New Windows Malware

[munkery]

A new worm similar to and possibly based on Stuxnet's source code is targeting Windows systems used in industrial settings.

http://www.symantec.com/connect/w32_duqu_precursor_next_stuxnet

http://www.symantec.com/content/en/...he_precursor_to_the_next_stuxnet_research.pdf

The installation vector is unknown.

It is possible that it leverages a local privilege escalation zero day.

 

[munkery]

Another reminder to use strong passwords.

A Windows worm is spreading across networks via the RDC service by brute forcing weak passwords.

http://www.computerworld.com/s/article/9219555/New_Windows_worm_spreads_by_attacking_weak_passwords

 

[munkery]

During around the last week of September, MySQL was hacked and was hosting drive-by-downloads of malware targeting Windows.

The malware was installed just by visiting the website. Installation occurred without the user knowing given that it didn't request permission to be installed.

http://blog.armorize.com/2011/09/mysqlcom-hacked-infecting-visitors-with.html?m=1

 

[munkery]

A new worm similar to and possibly based on Stuxnet's source code is targeting Windows systems used in industrial settings.

http://www.symantec.com/connect/w32_duqu_precursor_next_stuxnet

http://www.symantec.com/content/en/...he_precursor_to_the_next_stuxnet_research.pdf

The installation vector is unknown.

It is possible that it leverages a local privilege escalation zero day.

It has been confirmed that Duqu utilizes a local privilege escalation vulnerability to bypass discretionary access controls to install this malware at the system-level without prompting the user during installation.

http://www.theregister.co.uk/2011/11/01/duqu_exploits_windows_zero_day/

This means that this malware has access to even protected keystrokes, such as those related to security sensitive logins and other protected data entry.

The vulnerability is a zero day in the Windows kernel. It is presently still unpatched but given the severity of the threat will most likely be fixed quickly.

No workaround to mitigate the issue until a patch is ready has been provided by Microsoft.

 

[munkery]

Proof of concept bootkit for Windows 8 that includes local privilege escalation exploit to bypass UAC.

http://www.slashgear.com/windows-8-security-loophole-demoed-by-researcher-25198057/

 

[munkery]

Vulnerability in Win32k.sys allows arbitrary code execution with kernel-mode privileges via the web browser in Windows 7. -> http://www.theregister.co.uk/2011/12/21/win_7_bug_crash_risk/

This vulnerability would allow a sandbox escape as well as protected storage and protected data entry to be compromised. -> http://secunia.com/advisories/47237

Successful exploitation may allow execution of arbitrary code with kernel-mode privileges.

This vulnerability is not isolated to Safari running in Windows 7. -> http://pastebin.com/XTWnLF3p

What this means is that *any* client, local or remote, that does skinning of the controls (i.e.: almost all of them -- even a button on a flash PDF) could result in a NineGrid transform that hits this bug. It's not at all specific to WebKit.

The vulnerability has been known to manifest in Firefox since 2005. -> https://bugzilla.mozilla.org/show_bug.cgi?id=320430

 

[munkery]

Known malware combined with new 0-day to steal intellectual property from US defence contractors.

http://www.symantec.com/connect/blogs/sykipot-attacks

 

[munkery]

Stuxnet and Duqu have three other siblings.

http://venturebeat.com/2011/12/29/stuxnet-siblings/

 

[munkery]

Sykipot still compromising US government systems.

http://www.pcworld.com/article/2482..._us_dod_smart_cards_with_sykipot_malware.html

The control of US military spy drones appears to have shifted from Windows to Linux following an embarrassing malware infection.

http://www.theregister.co.uk/2012/01/12/drone_consoles_linux_switch/

Ramnit functionality is expanding beyond Facebook.

http://arstechnica.com/business/new...tm_source=rss&utm_medium=rss&utm_campaign=rss