Slashdot Mirror
Stuxnet Attacks Used 4 Windows Zero-Day Exploits
abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."
How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day? They actually had this patched through Windows Update before Conficker became the big epidemic it did. Systems with automatic update turned off were the cause for most of the Conficker problems.
...zero-day bug in the Print Spooler Service...
it won't affect the iPad!
Yeah, yeah, -1 Troll, -1 Flamebait, -1 Offtopic...
Who else was all ready to flame about 4 being used to mean "four"?
Then I read the rest of the summary for once...
Who else was all ready to flame about 4 being used to mean "for"?
Fixed. And I'm legitimately trying to be helpful not just being a pain in the ass, it took me like 30 seconds to figure out what you were trying to say here.
I think he complains about the rule that numbers smaller than 10 should be written in words. So text should be "Four Windows.." not "4 Windows.." at the title.
I like user-friendly[1] screen doors to enter my submarine! ;-)
Ghahh! Where's all of that water coming from?
All hands, 'Abandon ship!'
[1] and hacker/cracker friendly, spammer friendly, gov't. friendly, and criminal friendly
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
It's funny how this happened right after Microsoft released the source code of Windows 7 to the Russian government...Just sayin...
Undoing Informative mod. Actually, it seems he pissed off for using 4 instead of Four in the title.
No it doesn't. It seems like he's an idiot whose first interpretation of the numeral 4 was "for".
https://www.eff.org/https-everywhere
it took me like 30 seconds to figure out what you were trying to say here
Same here – but I actually figured it out as soon as I looked up and read TFHeadline.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
All these neat day0 exploits wasted to get into an industrial control system. The numbers of those systems are only in the thousands, they could have taken control over millions of normal Windows PCs. Who-ever designed this must have been really determined to get data out of those Siemens controllers. Wouldn't it be easier just to bribe a local operator into getting the info?
Or did they want to create their own bot-net of Scada systems? Then you can brag that you can shutdown a country at the touch of a button.
"...noting that the worm also used signed digital certificates stolen from RealTek and JMicron..."
I wonder how they obtained driver level certificates. I can imagine how, but I'd be curious to know the actual method.
I also chuckled at the fact that part of the exploit involved something that was patched a month ago. More unpatched PCs get attacked. I'm shocked. SHOCKED!
Hey Taco man you do realize this is recycled old news from about two month ago, don't you?
That doesn't make him an idiot, just overzealous at anticipating other people's idiocy.
People are buying these systems why? Ok. There are several possible reasons. 1. They don't know about anything else, haven't tried anything else, and believe everything muthercorp tells them. 2. They are stuck with some custom software written for the muthercorp system, and can't do any better. 3. Habit, no different than crack or cleaning solvent. I don't personally use muthercorp systems because they seem to be so vulnerable. Muthercorp users will yelp out 'if yers was this pepular, yew would have these problems too! (spoken with a shaken fist, and followed by a long taste of corn or grain alcohol, and then a small spit to the ground). Its all hyperbole. Its all made-up bullshit, which can't be proven or disproven until such time as blah blah. One thing I do know is, that the system I use --for whatever reason you can dream up, and I would prefer if you could include Soviet Russia and space aliens in your stories among the reasons, my system, right now here today, doesn't have these problems. It didn't have them last week, last month or last year. I could make comment on software quality, studies by the Department of Homeland Security, etc, but to the great unwashed it all sounds like blah blah. They don't want to hear it. So here's a thank you to the ignorant masses for buying up this trash from muthercorp. If it really is your large numbers making the target big (and not poor design decisions by muthercorp) then you keep on being a ginormous target. Sacrifice yourselves so that I can compute in safety and without risk. Good Job Sparky! (I'm giving you all a great big Captain Wunderbar salute right now). I feel like I'm watching lemmings jump over the edge in order that their rotting corpses make good fertilizer for my garden.