Feeds

Microsoft closes hole used to attack industrial plants

Two other Stuxnet bugs remain

High performance access to file storage

Microsoft has credited security partners at Kaspersky Lab and Symantec for helping to close a critical Windows vulnerability that was being exploited by a sophisticated worm that has attacked industrial plants around the world.

The bug in the Windows Print Spooler, which was one of at least 11 vulnerabilities Microsoft patched on Tuesday, was under active attack by the Stuxnet worm, a sophisticated piece of malware that penetrated factories and other industrial plants. While it exploited a recently patched bug to infect PCs, it then attacked the print spooler bug and two other flaws to spread to new machines on local networks.

Maarten Van Horenbeeck, a senior program manager for the Microsoft Security Response Center, said the worm was so complicated that his team benefited from the analysis of outside researchers, who he said provided invaluable help in understanding how it worked.

“It's very difficult to know what exactly the malware was going to do on a particular platform because the behavior on every platform was different, so we had to go byte by byte through the code” he told The Reg. “We all would have ended up discovering all of these on our own, but we were able to get there a lot faster by working together, and essentially that's the result of the bulletin.”

Both Kaspersky and Symantec are members of MAPP, short for the Microsoft Active Protections Program, under which about 70 partners share information about known vulnerabilities before it is made public. The advanced details allow members to develop signatures for anti-virus software and intrusion prevention systems and to pool research.

The flawed print spooler, which doesn't correctly validate user permissions, allows remote attackers to take complete control of Windows systems. It is rated critical on Windows XP because the operating system enables a guest account for anonymous users by default. It is rated important on more recent Windows versions because users must manually set them up.

Once Stuxnet had gained a foothold on a network, it exploited the vulnerability to spread to additional machines. It also used two additional Windows vulnerabilities that Microsoft has yet to patch. Company representatives declined to provide details about them – other than to say they allowed attackers to elevate system privileges – pending a patch.

According to IDG News, Stuxnet has infected 14 plants.

Other vulnerabilities that were fixed as part of this month's Patch Tuesday were a bug in an MPEG 4 codec, and a flaw in the in Unicode Scripts Processor, both of which were rated critical for older versions of Windows because they allowed attackers to remotely execute malicious code. The bundle of patches included no critical updates for Windows Vista, Server 2008 or Windows 7, which were built under a process designed to be more resistant to attacks.

Of the 11 or so vulnerabilities fixed, at least five are expected to be targeted with reliable code soon, Microsoft said. The print spool bug is already being exploited, and an additional flaw, which creates a directory authentication bypass vulnerability, has already been released publicly. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.