Stuxnet: The most serious threat yet?

The Stuxnet worm has been causing alarm bells to ring in the security industry but what is it and how serious a threat does it pose?

ANALYSIS With so many different forms of threats out there, it is rare that one comes along to stand out from the crowd.

Stuxnet is something unique, however. It has been causing something of a stir in the security community since it was first spotted by a small company from Belarus named VirusBlokAda.

When Microsoft put out an alert over the virus in July, Stuxnet quickly moved from being a relative unknown to something serious.

Then earlier this month, Stuxnet was observed doing something unprecedented: exploiting four zero-day vulnerabilities at once. It is this advanced capability that has caused such a commotion.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

So how has it made such a splash in such a small amount of time and what are hackers doing with it?

How does it work?

A trio of big time companies, including Microsoft itself, Kaspersky and Symantec, has been busy tracking the worm.

When it was first identified, Stuxnet was found using a .lnk file vulnerability to spread through USB drives.

Microsoft explained that with this, Stuxnet takes advantage of specially-crafted shortcut files the .lnk files - placed on USB drives to automatically execute malware as soon as the .lnk file is read by the operating system.

"In other words, simply browsing to the removable media drive using an application that displays shortcut icons (like Windows Explorer) runs the malware without any additional user interaction," Microsoft explained.

Advertisement - Article continues below

As for the four other vulnerabilities Stuxnet has been found exploiting, one is the same as a flaw used by the notorious Conficker worm last year.

Another uses a vulnerability in the Windows Print Spooler to spread, taking advantage of this weakness to send malicious code to a remote computer where it is then executed.

"By virtue of the features of this vulnerability, the infection can spread to computers using a printer or through shared access to one. Having infected a computer connected to a network, Stuxnet then attempts to spread to other computers," Kaspersky explained.

All of these vulnerabilities have now been patched, but two remain, although they are less serious.

These unpatched security holes are used by Stuxnet to let the attacker move from having limited control over a computer, up to privileged access, meaning a system could be completely compromised. Microsoft has said it intends to fix these in a future security bulletin.

Featured Resources

Report: The State of Software Security

This annual report explores important trends in software security

Download now

A fast guide to finding your cloud solution

One size doesn't fit all in the cloud, so how do you find the best option for your business?

Download now

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Small & Medium Business Trends Report

Insights from 2,000+ business owners and leaders worldwide

Download now
Advertisement

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/hardware/354723/coronavirus-starts-to-take-its-toll-on-the-tech-industry
Hardware

Coronavirus starts to take its toll on the tech industry

6 Feb 2020
Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

10 Feb 2020
Visit/operating-systems/microsoft-windows/354739/windows-7-bug-blocks-users-from-shutting-down-their-pcs
Microsoft Windows

Windows 7 bug blocks users from shutting down their PCs

10 Feb 2020