Slashdot Mirror
Stuxnet Attacks Used 4 Windows Zero-Day Exploits
abadnog writes "The attackers behind the recent Stuxnet worm attack used four different zero-day security vulnerabilities to burrow into — and spread around — Microsoft's Windows operating system, according to a startling disclosure from Microsoft. Two of the four vulnerabilities are still unpatched. Microsoft said the attackers initially targeted the old MS08-067 vulnerability (used in the Conficker attack), a new LNK (Windows Shortcut) flaw to launch exploit code on vulnerable Windows systems and a zero-day bug in the Print Spooler Service that makes it possible for malicious code to be passed to, and then executed on, a remote machine. The malware also exploited two different elevation of privilege holes to gain complete control over the affected system."
...zero-day bug in the Print Spooler Service...
it won't affect the iPad!
Yeah, yeah, -1 Troll, -1 Flamebait, -1 Offtopic...
define: zero day
Pertaining to the day on which software is released; New; as yet unpatched
So it sounds like zero day means that it was present in the unpatched version?
That said, the summary says nothing about patched vs. unpatched. There would be a great outcry if a vulnerability in Linux/OSS was exploited, even though that vulnerability was already patched, and the summary failed to mention that the only reason it was exploited was because the system was NOT patched...
Do you mean "for"? Because 4 == four.
When not four, 4 is 2 B.
... or maybe ! 2 B.
It's funny how this happened right after Microsoft released the source code of Windows 7 to the Russian government...Just sayin...
The exploits used unpatched bugs.
That said, if this is the work of well-funded terrorists, they are probably well funded enough to have access to the Windows source code. Yes, yes, Microsoft doesn't disclose the entire code base for their OS. The parts that were exploited (like the print spooler) are probably considered "not high enough risk" and so are disclosed to governments far and near.
In fact, the only guys playing catch-up seem to be the anti-virus writers.
Just because MS releases a patch doesn't mean that users apply said patch.
it took me like 30 seconds to figure out what you were trying to say here
Same here – but I actually figured it out as soon as I looked up and read TFHeadline.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Actually I was responding to his specific question: "How can a vulnerability that Microsoft had patched a very long time ago (MS08-067) be called a zero-day?"
In response to your question, no, I don't define "zero-day" to mean "unpatched bug". I define it to mean "exploit found using unpatched bug in the wild on the day it is first reported to a security researcher (preferred), or else vendor (not ideal, as they have less incentive to disclose all important details)"
A zero-day vulnerability is widely recognized to be a vulnerability that is found only because it's being exploited, which is how the four vulnerabilities appear to have been discovered. I suspect that the author of the article reasoned that a zero-day vulnerability remains a zero-day vulnerability even after a patch is available for it.
I don't think there's any guidelines for when, if ever, an exploit stops being called a zero-day vulnerability and becomes just a normal one.
All these neat day0 exploits wasted to get into an industrial control system. The numbers of those systems are only in the thousands, they could have taken control over millions of normal Windows PCs. Who-ever designed this must have been really determined to get data out of those Siemens controllers. Wouldn't it be easier just to bribe a local operator into getting the info?
Or did they want to create their own bot-net of Scada systems? Then you can brag that you can shutdown a country at the touch of a button.
"...noting that the worm also used signed digital certificates stolen from RealTek and JMicron..."
I wonder how they obtained driver level certificates. I can imagine how, but I'd be curious to know the actual method.
I also chuckled at the fact that part of the exploit involved something that was patched a month ago. More unpatched PCs get attacked. I'm shocked. SHOCKED!
TFS lists 5 vulnerabilities, one identified as old (MS08-067). What gives you the impression that they are calling the known exploit a zero day instead of the remaining four (previously undisclosed) that they list ? Generally when being pedantic it's best to ensure you aren't making a more obvious error.
No, it can't. The article may use it that way, but it is incorrect.
zero-day means that there is a hack before there is knowledge or, obviously, a fix of it.
http://en.wikipedia.org/wiki/Zero-day_attack
There are two types of people in the world: Those who crave closure
It stops being called a zero-day vulnerability... once there's a patch out. Just because a patch is or isn't used doesn't change that.
There are two types of people in the world: Those who crave closure
"Hey Taco man you do realize this is recycled old news from about two month ago, don't you?"
Do you mean it's not zero-day news?
Reference: common, universally-accepted infosec lingo.
An zero-day exploit is an exploit which works against a zero-day vulnerability. As soon as a patch is released (day 1) neither the exploit nor the vulnerability are "zero-day" anymore.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.