Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1105146" data-attributes="member: 32260">This attack vector can be dangerous for inexperienced users. The malicious code is executed outside the web browser via CmdLine, similar to a shortcut attack.The attack can be done filelessly. Such attacks are not especially dangerous for cautious users. Anyway, this attack vector can be easily prevented by blocking the Run option in Explorer:1. System wide:[CODE][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]&quot;NoRun&quot;=dword:00000001[/CODE]2. Per user only:[CODE]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]&quot;NoRun&quot;=dword:00000001[/CODE]Warning.This policy will block another possible attack by opening Windows Explorer via the Windows logo key + E and pasting the malicious CmdLine into the Address bar.Of course, the user will not be able to use this method for benign actions like running an application by pasting the application path into Explorer&#039;s Address bar (most people do not use this at all).</blockquote>

[QUOTE="Andy Ful, post: 1105146, member: 32260"] This attack vector can be dangerous for inexperienced users. The malicious code is executed outside the web browser via CmdLine, similar to a shortcut attack. The attack can be done filelessly. Such attacks are not especially dangerous for cautious users. Anyway, this attack vector can be easily prevented by blocking the Run option in Explorer: 1. System wide: [CODE][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoRun"=dword:00000001 [/CODE] 2. Per user only: [CODE]HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoRun"=dword:00000001 [/CODE] Warning. This policy will block another possible attack by opening Windows Explorer via the [B]Windows logo key [/B]+ [B]E [/B]and pasting the malicious CmdLine into the Address bar. Of course, the user will not be able to use this method for benign actions like running an application by pasting the application path into Explorer's Address bar (most people do not use this at all). [/QUOTE]

Verification