Windows shortcut vulnerability with rootkit - detailed video demo by Sophos

[SamyAdel9]

labrat is the coolest logon ever!

[stuxnettruth]

Stuxnet is a false flag cyber attack launched by Iran to justify a kinetic attack on a third-party nation state. Seek the truth.

[Stasoline]

Has this been patched yet?

[allanonmage]

its the gonasyphaherpaleze of sneakernet!!!

[blacksteel25]

@klemv20 ok well show me since you think it's so easy.

[xbia1]

Sophos's tool only protects against .lnk files, not against .pif files.

[kenpaustin]

Great that Sophos quickly had a signature for the threat, but AV is basically an ineffective, reactive solution for zero-day threats like this. More proactive solutions like Application Whitelisting exist that are proactive and prevent any new code from running, which would have negated this threat and all others like it. Much better fit in closely controlled environments like those that run Siemens Process Control software,. The better solutions also stop in-memory attacks too.

[595o]

Does Sophos Anti-Virus detect the particular malware or the exploit being used?

[sigintnsa]

This is a very sophisticated attack. This worm is looking to infect systems that run Siemens SCADA (software that run power plants, nuclear aircraft carriers). It uses a signed digital certificate stolen from Realtek. Disabling Autoplay will not stop this. You just need to browse to the folder with the files. I can't believe they run nuclear aircraft carriers on windows. Hope these people changed the default password.

[majstor037]

this is nonsense...

[PUnitTheITGuy]

Which rootkit is being used in this demonstration?

[muk546]

haha windows is junk

[Borridd]

@muk546 Good joke.

[muk546]

@Borridd no joke its junk use linux or get a mac

[Borridd]

@muk546 Linux isn't an operating system and Mac is marketing gone mad.

[ThePsychoticScyth396]

@muk546 macs are overrated and they suck when it comes to games (portal lagged like a son of a cock on my bothers mac) and linux isent an operationg system its a mod

[jake2135]

@ThePsychoticScyth396 Lol at your Linux comment. I don't understand how anyone could justify linux not being an operating system. Especially how much it has deviated from unix.

[Sketchfactory]

i dont get it...

[panterml]

@Sketchfactory , yea mee to.. shity manual. ; /

[ducatidesmo77]

vai a zappare

[lux1ph3r]

non è mica un bug di seven, con xp e vista si poteva fare la stessa cosa...

[OperationLionCash]

Lol that's a pure SHIT XD

[stevecrye]

We run Sophos on all of our ~ 40,000 PCs. We love it; the terms of the agreement allow me to run it at home!

[BacklTrack]

If I wasn't running Linux..I'd be using Sophos as my AV.

[blacksteel25]

Worry more about Malware, vulnerability through Virus's/root kits are less common. Virus's tend to attack servers rather than individual users. My guess this was on the 32bit version of Win 7 since Root kits can't execute code on a 64bit OS.

[595o]

@blacksteel25 Certain kinds of root-kits might be de facto impossible on 64-bit installation but certainly not all of them.

[silviucc]

Oh this is bad, very bad. I would have expected the malware to be executed with the same user rights as the user that launched it, instead it gets elevated rights. Ouch. There is a solution from MS but it is not pretty

[ebildude123]

Interesting......

[Link77996]

Interesting demonstration, but does the actual virus itself do any other damage to the computer other than hide the shortcuts from Autoplay?

[FirefoxReview]

I hope other AV's Keep up and get the definition for the rootkit. Anyway NIce Video