Researchers Uncover Stuxnet-Style Flaw In Windows

Ten years after the Stuxnet computer worm was first uncovered in 2010, security researchers have found two unpatched flaws in the same Windows component exploited by Stuxnet to attack critical infrastructure systems.

Stuxnet attacked its targets via a flaw in the 20-year-old Windows Print Spooler, which acts as an interface between Windows and a printer, loading the printer driver, queueing print jobs and carrying out other printing-related tasks.

The Stuxnet worm, thought to be a cyber-weapon jointly developed by the US and Israel, used its Windows Print Spooler flaw, known as CVE-2010-2729, to gain remote access to a system in order to execute malicious code.

More recently, in May 2020, Microsoft patched CVE-2020-1048, a privilege-escalation vulnerability in the Print Spooler that could allow an attacker to gain the highest level of system privileges, effectively allowing them to take control of a system.


Patch bypass

But two researchers, Tomer Bar and Peleg Hadar of SafeBreach Labs, have now discovered that Microsoft’s patch was not complete, and can be bypassed to re-exploit the same issue.

Microsoft has assigned the designation CVE-2020-1337 to the latest flaw, and said it plans to fix the bug in its August monthly Windows patch update.

Bar and Hadar also found a denial-of-service (DoS) vulnerability in the Print Spooler, but Microsoft said this flaw is not serious enough to patch.

The escalation-of-privilege attack affects Windows versions from Windows 7 to Windows 10, while the DoS bug affects all versions from Windows 2000 up to current releases.

At the Black Hat USA 2020 security conference Bar and Hadar said the privilege escalation flaw could be used by an attacker who has physical access to a system to gain escalated privileges.

An attacker who had already established remote access through other means could also use the flaw to take control of a system and execute malicious code.

Persistence

The flaw could additionally be used to establish persistence on a system, Bar and Hadar said.

They said the bug can be exploited using a series of PowerShell commands, without the need for specialised tools.

They have released proof-of-concept exploit code for the DoS bug and plan to release it for the escalation-of-privilege attack after Microsoft patches it.

The pair have also developed proof-of-concept code for a mini filter kernel driver that they said can help mitigate privilege escalation flaws in real time.

The researchers are publishing their proof-of-concept code on GitHub.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

Facebook, Twitter, YouTube Agree To Hate Speech Audits

Social networking giants agree to outside audit of efforts to deal with hate speech, after…

6 hours ago

EU Regulators Extend Fitbit Antitrust Probe

Fitness data probe. European antitrust regulators have given themselves more time to investigate Google's acquisition…

6 hours ago

Coronavirus: Mobile World Congress Postponed To June 2021

Safety concerns due to the ongoing Coronavirus pandemic around the world, delays telecom sector's biggest…

7 hours ago

Huawei CEO: ‘Survival Is The Goal’

With US restrictions hurting its business and threatening its supply chain and tech inventory, Huawei…

8 hours ago

Tesla Battery Day: Elon Musk Touts New Advances

Tesla's Elon Musk 'battery day announcements include 'tabless' batteries for improved range; goal of making…

10 hours ago