Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Stuxnet Attacks Used 4 Windows Zero-Day Exploits

CmdrTaco posted about 4 years ago | from the i'll-exploit-you dept.

Security 67

abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."

cancel ×

67 comments

Sorry! There are no comments related to the filter you selected.

Yes but.... (-1, Troll)

Anonymous Coward | about 4 years ago | (#33579524)

Do you still have to follow the instructions in a scam email to get infected?

2010 will not be the year of Linux on the desktop. Stalin's desktop maybe. but not mine.

First pie! (-1, Offtopic)

Anonymous Coward | about 4 years ago | (#33579530)

I like pie!

Zero Day? (1, Interesting)

Anonymous Coward | about 4 years ago | (#33579546)

How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day? They actually had this patched through Windows Update before Conficker became the big epidemic it did. Systems with automatic update turned off were the cause for most of the Conficker problems.

Re:Zero Day? (4, Insightful)

CannonballHead (842625) | about 4 years ago | (#33579590)

define: zero day
Pertaining to the day on which software is released; New; as yet unpatched

So it sounds like zero day means that it was present in the unpatched version?

That said, the summary says nothing about patched vs. unpatched. There would be a great outcry if a vulnerability in Linux/OSS was exploited, even though that vulnerability was already patched, and the summary failed to mention that the only reason it was exploited was because the system was NOT patched...

Re:Zero Day? (1)

CannonballHead (842625) | about 4 years ago | (#33579604)

(zero-day can also mean an unpatched bug I guess, too. weird.)

Re:Zero Day? (4, Informative)

NatasRevol (731260) | about 4 years ago | (#33581258)

No, it can't. The article may use it that way, but it is incorrect.

zero-day means that there is a hack before there is knowledge or, obviously, a fix of it.

http://en.wikipedia.org/wiki/Zero-day_attack [wikipedia.org]

Re:Zero Day? (1)

CannonballHead (842625) | about 4 years ago | (#33581486)

Someone should tell wiktionary [wiktionary.org] .

Re:Zero Day? (1)

Jurily (900488) | about 4 years ago | (#33584784)

I always used the meaning "there was an attack on the day of release". Shame it became such a cool phrase it doesn't mean anything anymore.

Re:Zero Day? (1)

Lord Ender (156273) | about 4 years ago | (#33582836)

In the context of security, a zero-day vulnerability is a vulnerability for which no patch exists.

Re:Zero Day? (1, Insightful)

turbidostato (878842) | about 4 years ago | (#33583248)

"In the context of security, a zero-day vulnerability is a vulnerability for which no patch exists"

References?

I bet that a exploit against a known vulnerability is not a "zero-day" attack no matter if there's still no patch.

But I wouldn't be surprised if software companies, especifically closed source software companies tried to change it to mean "no patch still delivered" of "before our monthly patch Thursday" since "zero-day attack" seems to imply the software vendor really couldn't do any better: another PR trick.

Re:Zero Day? (2, Informative)

Lord Ender (156273) | about 4 years ago | (#33603450)

Reference: common, universally-accepted infosec lingo.

An zero-day exploit is an exploit which works against a zero-day vulnerability. As soon as a patch is released (day 1) neither the exploit nor the vulnerability are "zero-day" anymore.

Re:Zero Day? (1)

turbidostato (878842) | about 4 years ago | (#33606532)

"As soon as a patch is released (day 1) neither the exploit nor the vulnerability are "zero-day" anymore."

That's neither common sense nor INFOSEC slang. Try that:
"As soon as a *day* has passed (day 1) neither the exploit nor the vulnerability are "zero-day" anymore."

*That* is common sense.

And regarding InfoSec, as old as 2003 you will find definitions like this*1:

"FYI, I define zero-day exploits as exploits that were used to actually
compromise a system ("in the wild") before the vulnerability was known
to exist by most security professionals (not published on public
security mailing lists - CERT, Bugtraq, Full Disclosure, Vendors,
etc.)."

See? No reference about patching and, by inference, once the vulnerability is "published on public
security mailing lists - CERT, Bugtraq, Full Disclosure, Vendors, etc.", once the vulnerability is publicly known, in other words, it can't be a zero-day exploit (it's day zero anymore!).

