Comments on: Experts Warn of New Windows Shortcut Flaw

By: BrianKrebs

BrianKrebs — Wed, 02 Mar 2011 15:45:40 +0000

Thanks, Curt. My biggest regret with that story is not knowing it would be called “Stuxnet” and including that in the headline! At the time, it looked like yet another Windows 0day, albeit with a potentially interesting twist.

The Vanity Fair article is here:
http://www.vanityfair.com/culture/features/2011/04/stuxnet-201104

Like or Dislike: 2 0

By: Curt Purdy

Curt Purdy — Wed, 02 Mar 2011 15:38:16 +0000

Very Cool Brian! I just read the April 2011 Vanity Fair article giving you credit for the first publication of Stuxnet, which this turned out to be. Just noticed that in Serjey’s comment though at the time it never hit me when I read your blog.

Keep up the great work,
tecman

Like or Dislike: 0 0

By: Patrick

Patrick — Thu, 27 Jan 2011 00:11:03 +0000

Cool shortcuts, very useful. Thanks a bunch!!! I found a few move shortcuts here: http://www.usingcomputers.co.uk/tutorials/useful-windows-shortcuts.php its worth taking a look at combined with this article. Thanks, keep up the good posts!

Patrick

Like or Dislike: 1 0

By: JMontes

JMontes — Sun, 14 Nov 2010 10:54:12 +0000

OMG! Thanks for sharing it. Its the first time I heard about this treat.

Thanks to the fix tool too.

I have all my defenses patched up. how it will do it.

Like or Dislike: 1 0

By: Michael Wenstrom

Michael Wenstrom — Wed, 28 Jul 2010 02:19:00 +0000

Regarding the Siemens WinCC SCADA sw trojan, why not block execution of mrxnet.sys & mrxctl.sys via registry to mitigate spread? See Marcelo Fartura’s blog http://goo.gl/kK0Z

Like or Dislike: 1 0

By: Dave

Dave — Tue, 27 Jul 2010 13:30:23 +0000

>It was not an expired certificate that was used to create this. After this
>became known, Verisign (or whomever issued it) revoked the certificate. So,
>as of whatever time they revoked it, the certificate was no longer valid.

Verisign considers it no longer valid, Windows still considered it valid the last time I checked. We had a small pool going on when Windows will notice the revocation, unfortunately too many people who have experience with past revocations chose “never” so that didn’t work so well.

Like or Dislike: 1 0

By: JCitizen

JCitizen — Tue, 27 Jul 2010 00:33:50 +0000

Thanks for that SOPHOS link Brian! That tool will really do the trick if Sophos claims are correct. It will provide a pop-up to tell you critical shortcut files are attempting to be changed.

After installation my icons went blank, but popped back automatically after coming out of standby!

Like or Dislike: 1 0

By: BrianKrebs

BrianKrebs — Sat, 24 Jul 2010 01:59:39 +0000

Bea- Check out my latest post. It includes a fix-it tool.

http://krebsonsecurity.com/2010/07/tool-blunts-threat-from-windows-shortcut-flaw/

Well-loved. Like or Dislike: 5 0

By: Bea

Bea — Sat, 24 Jul 2010 01:47:50 +0000

I am SO TIRED of nothing working on Vista which was NEW, and finding more and more problems, and sites like this find a flaw. HOW ABOUT A LINK OR D/L TO FIX IT? FOR ONE THING EVEN
Disgusted Blogs, bulletins, warnings but not ONE PLACE to tell you what to do or a fix. Flaw in links, Power grid, certificates, etc, al l mentioned do you think that the average person has the TIME or KNOWLEDGE to know where to go or how to fix it. A Microsoft Bulletin, Great. No fix though.

Hot debate. What do you think? 3 6

By: sergey ulasen

sergey ulasen — Fri, 23 Jul 2010 13:46:09 +0000

Hello Brian!

I want to say thanks for your interest to this problem. Your blog has helped to draw attention of community on tmphider/stuxnet and problems that connected with it.

I hope for collaboration in the future.

Sergey Ulasen
VirusBlokAda, Minsk, Belarus

Well-loved. Like or Dislike: 6 0