Feeds

Microsoft closes hole used to attack industrial plants

Two other Stuxnet bugs remain

5 things you didn’t know about cloud backup

Microsoft has credited security partners at Kaspersky Lab and Symantec for helping to close a critical Windows vulnerability that was being exploited by a sophisticated worm that has attacked industrial plants around the world.

The bug in the Windows Print Spooler, which was one of at least 11 vulnerabilities Microsoft patched on Tuesday, was under active attack by the Stuxnet worm, a sophisticated piece of malware that penetrated factories and other industrial plants. While it exploited a recently patched bug to infect PCs, it then attacked the print spooler bug and two other flaws to spread to new machines on local networks.

Maarten Van Horenbeeck, a senior program manager for the Microsoft Security Response Center, said the worm was so complicated that his team benefited from the analysis of outside researchers, who he said provided invaluable help in understanding how it worked.

“It's very difficult to know what exactly the malware was going to do on a particular platform because the behavior on every platform was different, so we had to go byte by byte through the code” he told The Reg. “We all would have ended up discovering all of these on our own, but we were able to get there a lot faster by working together, and essentially that's the result of the bulletin.”

Both Kaspersky and Symantec are members of MAPP, short for the Microsoft Active Protections Program, under which about 70 partners share information about known vulnerabilities before it is made public. The advanced details allow members to develop signatures for anti-virus software and intrusion prevention systems and to pool research.

The flawed print spooler, which doesn't correctly validate user permissions, allows remote attackers to take complete control of Windows systems. It is rated critical on Windows XP because the operating system enables a guest account for anonymous users by default. It is rated important on more recent Windows versions because users must manually set them up.

Once Stuxnet had gained a foothold on a network, it exploited the vulnerability to spread to additional machines. It also used two additional Windows vulnerabilities that Microsoft has yet to patch. Company representatives declined to provide details about them – other than to say they allowed attackers to elevate system privileges – pending a patch.

According to IDG News, Stuxnet has infected 14 plants.

Other vulnerabilities that were fixed as part of this month's Patch Tuesday were a bug in an MPEG 4 codec, and a flaw in the in Unicode Scripts Processor, both of which were rated critical for older versions of Windows because they allowed attackers to remotely execute malicious code. The bundle of patches included no critical updates for Windows Vista, Server 2008 or Windows 7, which were built under a process designed to be more resistant to attacks.

Of the 11 or so vulnerabilities fixed, at least five are expected to be targeted with reliable code soon, Microsoft said. The print spool bug is already being exploited, and an additional flaw, which creates a directory authentication bypass vulnerability, has already been released publicly. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.