Old vulnerabilities die hard: researchers uncover 20-year

It's an example of the old code that is bequeathed to popular software programs we take for granted.

Every Microsoft Windows operating system has a file that manages commands to print documents. It is ubiquitous to the point of going unnoticed. But when researchers from security firm SafeBreach took a closer look at the file, which is called a Print Spooler Service, they noticed that some of the code is two decades old.

A denial of service vulnerability the researchers reported earlier this year, which crashes the spooler service, worked not on only Windows 10, the latest operating system, but also on Windows 2000. It’s a glaring example of the old code that is bequeathed to popular software programs we take for granted.

But the researchers weren’t done dissecting the spooler service.

“We got intrigued, so we continued to dive in,” said Peleg Hadar, senior security researcher at SafeBreach Labs. They found another bug in the spooler service that could allow an attacker to gain system privileges on a machine. After Microsoft patched the issue in May, Hadar and his colleague, Tomer Bar, reverse-engineered the patch and developed a new exploit that Microsoft is still working to address.

While presenting their findings at the Black Hat hacking conference this week, Hadar and Bar release proof-of-concept code on GitHub designed to help detect attacks on the spooler service.

“We wanted to get people to think of a wider approach on how these kinds of issues can be mitigated,” Hadar told CyberScoop.`

The most famous malware to abuse a print spooler service was Stuxnet, the computer worm that sabotaged centrifuges at an Iranian nuclear facility a decade ago. Stuxnet spread, in part, through an exploit that copied the malware onto remote computers through the spooler service.

Liam O’Murchu, a security specialist who investigated Stuxnet, marveled at the longevity of security issues in the spooler service.

“It is amazing that the print spooler code appears to have survived untouched from when Stuxnet was discovered over 10 years ago through to today, and may in fact date back 20 years,” O’Murchu, director of the security technology and response group at Symantec, told CyberScoop.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure