Serious Security Flaw: New LNK Stomping Technique Bypasses Windows Alerts

In a recent report by Elastic Security Labs, researchers have unveiled a troubling method that allows malicious applications to bypass Windows security alerts undetected for over six years. This research highlights vulnerabilities within the Windows SmartScreen and Smart App Control (SAC), the built-in security measures designed to detect and prevent execution of potentially harmful software in Windows 8 and 11.

Overview of the Research​

The study conducted by Joe Desimone, tech lead of Elastic Security Labs, revealed multiple techniques that cybercriminals could exploit to run harmful applications without triggering security measures. The primary focus was on the ability to bypass "Mark of the Web" (MotW), which is an essential security feature designed to mark files downloaded from the internet as potentially dangerous.

Key Findings​

1. LNK Stomping Technique:
   • One of the critical techniques identified is called "LNK Stomping." This method exploits a flaw in how Windows handles shortcut files (.LNK). By manipulating these shortcuts, attackers can effectively strip the MotW tag that alerts SmartScreen and SAC about malicious content.
   • For instance, attackers can create a .LNK file with a faulty path or internal structure. When Windows Explorer attempts to launch the executable, it corrects these errors but, in the process, removes the MotW tag—rendering the file invisible to both SmartScreen and SAC.
   []Example of Exploiting LNK Files:
   • The simplest way to exploit this bug is by adding a period or space to the target executable's file path. For example, target.exe. or .\\target.exe.
   • This manipulation processes the path, thereby eliminating the MotW tag from the file, which allows it to be executed without raising any flags.
   []Field Evidence:
   • The research team confirmed that multiple samples were identified on VirusTotal that utilized this exploit, with the earliest sample dating back over six years, highlighting the long-standing nature of this vulnerability.
   []Lack of Immediate Solutions:
   • Despite discussions with Microsoft about mitigating this vulnerability, no immediate patch has been promised. Elastic Security Labs is providing recommendations for detection logic and countermeasures in the interim.

     Implications of Security Bypass​

     The implications of this discovery are significant for Windows users and organizations reliant on Windows security measures. Attacks that bypass MotW can lead to widespread malicious software distribution, impacting user devices and corporate environments.

     Understanding Windows SmartScreen and SAC​

     Windows SmartScreen is a reputation-based anti-malware feature built into Windows operating systems. It flags files based on their origin and behavior. If a file is flagged, Windows will warn the user before the file is executed. Smart App Control (SAC) is designed specifically for Windows 11 to prevent potentially unwanted applications from being executed. Both features rely heavily on the MotW to assess the risks associated with files.

     Historical Context and Relevance​

     This isn't the first time vulnerabilities in reputation-based protection systems have been exploited. Over the years, attackers have created several methods to bypass these safety nets. However, the existence of a technique that exposes a weakness for such an extended period draws attention to the need for better security practices and continuous monitoring.

     Other Bypass Techniques​

     Elastic Security Labs also highlighted additional methods that cybercriminals utilize to undermine Windows security:
   []Reputation Hijacking:
   • Attackers can compromise existing applications with good reputations, altering them for malicious intent. This is often accomplished through script hosts, which can include interpreted languages like Lua or Node.js.
   []Reputation Seeding:
   • This technique involves planting a seemingly harmless binary that can exploit vulnerabilities once certain conditions are met. This method works particularly well with SAC, as it requires a higher trust threshold.
   []Reputation Tampering:
   • Attackers can modify benign applications to create backdoors while maintaining a benign reputation. This method involves careful changes in code that do not affect the perceived reputation of the application.

     Recommendations for Security Professionals​

     Given the gaps identified by the Elastic Security research, immediate action is needed from security professionals managing Windows environments:
   []Adjust Detection Mechanisms:
   • Security teams should enhance their detection capabilities to account for the new types of attacks made possible through LNK Stomping and similar methods.
   []Increase User Awareness:
   • Organizations should educate users about the potential risks of downloading and executing unknown applications.
2. Regular Software Audits:
   • Conducting routine audits and monitoring for anomalies in software behavior could help in early detection of potential breaches caused by these exploits.

     Conclusion​

     With malicious applications leveraging newly unveiled tricks to bypass Windows security alerts, users and organizations are urged to adopt more robust cybersecurity measures. Understanding these vulnerabilities, especially the implications of the LNK Stomping technique, will play a crucial role in safeguarding digital environments. It is essential for users to stay vigilant and for Microsoft to act promptly in patching these vulnerabilities to maintain user trust and system integrity. Source: The Register