jness

Allowing code signing with a certificate that we generate for and hand out to enterprise customers was certainly not something we intended to do at Microsoft. It was sloppy and a mistake on our part that we rushed to address as soon as we discovered the issue. Honestly, I think many of us are terribly embarrassed by this failure and a little surprised that no one (us included) had discovered this issue years ago. :(

Microsoft ASP.NET fix coming tomorrow morning at 10am. http://technet.microsoft.com/en-us/security/bulletin/ms11-de...

This malware does not target air-gapped industrial control systems. This is just a remote administration trojan with a keylogging component. The kernel mode driver architecture and hooking method is the same (probably same code) as used in Stuxnet but the malware's purpose is information gathering only, not industrial sabotage.

To protect against this attack on Windows 7 and WS08 R2 client-side when browsing to sites that support it, enable TLS 1.1:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client] "DisabledByDefault"=dword:00000000

If both client and server support TLS 1.1, the conversation will use TLS 1.1 and this attack will not work. This vulnerability demonstration will probably prompt websites such as PayPal to consider adding TLS 1.1 support.

If you host a website using IIS on Windows Server 2008 R2, you can enable TLS 1.1 server-side as an option for customers that have enabled it client side. That regkey is

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] "DisabledByDefault"=dword:00000000