Will Dormann on Nostr: Less-efficient workaround: Do a VirusTotal RetroHunt with a close-enough YARA rule, ...
Less-efficient workaround:
Do a VirusTotal RetroHunt with a close-enough YARA rule, and then just manually run exiftool on them.
And then ask ChatGPT to tell me what some of them do because I'm lazy. This attacker from 4.5 years ago at least had a sense of humor. 😂
https://www.virustotal.com/gui/file/ca2723ce8388eda11d5b07e788145d9779a6d38bac2d448a89ba860e4899ab35/details
Microsoft has refused to assign a CVE to this, as they don't feel obligated to follow CNA rules. ("CNAs SHOULD assign CVE IDs to Vulnerabilities, not Fixes for Vulnerabilities. ")
MITRE has refused to assign a CVE (by way of ignoring the request), as they too apparently don't feel obligated to follow CNA rules ("... MUST direct a CNA-LR or another CNA with appropriate scope to assign as quickly as possible and no later than 72 hours after becoming aware of the first refusal.")
So have fun with this one, folks. It's been exploited ITW for years, and it definitely works. But "LNK Stomping" has no CVE because, well, draw your own conclusions...
Do a VirusTotal RetroHunt with a close-enough YARA rule, and then just manually run exiftool on them.
And then ask ChatGPT to tell me what some of them do because I'm lazy. This attacker from 4.5 years ago at least had a sense of humor. 😂
https://www.virustotal.com/gui/file/ca2723ce8388eda11d5b07e788145d9779a6d38bac2d448a89ba860e4899ab35/details
Microsoft has refused to assign a CVE to this, as they don't feel obligated to follow CNA rules. ("CNAs SHOULD assign CVE IDs to Vulnerabilities, not Fixes for Vulnerabilities. ")
MITRE has refused to assign a CVE (by way of ignoring the request), as they too apparently don't feel obligated to follow CNA rules ("... MUST direct a CNA-LR or another CNA with appropriate scope to assign as quickly as possible and no later than 72 hours after becoming aware of the first refusal.")
So have fun with this one, folks. It's been exploited ITW for years, and it definitely works. But "LNK Stomping" has no CVE because, well, draw your own conclusions...