ICS-CERT has released security advisories to address the vulnerability exploited by malicious software.
New malware, called W32/Stuxnet-B, has been reported. This malware propagates using USB drives apparently infected with malformed shortcut (.lnk) files. F-Secure detects the LNK exploit as Exploit:W32/WormLink.A. Reports suggest that the malformed shortcuts exploit a remote code execution vulnerability in Microsoft Windows, which has been reported in IntelliShield Alert 20918.
Reports suggest that a successful exploit would require the targeted user to view the contents of the USB drive using Windows Explorer or other applications that display file icons. However, the malicious link vulnerability could be used to target any Windows systems through removable media.
The malicious code is contained in drivers that appear to be digitally signed by Realtek Semiconductor Corp, which could help the code bypass controls that require drivers to be signed. The same reports confirm the vulnerability on completely patched Microsoft Windows 7 installations as of July 15, 2010.
Event data from Cisco Remote Management Services has detected intrusion prevention system signature activity related to this vulnerability. The data, which was captured on July 27, 2010, could indicate that malicious software distribution is increasing in the wild.
One suggested method of additional propagation is through the SQL facilities in WinCC. Reports have indicated that the WinCCAdmin and WinCCConnect account passwords for WinCC are hard-coded, allowing potential exploits to run commands on the host operating system through SQL instructions executed using these account credentials. Further, Siemens forum postings suggest that administrators are advised against changing the passwords. If these reports are accurate, this could result in a wide exposure for sites that use WinCC, which is human-machine interface software for process control systems used for things like critical infrastructure and manufacturing.
User interaction, if needed, is limited to inserting the USB drive and viewing its contents. Further user interaction is not needed.
Systems that have disabled AutoRun for USB drives do not appear to be protected from this automatic execution of .lnk files.
Administrators are advised to configure antivirus software to scan media upon insertion. Administrators may also consider disallowing USB drives or other removable media from sensitive environments.
Users are advised not to plug in USB drives from unknown sources.
Microsoft has released a security bulletin at the following link: MS10-046. Microsoft customers can obtain updates directly by using the links in the security advisory. These updates are also distributed by Windows automatic update features and available on the Windows Update website. Microsoft Windows Server Update Services (WSUS), Systems Management Server, and System Center Configuration Manager can assist administrators in deploying software updates.
Proof-of-concept code that exploits this vulnerability is publicly available.
Siemens has confirmed that the malicious code exploiting this vulnerability is targeting Siemens WinCC SCADA systems. Further details are available at the following link: SIMATIC WinCC / SIMATIC PCS 7. However, software updates are not available.
Version 5, August 2, 2010, 2:28 PM: Microsoft has released a security bulletin along with software updates to address the vulnerability exploited by malicious software.
Version 4, July 27, 2010, 2:20 PM: Additional information is available regarding increased malware activity.
Version 3, July 20, 2010, 10:48 AM: Siemens has confirmed that its products are being affected by the malware outbreak targeting SCADA systems.
Version 2, July 19, 2010, 10:38 AM: Microsoft has released a security advisory and software updates to address the Microsoft Windows .lnk file vulnerability related to the malware outbreak targeting SCADA systems.
Version 1, July 16, 2010, 11:52 AM: New malware has been detected that appears to rely on an undisclosed vulnerability in Microsoft Windows .lnk file handling. This malware appears to be targeted at Siemens WinCC SCADA installations.
The security vulnerability applies to the following combinations of products.
for 32-bit systemsBase | for x64-based systemsBase | Datacenter EditionBase, SP2 | Datacenter Edition, 64-bit (Itanium)Base, SP2 | Datacenter Edition x64 (AMD/EM64T)Base, SP2 | Enterprise EditionBase, SP2 | Enterprise Edition, 64-bit (Itanium)Base, SP2 | Enterprise Edition x64 (AMD/EM64T)Base, SP2 | Standard EditionBase, SP2 | Standard Edition, 64-bit (Itanium)Base, SP2 | Standard Edition x64 (AMD/EM64T)Base, SP2 | Web EditionBase, SP2 | Datacenter EditionBase, SP2 | Datacenter Edition, 64-bitBase, SP2 | Itanium-Based Systems EditionBase, SP2 | Enterprise EditionBase, SP2 | Enterprise Edition, 64-bitBase, SP2 | Essential Business Server StandardBase, SP2 | Essential Business Server PremiumBase, SP2 | Essential Business Server Premium, 64-bitBase, SP2 | Standard EditionBase, SP2 | Standard Edition, 64-bitBase, SP2 | Web ServerBase, SP2 | Web Server, 64-bitBase, SP2 | x64-Based Systems EditionBase | Itanium-Based Systems EditionBase | Home BasicBase, SP1, SP2 | Home PremiumBase, SP1, SP2 | BusinessBase, SP1, SP2 | EnterpriseBase, SP1, SP2 | UltimateBase, SP1, SP2 | Home Basic x64 EditionBase, SP1, SP2 | Home Premium x64 EditionBase, SP1, SP2 | Business x64 EditionBase, SP1, SP2 | Enterprise x64 EditionBase, SP1, SP2 | Ultimate x64 EditionBase, SP1, SP2 | Home EditionBase, SP3 | Professional EditionBase, SP3 | Professional Edition, 64-bit (Itanium)Base, SP2 | Professional x64 (AMD/EM64T)Base, SP2
Alerts and bulletins on the Cisco Security Intelligence Operations Portal are highlighted by analysts in the
Cisco Threat Operations Center and represent a subset of the comprehensive content that is available through Cisco Security IntelliShield Alert Manager Service.
This customizable threat and vulnerability alert service provides security staff with access to timely, accurate, and credible information about threats and vulnerabilities that may affect their environment.
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.