Microsoft has plugged a hole in its Windows operating system that allowed attackers to use USB-connected drives to take full control of a targeted computer.
Microsoft said it classified the vulnerability as "important," a less severe rating than "critical," because exploits require physical access to the computer being attacked. While that requirement makes it hard for hacks to spread online, readers should bear in mind that the vulnerability in theory allows attackers to carpet bomb conferences or other gatherings with booby-trapped drives that when plugged in to a vulnerable computer infect it with malware. Such vulnerabilities also allow attackers to penetrate sensitive networks that aren't connected to the Internet, in much the way the Stuxnet worm that targeted Iran's nuclear program did.
"When you look at it in the sense of a targeted attack, it does make the vulnerability critical," Marc Maiffret, CTO of BeyondTrust, told Ars. "Because of things like Stuxnet raising awareness around the physical aspect of planting USB drives or having people to take these things into facilities, it does make it critical."
Read 4 remaining paragraphs | Comments