages!

Technology Solutions

Further Reading

And we thought blocking Microsoft Office macros was a good idea – but close one door to the threat actors and of course they find another way to get to you…