Feeds

Microsoft closes hole used to attack industrial plants

Two other Stuxnet bugs remain

Next gen security for virtualised datacentres

Microsoft has credited security partners at Kaspersky Lab and Symantec for helping to close a critical Windows vulnerability that was being exploited by a sophisticated worm that has attacked industrial plants around the world.

The bug in the Windows Print Spooler, which was one of at least 11 vulnerabilities Microsoft patched on Tuesday, was under active attack by the Stuxnet worm, a sophisticated piece of malware that penetrated factories and other industrial plants. While it exploited a recently patched bug to infect PCs, it then attacked the print spooler bug and two other flaws to spread to new machines on local networks.

Maarten Van Horenbeeck, a senior program manager for the Microsoft Security Response Center, said the worm was so complicated that his team benefited from the analysis of outside researchers, who he said provided invaluable help in understanding how it worked.

“It's very difficult to know what exactly the malware was going to do on a particular platform because the behavior on every platform was different, so we had to go byte by byte through the code” he told The Reg. “We all would have ended up discovering all of these on our own, but we were able to get there a lot faster by working together, and essentially that's the result of the bulletin.”

Both Kaspersky and Symantec are members of MAPP, short for the Microsoft Active Protections Program, under which about 70 partners share information about known vulnerabilities before it is made public. The advanced details allow members to develop signatures for anti-virus software and intrusion prevention systems and to pool research.

The flawed print spooler, which doesn't correctly validate user permissions, allows remote attackers to take complete control of Windows systems. It is rated critical on Windows XP because the operating system enables a guest account for anonymous users by default. It is rated important on more recent Windows versions because users must manually set them up.

Once Stuxnet had gained a foothold on a network, it exploited the vulnerability to spread to additional machines. It also used two additional Windows vulnerabilities that Microsoft has yet to patch. Company representatives declined to provide details about them – other than to say they allowed attackers to elevate system privileges – pending a patch.

According to IDG News, Stuxnet has infected 14 plants.

Other vulnerabilities that were fixed as part of this month's Patch Tuesday were a bug in an MPEG 4 codec, and a flaw in the in Unicode Scripts Processor, both of which were rated critical for older versions of Windows because they allowed attackers to remotely execute malicious code. The bundle of patches included no critical updates for Windows Vista, Server 2008 or Windows 7, which were built under a process designed to be more resistant to attacks.

Of the 11 or so vulnerabilities fixed, at least five are expected to be targeted with reliable code soon, Microsoft said. The print spool bug is already being exploited, and an additional flaw, which creates a directory authentication bypass vulnerability, has already been released publicly. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.