Stuxnet Attacks Used 4 Windows Zero-Day Exploits 67
abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."
Re:4 != for (Score:2, Informative)
Who else was all ready to flame about 4 being used to mean "for"?
Fixed. And I'm legitimately trying to be helpful not just being a pain in the ass, it took me like 30 seconds to figure out what you were trying to say here.
Re:4 != for (Score:1, Informative)
Re:4 != for (Score:3, Informative)
it took me like 30 seconds to figure out what you were trying to say here
Same here – but I actually figured it out as soon as I looked up and read TFHeadline.
Re:Zero Day? (Score:4, Informative)
A zero-day vulnerability is widely recognized to be a vulnerability that is found only because it's being exploited, which is how the four vulnerabilities appear to have been discovered. I suspect that the author of the article reasoned that a zero-day vulnerability remains a zero-day vulnerability even after a patch is available for it.
I don't think there's any guidelines for when, if ever, an exploit stops being called a zero-day vulnerability and becomes just a normal one.
Re:Zero Day? (Score:2, Informative)
TFS lists 5 vulnerabilities, one identified as old (MS08-067). What gives you the impression that they are calling the known exploit a zero day instead of the remaining four (previously undisclosed) that they list ? Generally when being pedantic it's best to ensure you aren't making a more obvious error.
Re:Zero Day? (Score:5, Informative)
No, it can't. The article may use it that way, but it is incorrect.
zero-day means that there is a hack before there is knowledge or, obviously, a fix of it.
http://en.wikipedia.org/wiki/Zero-day_attack [wikipedia.org]
Re:Zero Day? (Score:3, Informative)
Reference: common, universally-accepted infosec lingo.
An zero-day exploit is an exploit which works against a zero-day vulnerability. As soon as a patch is released (day 1) neither the exploit nor the vulnerability are "zero-day" anymore.