In August 2010, Microsoft patched a previously unknown USB vulnerability that state-sponsored attackers had secretly exploited for years, first to infect targets of the "omnipotent" Equation Group and shortly thereafter to spread the virulent Stuxnet worm inside Iranian nuclear facilities. Now, almost five years later, security researchers have warned that the patch designated as MS10-046 failed to fully repair the weakness and that Windows PCs have remained susceptible to similar attacks the entire time. On Tuesday, the software maker released MS-15-020, a patch it says fixes the vulnerability.

As has been extensively documented since July 2010, the vulnerability has been repeatedly exploited in the wild since at least 2008 to surreptitiously infect PCs, even when they weren't connected to the Internet, as was the case with computers inside Iran's Natanz uranium enrichment facility infected by Stuxnet. Besides Stuxnet creators, at least one other group with ties to the NSA has been known to have exploited the so-called .LNK vulnerability: the highly advanced Equation Group hackers. While the exploits developed by those highly advanced state-sponsored attackers would no longer work on a PC that received the MS10-046 patch, there's no way to know if these hacking groups revised their exploits to work around the update. It's also unknown if other groups discovered and exploited the vulnerability.

"Whether this is being used in the wild over time remains to be seen," said Brian Gorenc, the lead researcher with HP's Zero Day Initiative, which first reported the vulnerability to Microsoft. "It's hard to believe that somebody didn't know about this bug prior to it being patched today."

HP's just-released 2015 "Cyber Risk Report" showed that the CVE-2010-2568 that came to light in August 2010 was the No. 1 most exploited vulnerability of 2014, accounting for about a third of the attack samples seen. Gorenc said those attacks likely would not have worked against PCs that received the earlier patch. But he went on to tell Ars that it wouldn't be hard for experienced attackers to reverse engineer that 2010 patch and identify loopholes that made it possible to bypass verification checks it put in place. The HP report, he said, didn't account for any such revised attacks because the ability to bypass the protections has only recently been discovered.

A blog post HP plans to publish on Tuesday afternoon makes an oblique reference to in-the-wild exploits. "Rumors point to this failed patch being exploited publicly, and we find ourselves in the same position as we were with Stuxnet," the post, which was reviewed by Ars, stated without elaborating. Gorenc didn't elaborate on the rumors either.

The vulnerability resides in the Windows shell32.dll file, specifically in functions that process so-called .LNK files Windows uses to display icons when a USB stick is connected to a PC. By embedding malicious code inside a .LNK file, a booby-trapped stick could automatically infect the connected computer even when its autorun feature is turned off. The self-replication and lack of any dependence on a network connection makes the vulnerability ideal for infecting air-gapped machines.

"The patch failed"

Early this year, researcher Michael Heerklotz approached HP ZDI with a proof-of-concept exploit that demonstrated that with a little more work the .LNK vulnerability remained exploitable. The new attack worked by bypassing verification checks Microsoft built into the 2010 patch.

"The patch failed," HP researchers wrote in a blog post published Tuesday morning. "And for more than four years, all Windows systems have been vulnerable to exactly the same attack that Stuxnet used for initial deployment."

In addition to installing the MS10-046 patch, users also had the option of following instructions provided by Microsoft to manually disable the display of icons for LNK files. The HP blog post said people who took those steps have remained safe against newer attacks. Customers of HP's Tipping Point intrusion detection services have remained protected for the past 60 days while Microsoft was preparing a fix.

Windows users should hold off using any USB drives until after installing today's patch, which is available through the normal Windows Update mechanism. Users who are comfortable making changes to their OS registry should strongly consider manually disabling .LNK icons just to be sure.

Update: Microsoft officials released a statement that read in part: "This is a new vulnerability that required a new security update. Microsoft released a comprehensive security fix in 2010 to address the vulnerability the Stuxnet virus exploited. As technology is always changing, so are the tactics and techniques of cybercriminals."