Of course, software vendors try to stretch the definition to their convenience: "everybody knows" that's impossible to cover from a zero-day exploit directly at the application level so if an attact is the result of a "zero-day exploit" instead of "a bug that went unpatched for weeks" they appear as less guilty.

As I already said, PR in action.

*1 http://www.mail-archive.com/isn%40attrition.org/msg02376.html [mail-archive.com]

Re:Zero Day? (1)

BlackBloq (702158) | about 4 years ago | (#33585136)

Zero day originally referred to software that was out for zero days before it was released for pirating. Then it mutated.

Re:Zero Day? (2, Interesting)

dch24 (904899) | about 4 years ago | (#33579866)

The exploits used unpatched bugs.

That said, if this is the work of well-funded terrorists, they are probably well funded enough to have access to the Windows source code. Yes, yes, Microsoft doesn't disclose the entire code base for their OS. The parts that were exploited (like the print spooler) are probably considered "not high enough risk" and so are disclosed to governments far and near.

In fact, the only guys playing catch-up seem to be the anti-virus writers.

Re:Zero Day? (1)

amicusNYCL (1538833) | about 4 years ago | (#33580272)

So "zero-day" now means "unpatched bug", instead of the original meaning where the vulnerability was being exploited the same day it was discovered? The term "zero-day" now has no temporal meaning, then?

Re:Zero Day? (2, Interesting)

dch24 (904899) | about 4 years ago | (#33580382)

Actually I was responding to his specific question: "How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day?"

In response to your question, no, I don't define "zero-day" to mean "unpatched bug". I define it to mean "exploit found using unpatched bug in the wild on the day it is first reported to a security researcher (preferred), or else vendor (not ideal, as they have less incentive to disclose all important details)"

Re:Zero Day? (1)

sjames (1099) | about 4 years ago | (#33582316)

Currently, zero-day is an adjective that may be applied to any exploit (including very old exploits for which a patch has been available more than a year but never applied) including good old social engineering whenever a reporter needs to sound more authoritative or wizardy. Now we're just waiting for the -1 day exploit where due to causality violations, affected systems contact the hackers for instructions before the exploit is actually discovered.

Re:Zero Day? (1)

BlackBloq (702158) | about 4 years ago | (#33593938)

Zero day originally referred to software that was out for zero days before it was released for pirating. Then it mutated. Dude.

Re:Zero Day? (1)

amicusNYCL (1538833) | about 4 years ago | (#33594430)

Ah, the good old days. Some light warez browsing on the local BBS, followed by a couple games of Legend of the Red Dragon, Usurper, maybe even The Pit.

Zero-day was definitely used to describe several exploits in the early days though, not just warez.

Re:Zero Day? (1)

shmlco (594907) | about 4 years ago | (#33580952)

"That said, if this is the work of well-funded terrorists, they are probably well funded enough to have access to the Windows source code. "

So in other words, having source access made the problem worse....

Re:Zero Day? (1, Insightful)

Anonymous Coward | about 4 years ago | (#33581052)

When you rely on security by obfuscation, yes, it does become easier when you take away the obfuscation. Best to not rely on that when it isn't reliable.

Re:Zero Day? (1)

John Hasler (414242) | about 4 years ago | (#33581726)

> So in other words, having source access made the problem worse....

A small set of privileged people (not the users) having source access made the problem worse. That's pretty much the definition of closed source, isn't it?

Re:Zero Day? (2, Insightful)

TheRedDuke (1734262) | about 4 years ago | (#33580122)

Just because MS releases a patch doesn't mean that users apply said patch.

Re:Zero Day? (4, Informative)

GrumpySteen (1250194) | about 4 years ago | (#33580412)

A zero-day vulnerability is widely recognized to be a vulnerability that is found only because it's being exploited, which is how the four vulnerabilities appear to have been discovered. I suspect that the author of the article reasoned that a zero-day vulnerability remains a zero-day vulnerability even after a patch is available for it.

I don't think there's any guidelines for when, if ever, an exploit stops being called a zero-day vulnerability and becomes just a normal one.

Re:Zero Day? (3, Insightful)

NatasRevol (731260) | about 4 years ago | (#33581288)

It stops being called a zero-day vulnerability... once there's a patch out. Just because a patch is or isn't used doesn't change that.

