VeriSign Revokes Certificate Used to Sign Stuxnet Malware
The digital certificate that belonging to Realtek Semiconductor that was used to sign a pair of drivers fro the new Stuxnet rootkit has been revoked by VeriSign. The certificate was revoked Friday, several days after news broke about the existence of the new malware and the troubling existence of the signed drivers.
Stuxnet's infection method takes advantage of a previously unknown vulnerability in most of the current versions of Windows, including Windows Vista, Windows 7, both 32- and 64-bit versions, and Windows Server 2008. The vulnerability in the Windows shell is what enables the malware to execute via the .lnk files. Microsoft said it is investigating the flaw and looking at possible solutions, however there was no clear indication that the company intends to patch the flaw in the near future.
On Sunday, proof-of-concept exploit code for the Windows shell vulnerability was posted to Offensive Security's Exploit Database. The code is designed to work on Windows XP SP3.
