Stuxnet: The most serious threat yet?

The Stuxnet worm has been causing alarm bells to ring in the security industry but what is it and how serious a threat does it pose?

ANALYSIS With so many different forms of threats out there, it is rare that one comes along to stand out from the crowd.

Stuxnet is something unique, however. It has been causing something of a stir in the security community since it was first spotted by a small company from Belarus named VirusBlokAda.

When Microsoft put out an alert over the virus in July, Stuxnet quickly moved from being a relative unknown to something serious.

Then earlier this month, Stuxnet was observed doing something unprecedented: exploiting four zero-day vulnerabilities at once. It is this advanced capability that has caused such a commotion.

So how has it made such a splash in such a small amount of time and what are hackers doing with it?

How does it work?

A trio of big time companies, including Microsoft itself, Kaspersky and Symantec, has been busy tracking the worm.

When it was first identified, Stuxnet was found using a .lnk file vulnerability to spread through USB drives.

Microsoft explained that with this, Stuxnet takes advantage of specially-crafted shortcut files the .lnk files - placed on USB drives to automatically execute malware as soon as the .lnk file is read by the operating system.

"In other words, simply browsing to the removable media drive using an application that displays shortcut icons (like Windows Explorer) runs the malware without any additional user interaction," Microsoft explained.

As for the four other vulnerabilities Stuxnet has been found exploiting, one is the same as a flaw used by the notorious Conficker worm last year.

Another uses a vulnerability in the Windows Print Spooler to spread, taking advantage of this weakness to send malicious code to a remote computer where it is then executed.

"By virtue of the features of this vulnerability, the infection can spread to computers using a printer or through shared access to one. Having infected a computer connected to a network, Stuxnet then attempts to spread to other computers," Kaspersky explained.

All of these vulnerabilities have now been patched, but two remain, although they are less serious.

These unpatched security holes are used by Stuxnet to let the attacker move from having limited control over a computer, up to privileged access, meaning a system could be completely compromised. Microsoft has said it intends to fix these in a future security bulletin.

Featured Resources

How to scale your organisation in the cloud

How to overcome common scaling challenges and choose the right scalable cloud service

Download now

The people factor: A critical ingredient for intelligent communications

How to improve communication within your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now

Most Popular

How to find RAM speed, size and type

How to find RAM speed, size and type

26 Feb 2021
How to connect one, two or more monitors to your laptop

How to connect one, two or more monitors to your laptop

25 Feb 2021
How to build a CMS with React and Google Sheets
content management system (CMS)

How to build a CMS with React and Google Sheets

24 Feb 2021