Microsoft isn't fixing 8-year-old shortcut exploit abused for spying
theregister.com
theregister.com
So if .LNK is treated as .EXE and .COM and .BAT, then I would say that there is parity there. Unfortunately, typical users aren't sophisticated enough to recognize that a .LNK is an arbitrarily-coded script file, nor to inspect it closely enough when these Evil North Koreans found a way to obfuscate it.
We're still at a level where typical troubleshooting instructions include: "destroy all your data/cookies/cache, disable your firewall & anti-malware, and run this with admin privileges" because sure enough, those pesky security measures can indeed interfere with legitimate operations.
It's the same thing when you tell users to "check the full URL on preview to make sure it's OK before you click it." Well, bud, I'll show you punycode, and link shortener/redirection, and thousands of legitimate gTLDs, and weighing that against the expertise of a typical consumer on what a "valid URL" looks like, not going to help.
(This may have changed with new versions of Windows 11, I'm stopped working in this area a few years back)
Thus users are unlikely to detect that they're LNK files (in Windows), even with enabled extension.
Search in your registry for "NeverShowExt".
In my PC I found the following:
*.accountpicture-ms, *.appcontent-ms, *.appref-ms, *.desklink, *.library-ms, *.lnk, *.mapimail, *.mydocs *.pif, *.scf, *.search-ms, *.searchConnector-ms, *.settingcontent-ms, *.URL, *.website, *.zfsendtotarget
Windows and every other OS has a complex system that takes into account "mime-types" and custom application handlers, and the whole configuration is quite malleable. The GUI icon accompanying a file is often a more reliable indicator of what's going to launch when you click it. Of course, as files get transferred over the network and shared among heterogeneous systems, that association may ultimately rely on nothing else but the extension when the content-type system doesn't work as designed.
> users are unlikely to detect that they're LNK files
LNK format is a Windows shortcut, which is a signature design feature of Windows 95 and later. It's working as intended, as a soft-link to some other type of file. So of course it is supposed to depict the handler that opens link target, and hide the shortcut-ness, although you should usually also see a curly-arrow at the lower-left side of a shortcut icon. There have been ways to suppress the arrow, but its presence is a dead giveaway of the LNK nature of the icon you're clicking, in the GUI under normal circumstances. Surely it is also distinguishable through PowerShell.
The bottom line is that users are accustomed to reading ideograms, animations, and GUI cues just as well, or better, than the accompanying text, and graphical expressions are becoming mandatory in order to properly describe a button, a widget, an application, or whatever GUI element is in question. Describing them is a whole other ball of wax, especially if you try to do it over the telephone!
Furthermore, I don't know how much uncharted territory is involved with Unicode homoglyphs and file extensions, but it's worth considering whether your freshly downloaded file is named in a mixture of Cyrillic, Turkish, and Icelandic scripts, with ZWJ and other potential shenanigans.
This reads like someone at Microsoft looked at the issue and decided that this issue is technically "not my job".
Lots and lots of words, but tl;dr seems to be that it's just the .lnk equivalent of someone adding `logout` to your .bashrc, prepending it with a couple hundred spaces, and hoping your favorite editor doesn't have line wrap turned on. Except here, it's a fixed-width one-line GUI textbox, so there's no vertical space for line wrap, and the "hidden" commands are not a prank.
If the overall info on exploitation is accurate, it's quite surprising just how far one can go with most trivial of tricks.
ZDI = Zero Day Initiative.
https://www.zerodayinitiative.com/advisories/published/
I don't particularily agree with some of their philosophy, but they are smart folks and valuable to monitor alongside CVE. It's not like it's some backalley discount version of CVE. They've been around for 20 years, after all.