Windows shortcut parsing flaw (CVE-2010-2568) — not opened, merely displayed, and it runs

1Nothing was opened, and it ran

Most attacks need the user to do something: open the attachment, click the link, approve the prompt. What is unusual here is that no such move is required. To draw its icon, a shortcut file has to read information about what it points to. As the catalog describes it, that parsing is wrong, and code can run at the moment the icon is displayed. Open a folder, see its contents listed, and the condition is met.

Telling people to be careful does not work here. Even the most careful person still looks at a folder listing. Where judgment cannot be relied on, applying the fix becomes the entire line of defense.

2What a twelve-year interval means

Ninety-six records show an interval of ten years or more, and more than a third of them name the same manufacturer. The more widely a platform was deployed, the longer its old versions survive. As long as they survive, so do the flaws in them. A catalog listing is confirmation that an old version is still running somewhere, and still being targeted.

3The reasons old things persist are not technical

Old versions persist mostly for reasons outside technology: work that cannot stop, tested combinations that cannot be disturbed, and a shortage of hands or budget for updating. So the presumption that something old is no longer dangerous does not hold. If anything, what is old and still running usually sits where updates reach least easily. That is what twelve years means.