Feeds

Microsoft closes hole used to attack industrial plants

Two other Stuxnet bugs remain

SANS - Survey on application security programs

Microsoft has credited security partners at Kaspersky Lab and Symantec for helping to close a critical Windows vulnerability that was being exploited by a sophisticated worm that has attacked industrial plants around the world.

The bug in the Windows Print Spooler, which was one of at least 11 vulnerabilities Microsoft patched on Tuesday, was under active attack by the Stuxnet worm, a sophisticated piece of malware that penetrated factories and other industrial plants. While it exploited a recently patched bug to infect PCs, it then attacked the print spooler bug and two other flaws to spread to new machines on local networks.

Maarten Van Horenbeeck, a senior program manager for the Microsoft Security Response Center, said the worm was so complicated that his team benefited from the analysis of outside researchers, who he said provided invaluable help in understanding how it worked.

“It's very difficult to know what exactly the malware was going to do on a particular platform because the behavior on every platform was different, so we had to go byte by byte through the code” he told The Reg. “We all would have ended up discovering all of these on our own, but we were able to get there a lot faster by working together, and essentially that's the result of the bulletin.”

Both Kaspersky and Symantec are members of MAPP, short for the Microsoft Active Protections Program, under which about 70 partners share information about known vulnerabilities before it is made public. The advanced details allow members to develop signatures for anti-virus software and intrusion prevention systems and to pool research.

The flawed print spooler, which doesn't correctly validate user permissions, allows remote attackers to take complete control of Windows systems. It is rated critical on Windows XP because the operating system enables a guest account for anonymous users by default. It is rated important on more recent Windows versions because users must manually set them up.

Once Stuxnet had gained a foothold on a network, it exploited the vulnerability to spread to additional machines. It also used two additional Windows vulnerabilities that Microsoft has yet to patch. Company representatives declined to provide details about them – other than to say they allowed attackers to elevate system privileges – pending a patch.

According to IDG News, Stuxnet has infected 14 plants.

Other vulnerabilities that were fixed as part of this month's Patch Tuesday were a bug in an MPEG 4 codec, and a flaw in the in Unicode Scripts Processor, both of which were rated critical for older versions of Windows because they allowed attackers to remotely execute malicious code. The bundle of patches included no critical updates for Windows Vista, Server 2008 or Windows 7, which were built under a process designed to be more resistant to attacks.

Of the 11 or so vulnerabilities fixed, at least five are expected to be targeted with reliable code soon, Microsoft said. The print spool bug is already being exploited, and an additional flaw, which creates a directory authentication bypass vulnerability, has already been released publicly. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.