Security researchers are expressing concern that Microsoft's security advisory about a Windows vulnerability is misleading, as users do not need to click on malicious icons in order to trigger malware exploiting the flaw, which, according to all sides, has already been the subject of attacks.To read this article in its entirety, please visit eWeek: Microsoft Windows Security Advisory Flawed, Pros Say
Some security pros are taking issue with Microsoft's advisory on a zero-day vulnerability one researcher referred to as "simple to exploit."
The vulnerability lies in the Windows Shell component. While Microsoft asserted in its advisory July 16 that the result of the vulnerability is that "malicious code may be executed when the user clicks the displayed icon of a specially crafted shortcut," security researchers are stressing that it is not necessary for users to click on an icon.
"All you do is open a device/network share/WebDav point that has the shortcut, and boom! It runs whatever you tell it to," said Sophos Senior Security Advisor Chester Wisniewski. "It is downright simple to exploit. Any criminal with the most basic of skills can take advantage of this flaw. We have not seen much activity in the wild yet, but now that a proof of concept is posted it is likely to become a major issue as the week rolls on."
Want an easy way to keep up with breaking tech news? And the Get DevSource headlines delivered to your desktop with RSS. 
