X

Aggregator

Microsoft Isn't Fixing 8-Year-Old Shortcut Exploit Abused For Spying

Slashdot
3 months 2 weeks ago
Trend Micro uncovered an eight-year-long spying campaign exploiting a Windows vulnerability involving malicious .LNK shortcut files, which attackers padded with whitespace to conceal commands. Despite being reported to Microsoft in 2023, the company considers it a UI issue rather than a security risk and has not prioritized a fix. The Register reports: The attack method is low-tech but effective, relying on malicious .LNK shortcut files rigged with commands to download malware. While appearing to point to legitimate files or executables, these shortcuts quietly include extra instructions to fetch or unpack and attempt to run malicious payloads. Ordinarily, the shortcut's target and command-line arguments would be clearly visible in Windows, making suspicious commands easy to spot. But Trend's Zero Day Initiative said it observed North Korea-backed crews padding out the command-line arguments with megabytes of whitespace, burying the actual commands deep out of sight in the user interface. Trend reported this to Microsoft in September last year and estimates that it has been used since 2017. It said it had found nearly 1,000 tampered .LNK files in circulation but estimates the actual number of attacks could have been higher. "This is one of many bugs that the attackers are using, but this is one that is not patched and that's why we reported it as a zero day," Dustin Childs, head of threat awareness at the Zero Day Initiative, told The Register. "We told Microsoft but they consider it a UI issue, not a security issue. So it doesn't meet their bar for servicing as a security update, but it might be fixed in a later OS version, or something along those lines." After poring over malicious .LNK samples, the security shop said it found the vast majority of these files were from state-sponsored attackers (around 70 percent), used for espionage or information theft, with another 20 percent going after financial gain. Among the state-sponsored crews, 46 percent of attacks came from North Korea, while Russia, Iran, and China each accounted for around 18 percent of the activity.

Read more of this story at Slashdot.

BeauHD

Gavin Newsom Is Reportedly Sending Burner Phones To Tech CEOs

Slashdot
3 months 2 weeks ago
According to Politico, Gov. Gavin Newsom has distributed prepaid burner phones to around 100 California business leaders, giving them direct access to him and reinforcing his pro-business stance. "If you ever need anything, I'm a phone call away," read one of the notes. From the report: It was Newsom's idea, a representative said, and has already yielded some "valuable interactions." That arrangement surprised some people POLITICO spoke with, largely because Newsom is already known as an inveterate texter whose digits live in many business titans' contacts. He's also long been seen as more aligned with business interests than the Legislature, the proverbial adult in the room when private pillars like Silicon Valley need a sympathetic ear or a veto. But Newsom wanted to convey that he's intent on maintaining California's competitive edge. Phones are still going out. The California Protocol Foundation picked up the tab. That organization gets money from businesses and nonprofits for gubernatorial expenses like trips abroad -- or, evidently, burner phones -- so taxpayers aren't on the hook. It also drew leftover funds from Newsom's inauguration account, which itself drew business, so in a roundabout way California's private sector helped fund phones nurturing ties with the private sector.

Read more of this story at Slashdot.

BeauHD