Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Windows

Stuxnet Attacks Used 4 Windows Zero-Day Exploits 67

Posted by CmdrTaco from the i'll-exploit-you dept.
abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."
This discussion has been archived. No new comments can be posted.

Stuxnet Attacks Used 4 Windows Zero-Day Exploits More

Stuxnet Attacks Used 4 Windows Zero-Day Exploits

Comments Filter:

  • Zero Day? (Score:1, Interesting)

    by Anonymous Coward
    How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day? They actually had this patched through Windows Update before Conficker became the big epidemic it did. Systems with automatic update turned off were the cause for most of the Conficker problems.

    • Re:Zero Day? (Score:5, Insightful)

      by CannonballHead ( 842625 ) on Tuesday September 14, 2010 @03:08PM (#33579590)

      define: zero day
      Pertaining to the day on which software is released; New; as yet unpatched

      So it sounds like zero day means that it was present in the unpatched version?

      That said, the summary says nothing about patched vs. unpatched. There would be a great outcry if a vulnerability in Linux/OSS was exploited, even though that vulnerability was already patched, and the summary failed to mention that the only reason it was exploited was because the system was NOT patched...

      • (zero-day can also mean an unpatched bug I guess, too. weird.)

      • In the context of security, a zero-day vulnerability is a vulnerability for which no patch exists.

        • Re: (Score:2, Insightful)

          by turbidostato ( 878842 )

          "In the context of security, a zero-day vulnerability is a vulnerability for which no patch exists"

          References?

          I bet that a exploit against a known vulnerability is not a "zero-day" attack no matter if there's still no patch.

          But I wouldn't be surprised if software companies, especifically closed source software companies tried to change it to mean "no patch still delivered" of "before our monthly patch Thursday" since "zero-day attack" seems to imply the software vendor really couldn't do any better: another

          • Re: (Score:3, Informative)

            by Lord Ender ( 156273 )

            Reference: common, universally-accepted infosec lingo.

            An zero-day exploit is an exploit which works against a zero-day vulnerability. As soon as a patch is released (day 1) neither the exploit nor the vulnerability are "zero-day" anymore.

            • "As soon as a patch is released (day 1) neither the exploit nor the vulnerability are "zero-day" anymore."

              That's neither common sense nor INFOSEC slang. Try that:
              "As soon as a *day* has passed (day 1) neither the exploit nor the vulnerability are "zero-day" anymore."

              *That* is common sense.

              And regarding InfoSec, as old as 2003 you will find definitions like this*1:

              "FYI, I define zero-day exploits as exploits that were used to actually
              compromise a system ("in the wild") before the vulnerability was known
              to e

      • Zero day originally referred to software that was out for zero days before it was released for pirating. Then it mutated.

    • Re: (Score:3, Interesting)

      by dch24 ( 904899 )
      The exploits used unpatched bugs.

      That said, if this is the work of well-funded terrorists, they are probably well funded enough to have access to the Windows source code. Yes, yes, Microsoft doesn't disclose the entire code base for their OS. The parts that were exploited (like the print spooler) are probably considered "not high enough risk" and so are disclosed to governments far and near.

      In fact, the only guys playing catch-up seem to be the anti-virus writers.

      • So "zero-day" now means "unpatched bug", instead of the original meaning where the vulnerability was being exploited the same day it was discovered? The term "zero-day" now has no temporal meaning, then?

        • Re: (Score:3, Interesting)

          by dch24 ( 904899 )
          Actually I was responding to his specific question: "How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day?"

          In response to your question, no, I don't define "zero-day" to mean "unpatched bug". I define it to mean "exploit found using unpatched bug in the wild on the day it is first reported to a security researcher (preferred), or else vendor (not ideal, as they have less incentive to disclose all important details)"

        • Re: (Score:2)

          by sjames ( 1099 )

          Currently, zero-day is an adjective that may be applied to any exploit (including very old exploits for which a patch has been available more than a year but never applied) including good old social engineering whenever a reporter needs to sound more authoritative or wizardy. Now we're just waiting for the -1 day exploit where due to causality violations, affected systems contact the hackers for instructions before the exploit is actually discovered.

        • Zero day originally referred to software that was out for zero days before it was released for pirating. Then it mutated. Dude.

          • Ah, the good old days. Some light warez browsing on the local BBS, followed by a couple games of Legend of the Red Dragon, Usurper, maybe even The Pit.

            Zero-day was definitely used to describe several exploits in the early days though, not just warez.

      • Re: (Score:2)

        by shmlco ( 594907 )

        "That said, if this is the work of well-funded terrorists, they are probably well funded enough to have access to the Windows source code. "

        So in other words, having source access made the problem worse....

        • Re: (Score:1, Insightful)

          by Anonymous Coward

          When you rely on security by obfuscation, yes, it does become easier when you take away the obfuscation. Best to not rely on that when it isn't reliable.

