Windows Bug Used To Spread Stuxnet World's Most Exploited


reader comments 14

one of the vital Microsoft home windows vulnerabilities used to spread the Stuxnet worm that focused Iran remained probably the most broadly exploited instrument worm in 2015 and 2016 even if the malicious program was once patched years past, in step with a file revealed via antivirus supplier Kaspersky Lab.

The most widespread exploits of 2015.

magnify / the most popular exploits of 2015.
Kaspersky Lab

The most widespread exploits of 2016.

amplify / probably the most well-liked exploits of 2016.
Kaspersky Lab

In 2015, 27 p.c of Kaspersky customers who encountered any sort of make the most have been exposed to attacks focused on the essential windows flaw indexed as CVE-2010-2568. In 2016, the determine dipped to 24.7 % but still ranked the best. The code-execution vulnerability is brought about with the aid of plugging a booby-trapped USB force into a inclined computer. The 2nd most standard make the most was once designed to gain root get entry to rights to Android telephones, with 11 percent in 2015 and 15.6 % ultimate 12 months.

The home windows vulnerability was once first publicly disclosed in July 2010, a couple of days prior to safety reporter Brian Krebs was once the primary to file on the Stuxnet outbreak. The malicious program resided in features that course of so-known as .LNK recordsdata that home windows makes use of to display icons when a USB stick is hooked up to a laptop. via hiding malicious code throughout the .LNK information, a booby-trapped stick could routinely infect the related computer even when its autorun feature was once turned off. The self-replication and absence of any dependence on a network connection made the vulnerability ideal for infecting air-gapped machines. Microsoft patched the vulnerability in August, 2010.

the first known take advantage of of the .LNK vulnerability took place in 2008 in assaults performed by using Equation crew, a state-subsidized group Kaspersky Lab mentioned ran essentially the most evolved hacking operation ever uncovered. Equation staff combined the .LNK exploit with different assaults that have been also zerodays at the time to propagate a worm dubbed Fanny. a pc beef up discussion board thread from 2010 displays a consumer contaminated by way of Fanny asking: “How do I stop this virus?” In 2009 or 2010, Stuxnet used the .LNK vulnerability to put in itself on computer systems inside Iran’s Natanz uranium enrichment facility.


Stuxnet—which the big apple instances reporter David Sanger mentioned was the product of a joint operation between the usa nationwide security company and its counterpart in Israel—took nice pains not to spread outdoor of Iran. That effort famously failed. The worm has contaminated an estimated 100,000 or extra computers all over the world, the vast majority of which had nothing to do with Iran’s uranium-enrichment application. The .LNK vulnerability was additionally exploited round 2009 through Naikon, a chinese-talking hacking group, and roughly two years later via Gauss, a section of state-backed malware used to undercover agent on centered individuals in Lebanon, Syria, Israel, and the Palestinian region.

Kaspersky Lab’s finding that CVE-2010-2568 used to be the most popular exploit in 2015 and 2016 is a testomony to its attainable for longevity. because assaults require little interaction on the part of customers as opposed to the usage of an infected USB pressure, the exploits propagate spontaneously in networks where inclined computers are put in. more in most cases, the discovering additionally underscores the awesome endurance of worms, which by using definition are pieces of malware that self-replicate. Conficker, any other worm that focused a essential windows vulnerability Microsoft patched in 2008, has proven similarly tough to extinguish.

Overall number of attacked users and number of attacks in 2015 and 2016.

magnify / overall choice of attacked users and selection of assaults in 2015 and 2016.
Kaspersky Lab

The change in the number of users attacked with exploit for major applications of OSes in 2015 and 2016.

amplify / The exchange in the choice of users attacked with exploit for main applications of OSes in 2015 and 2016.
Kaspersky Lab

different key findings in Kaspersky Lab’s document embrace:

  • The number of computer attacks that used exploits—outlined as malicious code that makes use of tool bugs to contaminate gadgets with malware—increased by way of 24.5 % in 2016, to 702 million.
  • The number of Kaspersky Lab customers attacked by way of a number of exploits in 2016 fell by way of 20.9 p.c more than in 2015, to four.three million.
  • Browsers, home windows, Android, and Oracle’s Java software framework had been the products exploited most ceaselessly in 2016, with exploits numbering 1.5 million, 1.3 million, 750,716, and 226,852. Exploits of Microsoft place of business greater than doubled in 2016 to 367,167.
  • Attackers have used and reused exploits focused on more than 80 vulnerabilities in the years 2010 to 2016. Roughly two-thirds of these exploits have been used by multiple attacker.

A hyperlink to the Kaspersky record is here.

Packet Storm


Share This Article!...