Re:Zero Day? (1)

molecular (311632) | about 4 years ago | (#33584074)

nah, after one day, it's a one-day.

Re:Zero Day? (2, Informative)

Anonymous Coward | about 4 years ago | (#33580690)

TFS lists 5 vulnerabilities, one identified as old (MS08-067). What gives you the impression that they are calling the known exploit a zero day instead of the remaining four (previously undisclosed) that they list ? Generally when being pedantic it's best to ensure you aren't making a more obvious error.

Well, at least (4, Funny)

by (1706743) (1706744) | about 4 years ago | (#33579572)

...zero-day bug in the Print Spooler Service...

it won't affect the iPad!

Yeah, yeah, -1 Troll, -1 Flamebait, -1 Offtopic...

Re:Well, at least (0)

Anonymous Coward | about 4 years ago | (#33579608)

Yeah, but +1 Microsoft bashing, +1 Apple fan boy, +1 Snarky, +1 First...

Re:Well, at least (0)

Anonymous Coward | about 4 years ago | (#33579776)

There should be a +1 Ballsy, for posting as yourself when you really should be posting AC.

Clearly, this post wouldn't receive said mod...

Re:Well, at least (1)

RyuuzakiTetsuya (195424) | about 4 years ago | (#33580140)

/. math

-1 Troll + -1 Flamebait + -1 Offtopic = +5 Funny

I hope for your sake that you don't do your own taxes...

Re:Well, at least (1)

WrongSizeGlass (838941) | about 4 years ago | (#33580516)

/. math

-1 Troll + -1 Flamebait + -1 Offtopic = +5 Funny

I hope for your sake that you don't do your own taxes...

Cut him a break. He's not Kreskin [wikipedia.org]

Re:Well, at least (1)

RyuuzakiTetsuya (195424) | about 4 years ago | (#33580640)

... Must..

resist...

netcraft...

comment... Auuuuuuuugh.

Re:Well, at least (0)

Anonymous Coward | about 4 years ago | (#33580882)

  –I hope for your sake that you don't do your own taxes...

Old Joke
Question: What does 2 + 2 equal
Engineer: precisely 2 plus precisely 2 equals exactly 4

Philosopher
2 plus 2 of what?... what do we mean by '2'... is 'plus' always necessary? Why must it ' equal' and not simply be?

Accountant
What do you want it to equal?

Re:Well, at least (0)

Anonymous Coward | about 4 years ago | (#33584296)

You wanted to say 1bourbon, 1scoch 1beer....

4 != four (1, Funny)

VMaN (164134) | about 4 years ago | (#33579576)

Who else was all ready to flame about 4 being used to mean "four"?

Then I read the rest of the summary for once...

Re:4 != four (1)

Spad (470073) | about 4 years ago | (#33579594)

Or even "for"

Re:4 != four (1)

VMaN (164134) | about 4 years ago | (#33579620)

Well that was the opposite of what I meant...

Re:4 != four (0)

Anonymous Coward | about 4 years ago | (#33579774)

Clearly, the only honorable way out is the time honored tradition of Grammar Nazi Seppuku.

Thankfully, Grammar Nazis don't care that Nazis are German and Seppuku is a Japanese ritual. That's a History Nazi thing.

Not a Historical Nazi thing, however. They're totally different. They kill themselves via gunshot AND cyanide, in bunkers.

Re:4 != four (2, Funny)

jonescb (1888008) | about 4 years ago | (#33579624)

Do you mean "for"? Because 4 == four.

Re:4 != for (1, Informative)

MozeeToby (1163751) | about 4 years ago | (#33579638)

Who else was all ready to flame about 4 being used to mean "for"?

Fixed. And I'm legitimately trying to be helpful not just being a pain in the ass, it took me like 30 seconds to figure out what you were trying to say here.

Re:4 != for (1, Informative)

Anonymous Coward | about 4 years ago | (#33579694)

I think he complains about the rule that numbers smaller than 10 should be written in words. So text should be "Four Windows.." not "4 Windows.." at the title.