        • > So in other words, having source access made the problem worse....

          A small set of privileged people (not the users) having source access made the problem worse. That's pretty much the definition of closed source, isn't it?

    • Re: (Score:2, Insightful)

      by TheRedDuke ( 1734262 )
      Just because MS releases a patch doesn't mean that users apply said patch.

    • Re:Zero Day? (Score:4, Informative)

      by GrumpySteen ( 1250194 ) on Tuesday September 14, 2010 @04:15PM (#33580412)

      A zero-day vulnerability is widely recognized to be a vulnerability that is found only because it's being exploited, which is how the four vulnerabilities appear to have been discovered. I suspect that the author of the article reasoned that a zero-day vulnerability remains a zero-day vulnerability even after a patch is available for it.

      I don't think there's any guidelines for when, if ever, an exploit stops being called a zero-day vulnerability and becomes just a normal one.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      TFS lists 5 vulnerabilities, one identified as old (MS08-067). What gives you the impression that they are calling the known exploit a zero day instead of the remaining four (previously undisclosed) that they list ? Generally when being pedantic it's best to ensure you aren't making a more obvious error.

  • Well, at least (Score:4, Funny)

    by by (1706743) ( 1706744 ) on Tuesday September 14, 2010 @03:07PM (#33579572)

    ...zero-day bug in the Print Spooler Service...

    it won't affect the iPad!

    Yeah, yeah, -1 Troll, -1 Flamebait, -1 Offtopic...

  • 4 != four (Score:2, Funny)

    by VMaN ( 164134 )

    Who else was all ready to flame about 4 being used to mean "four"?

    Then I read the rest of the summary for once...

  • It's funny how this happened right after Microsoft released the source code of Windows 7 to the Russian government...Just sayin...

    • In Russia, bugs exploit you!

    • Re: (Score:3, Interesting)

      by gad_zuki! ( 70830 )

      Lots of organizations and most governments have the source to windows, its not like its this closely guarded secret. Considering Stuxnet was found infecting Iranian systems [computerworld.com] more than anything else, its probably made in the good ol' USA. This thing has NSA written all over it. Its really well-done, I guess my tax dollars are at work.

  • All these vulnerabilities.. (Score:4, Insightful)

    by simp ( 25997 ) on Tuesday September 14, 2010 @04:25PM (#33580560)

    All these neat day0 exploits wasted to get into an industrial control system. The numbers of those systems are only in the thousands, they could have taken control over millions of normal Windows PCs. Who-ever designed this must have been really determined to get data out of those Siemens controllers. Wouldn't it be easier just to bribe a local operator into getting the info?

    Or did they want to create their own bot-net of Scada systems? Then you can brag that you can shutdown a country at the touch of a button.

    • Re: (Score:3, Insightful)

      by NatasRevol ( 731260 )

      Seriously, why go to that level of trouble.

      Especially when the passwords to the database are hardcoded:
      http://www.wired.com/threatlevel/2010/07/siemens-scada/ [wired.com]

      • Re: (Score:3, Interesting)

        by omglolbah ( 731566 )

        I work with a constrol system made by one of the largest competetors to Siemens... The root level passwords are almost always left as the default...
        Same with the software access passwords :(

        All of the systems I work with are physically disconnected from the outside world though, so it is less of an issue.

    • Re:All these vulnerabilities.. (Score:4, Insightful)

      by antifoidulus ( 807088 ) on Tuesday September 14, 2010 @06:19PM (#33581840) Homepage Journal
      This thing is able to inject code as well. Imagine how much a company could gain if it was able to inject difficult to detect faults in its competitors products. Imagine how many armies around the world would be salivating at the opportunity to, for a few thousand dollars, basically have an opportunity to render their opponents half-billion dollar jet useless. These attacks only work, however, if you are able to fly under the radar. If the authors would have attacked normal PCs the odds of the bug being discovered and fixed would be much greater than if they only target a very small subset of Windows computers.

    • Depending on how the industrial control systems are use, you might be able to do a large amount of damage, and possibly kill people. Many facilities rely on industrial control systems to prevent damage to hardware (control sequencing of components, etc). Some facilities now rely on industrial controllers to provide human safety interlocks although these controllers need to be certified for life-safety applications, and I don't know if they could be vulnerable to similar attacks. Medical equipment may use si

  • Interesting note spied in the article (Score:2, Interesting)

    by Anonymous Coward

    "...noting that the worm also used signed digital certificates stolen from RealTek and JMicron..."
    I wonder how they obtained driver level certificates. I can imagine how, but I'd be curious to know the actual method.

    I also chuckled at the fact that part of the exploit involved something that was patched a month ago. More unpatched PCs get attacked. I'm shocked. SHOCKED!

Slashdot Top Deals

"I've seen it. It's rubbish." -- Marvin the Paranoid Android

Close