9 ms·

Stuxnet's Legacy Lives on in New Windows Bug

187 points by whiteyford 6y ago

lostmsu 6y ago
TL;DR; there was a local privilege escalation bug in Print Spooler (fixed yesterday). The article calls it "Stuxnet's Legacy" because Stuxnet hit the same component. But Stuxnet bug was a remote code execution (10 years ago).
- draugadrotten 6y ago
  TL;DR; There are undisclosed unpatched CVEs pending for Windows Print Spooler services. From the article: "The [researchers] also said that they had found and disclosed some other bugs in the same are that have not yet been patched “so there’s definitely still some dragons hiding.”"
s_dev 6y ago
I'm still in awe of stuxnet: https://www.quora.com/What-is-the-most-sophisticated-piece-of-software-ever-written-1?share=1 https://www.quora.com/What-is-the-most-sophisticated-piece-o... Almost certainly an NSA product.
- ciarannolan 6y ago
  It was a multinational effort (US, Israel, Germany), mostly lead by the NSA.
  - detuur 6y ago
    This must be the first time I've ever seen Germany implicated in this. I consider it 100 times more likely that the UK was involved than Germany.
    - ciarannolan 6y ago
      From my very vague recollection of this from Countdown to Zero Day, there were some Germans (at Siemens?) who had expertise in the industrial control units that Stuxnet was attacking. Definitely don't take that as fact though :)
    - dsl 6y ago
      I personally believe the German government was aware, but did not directly participate in a meaningful way. However a German corporation played a huge role. Siemens engineers deployed a PCS 7 lab environment at the Idaho National Laboratory, where research in to exploits was conducted. Coincidently one of the methods Stuxnet used to stay hidden was demonstrated at the KEMA Control Systems Conference in Idaho Falls. Separately, Siemens engineers built a replica of the Iranian system at Shimon Peres Negev Nuclear Research Center in Israel using P-1 centrifuges the US obtained from Libya's nuclear program.
jakozaur 6y ago
Stuxnet is a masterpiece in terms of achieving goals while attacking hard to hit, network isolated facilities. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet It would be very interesting to see the next Stuxnet class viruses, sponsored by major companies/countries. I'm fairly sure there are some already running in the wild.
ciarannolan 6y ago
I thought Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon was a fantastic chronicle of Stuxnet. For those not interested in the whole narrative, it's still interesting to browse one or two chapters of interest. https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...
- accidentalrebel 6y ago
  I just checked and happy to find that it's on Audible. Can anyone recommend similar audiobooks on tech that are not as well known?
  - malware7 6y ago
    I'm not sure about the "not as well known" part, but these are some other books similar to Countdown to zero day and most of them have audiobooks available. https://darknetdiaries.com/books/ https://darknetdiaries.com/books/
  - khalladay 6y ago
    If you're looking for more computer security / hacking related books, I can recommend "Sandworm" (by Andy Greenberg) and "The Cuckoo's Egg" (by Cliff Stoll). Both appear to have audible versions.
  - jmull3n 6y ago
    The Mastermind by Evan Ratliff
- donclark 6y ago
  I thought the video was very compelling - https://www.youtube.com/watch?v=C8lj45IL5J4 https://www.youtube.com/watch?v=C8lj45IL5J4
barbegal 6y ago
It's worth reading the full technical analysis https://windows-internals.com/printdemon-cve-2020-1048/ https://windows-internals.com/printdemon-cve-2020-1048/ It's well written and easy to follow even for someone that doesn't know much about Windows security. And if you didn't read it the bug comes from the fact that the Powershell command Add-PrinterPort can be used to add a printer port as a file that you don't have access to. After restarting the spooler service you can then use this port to write to that file.
- koheripbal 6y ago
  Interesting - can you write back to RDP clients that are connected? As a call-back to infect a connected computer? If so, seems like you could use it to break out of VMs/RDP servers.
- quietbritishjim 6y ago
  This was very interesting, thanks for posting it! I will say that this is a bit misleading though: > the bug comes from the fact that the Powershell command Add-PrinterPort can be used ... The bug is in the print spooler service and the Windows API to access to it. It just happens that PowerShell offers an easy way to access the Windows API, which makes it easy to illustrate the exploit.
Jonnax 6y ago
Why's it so difficult to write a print spooler? I'm not too familar with what it does exactly. But I presume it's a queue of documents to send to a printer and some level of conversation of the data from a print document format to what the printer driver understands. This seems like quite a crazy bug. Also today, a lot of home printers are network printers so it shouldn't even require higher privilages to send the document to the printer, right? Or is printing in Windows a huge can of worms like its use of UTF-16?
- derefr 6y ago
  It is indeed possible to design a system that only works as a client for network printers as a pure-userland service; I believe this is what iOS has, in the form of AirPrint. But most OS printing services cover both network and local (USB, parallel, even serial!) printing, and therefore the print daemon needs to essentially "own" ACLs on some collection of USB-devices and even "own" direct bit-banging access to a set of serial/parallel-ports, in the same sense that X11 gets to own VRAM memory-regions, or an audio daemon gets to own bit-banging access to a set of DAC controllers. Coupled with this is the problem of supporting legacy software that expects older consumer-microcomputer OS paradigms for device access. This isn't so much of a problem on POSIX systems, where the oldest paradigm (having /var/spool as a sticky dir, where roff(1) would just write files there) was already multitenant-friendly; you just need a print daemon (CUPS) that can watch /var/spool for changes, along with its non-legacy API. I believe you can roff(1) even within Termux on Android, and it'll "just work", without special kernel support other than the generic filesystem notification-event API. But Windows specifically inherits a print-system design all the way from DOS, and still supports software (e.g. Win9x software written for the Win32 API) that was written to expect that legacy API. I don't know too much about the Win32 print API specifically, but I'd guess that it was designed to be a forward-compatible shim on top of the DOS printing "API"—which was really just allowing the application to bang bits down the serial/parallel port through memory-mapped IO. That's what the "LPT1", "COM", etc. devices in Windows are: emulations of those same legacy memory-mapped IO channels that only make sense to access in a single-tasking OS. But, as of NT/W2K, it's actually the OS on the other end of that pipe, arbitrating data flows. So that's another thing that needs to happen in kernel-land in Windows: the emulation of an unprotected MMIO memory region within the process's address space, as a glorified syscall ABI, which just (these days) routes messages to the userspace print daemon, but back in Win9x probably did do all its work in kernelspace.
sunshine90219 6y ago
And Bill Gates wants to defend humanity against covid-19... what about focussing on Windows first? Maybe his foundation could give money to Microsoft?
jstrieb 6y ago
For a recent take on the geopolitical effects of Stuxnet and many other cyber attacks, I can recommend The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics by Dr. Ben Buchanan. I found it to be a fascinating account of international cyber attacks with a clear, well-argued thesis. https://www.amazon.com/Hacker-State-Attacks-Normal-Geopolitics/dp/0674987551 https://www.amazon.com/Hacker-State-Attacks-Normal-Geopoliti...
mrlonglong 6y ago
Isn't Alex Ionescu also the chap working on ReactOS, a clone of Windows?
cyptus 6y ago
See also on https://news.ycombinator.com/item?id=23178247 https://news.ycombinator.com/item?id=23178247
caf 6y ago
I'm pretty sure I recall the "Generic / Text-Only" printer driver from Windows 3.0 days.

