ELM Bulletin - April 8, 2010
F1 / Internet Explorer Virus Warning
A subscriber to the ELM Bulletin has just informed me of a virus with a unique delivery method. The virus installs when a user (upon viewing a specially formatted web page), is convinced to press the “F1” key on their keyboard. The prompt to press “F1” may appear repeatedly and is especially deceiving as this is also the key used by most Windows application to access their help systems.
NOTE: Windows Vista, Windows 7 and Windows 2008 Server are not typically affected by this virus as it exploits a vulnerability in the Help Systems of Windows 2000 and Windows XP when using any version of Internet Explorer.
The following information has been excerpted from a Snopes article discussing the virus:
http://www.snopes.com/computer/virus/f1key.asp
In addition to the precautions listed below, most Windows applications will not prompt the user to press the “F1” key of their own initiative. In most cases, such a prompt is an indication that something is wrong.
“Origins: As noted in a 1 March 2010 Microsoft Security Advisory, a vulnerability in VBScript has opened the door to a potential exploit tied to luring users of Microsoft's Internet Explorer web browser software into pressing the F1 key:
Microsoft is investigating new public reports of a vulnerability in VBScript that is exposed on supported versions of Microsoft Windows 2000, Windows XP, and Windows Server 2003 through the use of Internet Explorer. Our investigation has shown that the vulnerability cannot be exploited on Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008. The main impact of the vulnerability is remote code execution. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.
The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user. On systems running Windows Server 2003, Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate against this issue.A 2 March 2010 advisory from US-CERT (the United States Computer Emergency Readiness Team) similarly notes that:
Microsoft has released a security advisory to address a vulnerability in VBScript. The advisory indicates that this vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. By convincing a user to view a specially crafted HTML document (web page, HTML email, or email attachment) with Internet Explorer and to press the F1 key, an attacker could run arbitrary code with the privileges of the user running the application.
US-CERT encourages users and administrators to do the following to help mitigate the risks:
- Review Microsoft Security Advisory 981169.
- Review the Microsoft Security Research & Defense blog entry regarding this issue.
- Review US-CERT Vulnerability Note VU#612021.
- Refrain from pressing the F1 key when prompted by a website.
- Restrict access to the Windows Help System.”
As always, please do not hesitate to contact me if you have any questions about this or any other issue.
Past issues of the ELM Bulletin are available from our website, feel free to forward them to anyone you wish.
You have received this ELM Bulletin either by request or because you have given your contact information to an ELM employee. If you no longer wish to receive the ELM Bulletin, send us an email with "Remove Me" in the subject line and we will remove your email address from our distribution list.
Peter Rhebergen Telephone |
Websites & Publications Product Websites |