Re:4 != for (1)

iammani (1392285) | about 4 years ago | (#33579950)

Undoing Informative mod. Actually, it seems he pissed off for using 4 instead of Four in the title.

Re:4 != for (1)

StikyPad (445176) | about 4 years ago | (#33579968)

No it doesn't. It seems like he's an idiot whose first interpretation of the numeral 4 was "for".

Re:4 != for (0)

Anonymous Coward | about 4 years ago | (#33581728)

That doesn't make him an idiot, just overzealous at anticipating other people's idiocy.

Re:4 != for (2, Informative)

clone53421 (1310749) | about 4 years ago | (#33580190)

it took me like 30 seconds to figure out what you were trying to say here

Same here – but I actually figured it out as soon as I looked up and read TFHeadline.

Re:4 != four (1)

Darkness404 (1287218) | about 4 years ago | (#33579662)

Ok, so if 4 isn't four, what is it? Five? Six?

Re:4 != four (2, Funny)

CannonballHead (842625) | about 4 years ago | (#33579682)

When not four, 4 is 2 B.
... or maybe ! 2 B.

Re:4 != four (1)

rakuen (1230808) | about 4 years ago | (#33579730)

4 = 5 for exceptionally large values of 4.

Re:4 != four (0)

Anonymous Coward | about 4 years ago | (#33579670)

Hilarious, man!

Re:4 != four (1)

c6gunner (950153) | about 4 years ago | (#33580622)

+5 Facepalm

That's why I also run Windows.... (0, Troll)

rts008 (812749) | about 4 years ago | (#33579706)

I like user-friendly[1] screen doors to enter my submarine! ;-)

Ghahh! Where's all of that water coming from?
All hands, 'Abandon ship!'

[1] and hacker/cracker friendly, spammer friendly, gov't. friendly, and criminal friendly

Gee What a Coincidence (3, Funny)

Kernel Rootkits (1422221) | about 4 years ago | (#33579824)

It's funny how this happened right after Microsoft released the source code of Windows 7 to the Russian government...Just sayin...

Re:Gee What a Coincidence (1)

VGPowerlord (621254) | about 4 years ago | (#33580206)

In Russia, bugs exploit you!

Re:Gee What a Coincidence (2, Interesting)

gad_zuki! (70830) | about 4 years ago | (#33582970)

Lots of organizations and most governments have the source to windows, its not like its this closely guarded secret. Considering Stuxnet was found infecting Iranian systems [computerworld.com] more than anything else, its probably made in the good ol' USA. This thing has NSA written all over it. Its really well-done, I guess my tax dollars are at work.

One Word Says It All ( -10, Incendiary ) (-1)

Anonymous Coward | about 4 years ago | (#33579898)

WinBLOZE [microsoft.com] .

Yours In Ufa,
K. Trout

All these vulnerabilities.. (3, Insightful)

simp (25997) | about 4 years ago | (#33580560)

All these neat day0 exploits wasted to get into an industrial control system. The numbers of those systems are only in the thousands, they could have taken control over millions of normal Windows PCs. Who-ever designed this must have been really determined to get data out of those Siemens controllers. Wouldn't it be easier just to bribe a local operator into getting the info?

Or did they want to create their own bot-net of Scada systems? Then you can brag that you can shutdown a country at the touch of a button.

Re:All these vulnerabilities.. (2, Insightful)

NatasRevol (731260) | about 4 years ago | (#33581380)

Seriously, why go to that level of trouble.

Especially when the passwords to the database are hardcoded:
http://www.wired.com/threatlevel/2010/07/siemens-scada/ [wired.com]

Re:All these vulnerabilities.. (2, Interesting)

omglolbah (731566) | about 4 years ago | (#33581510)

I work with a constrol system made by one of the largest competetors to Siemens... The root level passwords are almost always left as the default...
Same with the software access passwords :(

All of the systems I work with are physically disconnected from the outside world though, so it is less of an issue.

Re:All these vulnerabilities.. (3, Insightful)

antifoidulus (807088) | about 4 years ago | (#33581840)

This thing is able to inject code as well. Imagine how much a company could gain if it was able to inject difficult to detect faults in its competitors products. Imagine how many armies around the world would be salivating at the opportunity to, for a few thousand dollars, basically have an opportunity to render their opponents half-billion dollar jet useless. These attacks only work, however, if you are able to fly under the radar. If the authors would have attacked normal PCs the odds of the bug being discovered and fixed would be much greater than if they only target a very small subset of Windows computers.