187 points by whiteyford 6y ago

TL;DR; there was a local privilege escalation bug in Print Spooler (fixed yesterday). The article calls it "Stuxnet's Legacy" because Stuxnet hit the same component. But Stuxnet bug was a remote code execution (10 years ago).

draugadrotten 6y ago
TL;DR; There are undisclosed unpatched CVEs pending for Windows Print Spooler services. From the article: "The [researchers] also said that they had found and disclosed some other bugs in the same are that have not yet been patched “so there’s definitely still some dragons hiding.”"

s_dev 6y ago

I'm still in awe of stuxnet: https://www.quora.com/What-is-the-most-sophisticated-piece-of-software-ever-written-1?share=1 https://www.quora.com/What-is-the-most-sophisticated-piece-o... Almost certainly an NSA product.

ciarannolan 6y ago
It was a multinational effort (US, Israel, Germany), mostly lead by the NSA.
- detuur 6y ago
  This must be the first time I've ever seen Germany implicated in this. I consider it 100 times more likely that the UK was involved than Germany.
  - ciarannolan 6y ago
    From my very vague recollection of this from Countdown to Zero Day, there were some Germans (at Siemens?) who had expertise in the industrial control units that Stuxnet was attacking. Definitely don't take that as fact though :)
  - dsl 6y ago
    I personally believe the German government was aware, but did not directly participate in a meaningful way. However a German corporation played a huge role. Siemens engineers deployed a PCS 7 lab environment at the Idaho National Laboratory, where research in to exploits was conducted. Coincidently one of the methods Stuxnet used to stay hidden was demonstrated at the KEMA Control Systems Conference in Idaho Falls. Separately, Siemens engineers built a replica of the Iranian system at Shimon Peres Negev Nuclear Research Center in Israel using P-1 centrifuges the US obtained from Libya's nuclear program.

jakozaur 6y ago

Stuxnet is a masterpiece in terms of achieving goals while attacking hard to hit, network isolated facilities. https://en.wikipedia.org/wiki/Stuxnet https://en.wikipedia.org/wiki/Stuxnet It would be very interesting to see the next Stuxnet class viruses, sponsored by major companies/countries. I'm fairly sure there are some already running in the wild.

ciarannolan 6y ago

I thought Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon was a fantastic chronicle of Stuxnet. For those not interested in the whole narrative, it's still interesting to browse one or two chapters of interest. https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp...

