Feeds

Microsoft closes hole used to attack industrial plants

Two other Stuxnet bugs remain

Providing a secure and efficient Helpdesk

Microsoft has credited security partners at Kaspersky Lab and Symantec for helping to close a critical Windows vulnerability that was being exploited by a sophisticated worm that has attacked industrial plants around the world.

The bug in the Windows Print Spooler, which was one of at least 11 vulnerabilities Microsoft patched on Tuesday, was under active attack by the Stuxnet worm, a sophisticated piece of malware that penetrated factories and other industrial plants. While it exploited a recently patched bug to infect PCs, it then attacked the print spooler bug and two other flaws to spread to new machines on local networks.

Maarten Van Horenbeeck, a senior program manager for the Microsoft Security Response Center, said the worm was so complicated that his team benefited from the analysis of outside researchers, who he said provided invaluable help in understanding how it worked.

“It's very difficult to know what exactly the malware was going to do on a particular platform because the behavior on every platform was different, so we had to go byte by byte through the code” he told The Reg. “We all would have ended up discovering all of these on our own, but we were able to get there a lot faster by working together, and essentially that's the result of the bulletin.”

Both Kaspersky and Symantec are members of MAPP, short for the Microsoft Active Protections Program, under which about 70 partners share information about known vulnerabilities before it is made public. The advanced details allow members to develop signatures for anti-virus software and intrusion prevention systems and to pool research.

The flawed print spooler, which doesn't correctly validate user permissions, allows remote attackers to take complete control of Windows systems. It is rated critical on Windows XP because the operating system enables a guest account for anonymous users by default. It is rated important on more recent Windows versions because users must manually set them up.

Once Stuxnet had gained a foothold on a network, it exploited the vulnerability to spread to additional machines. It also used two additional Windows vulnerabilities that Microsoft has yet to patch. Company representatives declined to provide details about them – other than to say they allowed attackers to elevate system privileges – pending a patch.

According to IDG News, Stuxnet has infected 14 plants.

Other vulnerabilities that were fixed as part of this month's Patch Tuesday were a bug in an MPEG 4 codec, and a flaw in the in Unicode Scripts Processor, both of which were rated critical for older versions of Windows because they allowed attackers to remotely execute malicious code. The bundle of patches included no critical updates for Windows Vista, Server 2008 or Windows 7, which were built under a process designed to be more resistant to attacks.

Of the 11 or so vulnerabilities fixed, at least five are expected to be targeted with reliable code soon, Microsoft said. The print spool bug is already being exploited, and an additional flaw, which creates a directory authentication bypass vulnerability, has already been released publicly. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.