Re:All these vulnerabilities.. (1)

joe_frisch (1366229) | more than 3 years ago | (#33704324)

Depending on how the industrial control systems are use, you might be able to do a large amount of damage, and possibly kill people. Many facilities rely on industrial control systems to prevent damage to hardware (control sequencing of components, etc). Some facilities now rely on industrial controllers to provide human safety interlocks although these controllers need to be certified for life-safety applications, and I don't know if they could be vulnerable to similar attacks. Medical equipment may use similar systems.

It is an interesting question - if intentional sabotage of these systems results in significant damage or deaths, and the attack can be tracked down to a national government, is this considered an act of war? If a nuclear facility or strategic asset is targeted, is a strategic retaliation warranted?

Interesting note spied in the article (2, Interesting)

Anonymous Coward | about 4 years ago | (#33580588)

"...noting that the worm also used signed digital certificates stolen from RealTek and JMicron..."
I wonder how they obtained driver level certificates. I can imagine how, but I'd be curious to know the actual method.

I also chuckled at the fact that part of the exploit involved something that was patched a month ago. More unpatched PCs get attacked. I'm shocked. SHOCKED!

old news? (0)

Anonymous Coward | about 4 years ago | (#33581430)

Hey Taco man you do realize this is recycled old news from about two month ago, don't you?

Re:old news? (2, Funny)

turbidostato (878842) | about 4 years ago | (#33583278)

"Hey Taco man you do realize this is recycled old news from about two month ago, don't you?"

Do you mean it's not zero-day news?

Still? (0)

Anonymous Coward | about 4 years ago | (#33583732)

People are buying these systems why? Ok. There are several possible reasons. 1. They don't know about anything else, haven't tried anything else, and believe everything muthercorp tells them. 2. They are stuck with some custom software written for the muthercorp system, and can't do any better. 3. Habit, no different than crack or cleaning solvent. I don't personally use muthercorp systems because they seem to be so vulnerable. Muthercorp users will yelp out 'if yers was this pepular, yew would have these problems too! (spoken with a shaken fist, and followed by a long taste of corn or grain alcohol, and then a small spit to the ground). Its all hyperbole. Its all made-up bullshit, which can't be proven or disproven until such time as blah blah. One thing I do know is, that the system I use --for whatever reason you can dream up, and I would prefer if you could include Soviet Russia and space aliens in your stories among the reasons, my system, right now here today, doesn't have these problems. It didn't have them last week, last month or last year. I could make comment on software quality, studies by the Department of Homeland Security, etc, but to the great unwashed it all sounds like blah blah. They don't want to hear it. So here's a thank you to the ignorant masses for buying up this trash from muthercorp. If it really is your large numbers making the target big (and not poor design decisions by muthercorp) then you keep on being a ginormous target. Sacrifice yourselves so that I can compute in safety and without risk. Good Job Sparky! (I'm giving you all a great big Captain Wunderbar salute right now). I feel like I'm watching lemmings jump over the edge in order that their rotting corpses make good fertilizer for my garden.

Re:Still? (1)

night_flyer (453866) | about 4 years ago | (#33585036)

And the alternative is? Linux? STILL not ready for grandma's desktops. Mac? overpriced and neither have the software support of Win based machines.

Re:Still? (0)

Anonymous Coward | more than 3 years ago | (#33712056)

The alternative is a Unix/Linux version designed with security in mind from the start knowing what we currently know. The short term solution would be to replace all industrial controllers which under the right circumstances could go boom in some way with well-protected (note not exactly off the shelf) Unix/Linux. Then replace those with the redesigned secure version as it becomes available. And to form an international team to research further exploits. Companies with a short-term motive profit can do it by themselves (part of the failure of business/capitalism).

As for Grandma and the rest - they can use a commercial version of easy to use Linux when the interface becomes useful for non-professionals. At any rate Grandma, etc. aren't going to be directly using industrial control systems but trusting industrial control systems to Windows (what moron came up with this???) can potentially harm Grandma.

Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>