accidentalrebel 6y ago
I just checked and happy to find that it's on Audible. Can anyone recommend similar audiobooks on tech that are not as well known?
- malware7 6y ago
  I'm not sure about the "not as well known" part, but these are some other books similar to Countdown to zero day and most of them have audiobooks available. https://darknetdiaries.com/books/ https://darknetdiaries.com/books/
- khalladay 6y ago
  If you're looking for more computer security / hacking related books, I can recommend "Sandworm" (by Andy Greenberg) and "The Cuckoo's Egg" (by Cliff Stoll). Both appear to have audible versions.
- jmull3n 6y ago
  The Mastermind by Evan Ratliff
donclark 6y ago
I thought the video was very compelling - https://www.youtube.com/watch?v=C8lj45IL5J4 https://www.youtube.com/watch?v=C8lj45IL5J4

barbegal 6y ago

It's worth reading the full technical analysis https://windows-internals.com/printdemon-cve-2020-1048/ https://windows-internals.com/printdemon-cve-2020-1048/ It's well written and easy to follow even for someone that doesn't know much about Windows security. And if you didn't read it the bug comes from the fact that the Powershell command Add-PrinterPort can be used to add a printer port as a file that you don't have access to. After restarting the spooler service you can then use this port to write to that file.

koheripbal 6y ago
Interesting - can you write back to RDP clients that are connected? As a call-back to infect a connected computer? If so, seems like you could use it to break out of VMs/RDP servers.
quietbritishjim 6y ago
This was very interesting, thanks for posting it! I will say that this is a bit misleading though: > the bug comes from the fact that the Powershell command Add-PrinterPort can be used ... The bug is in the print spooler service and the Windows API to access to it. It just happens that PowerShell offers an easy way to access the Windows API, which makes it easy to illustrate the exploit.

Jonnax 6y ago

Why's it so difficult to write a print spooler? I'm not too familar with what it does exactly. But I presume it's a queue of documents to send to a printer and some level of conversation of the data from a print document format to what the printer driver understands. This seems like quite a crazy bug. Also today, a lot of home printers are network printers so it shouldn't even require higher privilages to send the document to the printer, right? Or is printing in Windows a huge can of worms like its use of UTF-16?

derefr 6y ago
It is indeed possible to design a system that only works as a client for network printers as a pure-userland service; I believe this is what iOS has, in the form of AirPrint. But most OS printing services cover both network and local (USB, parallel, even serial!) printing, and therefore the print daemon needs to essentially "own" ACLs on some collection of USB-devices and even "own" direct bit-banging access to a set of serial/parallel-ports, in the same sense that X11 gets to own VRAM memory-regions, or an audio daemon gets to own bit-banging access to a set of DAC controllers. Coupled with this is the problem of supporting legacy software that expects older consumer-microcomputer OS paradigms for device access. This isn't so much of a problem on POSIX systems, where the oldest paradigm (having /var/spool as a sticky dir, where roff(1) would just write files there) was already multitenant-friendly; you just need a print daemon (CUPS) that can watch /var/spool for changes, along with its non-legacy API. I believe you can roff(1) even within Termux on Android, and it'll "just work", without special kernel support other than the generic filesystem notification-event API. But Windows specifically inherits a print-system design all the way from DOS, and still supports software (e.g. Win9x software written for the Win32 API) that was written to expect that legacy API. I don't know too much about the Win32 print API specifically, but I'd guess that it was designed to be a forward-compatible shim on top of the DOS printing "API"—which was really just allowing the application to bang bits down the serial/parallel port through memory-mapped IO. That's what the "LPT1", "COM", etc. devices in Windows are: emulations of those same legacy memory-mapped IO channels that only make sense to access in a single-tasking OS. But, as of NT/W2K, it's actually the OS on the other end of that pipe, arbitrating data flows. So that's another thing that needs to happen in kernel-land in Windows: the emulation of an unprotected MMIO memory region within the process's address space, as a glorified syscall ABI, which just (these days) routes messages to the userspace print daemon, but back in Win9x probably did do all its work in kernelspace.

sunshine90219 6y ago

And Bill Gates wants to defend humanity against covid-19... what about focussing on Windows first? Maybe his foundation could give money to Microsoft?

jstrieb 6y ago

For a recent take on the geopolitical effects of Stuxnet and many other cyber attacks, I can recommend The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics by Dr. Ben Buchanan. I found it to be a fascinating account of international cyber attacks with a clear, well-argued thesis. https://www.amazon.com/Hacker-State-Attacks-Normal-Geopolitics/dp/0674987551 https://www.amazon.com/Hacker-State-Attacks-Normal-Geopoliti...

mrlonglong 6y ago

Isn't Alex Ionescu also the chap working on ReactOS, a clone of Windows?

cyptus 6y ago

See also on https://news.ycombinator.com/item?id=23178247 https://news.ycombinator.com/item?id=23178247

caf 6y ago

I'm pretty sure I recall the "Generic / Text-Only" printer driver from Windows 3.0 days.