One of the Microsoft Windows vulnerabilities used to spread the Stuxnet worm that targeted Iran remained the most widely exploited software bug in 2015 and 2016 even though the bug was patched years earlier, according to a report published by antivirus provider Kaspersky Lab.

In 2015, 27 percent of Kaspersky users who encountered any sort of exploit were exposed to attacks targeting the critical Windows flaw indexed as CVE-2010-2568. In 2016, the figure dipped to 24.7 percent but still ranked the highest. The code-execution vulnerability is triggered by plugging a booby-trapped USB drive into a vulnerable computer. The second most widespread exploit was designed to gain root access rights to Android phones, with 11 percent in 2015 and 15.6 percent last year.

The Windows vulnerability was first publicly disclosed in July 2010, a few days before security reporter Brian Krebs was the first to report on the Stuxnet outbreak. The bug resided in functions that process so-called .LNK files that Windows uses to display icons when a USB stick is connected to a PC. By hiding malicious code inside the .LNK files, a booby-trapped stick could automatically infect the connected computer even when its autorun feature was turned off. The self-replication and lack of any dependence on a network connection made the vulnerability ideal for infecting air-gapped machines. Microsoft patched the vulnerability in August, 2010.

The first known exploit of the .LNK vulnerability occurred in 2008 in attacks carried out by Equation Group, a state-sponsored group Kaspersky Lab said ran the most advanced hacking operation ever uncovered. Equation Group combined the .LNK exploit with other attacks that were also zerodays at the time to propagate a worm dubbed Fanny. A computer support forum thread from 2010 shows a user infected by Fanny asking: "How do I stop this virus?" In 2009 or 2010, Stuxnet used the .LNK vulnerability to install itself on computers inside Iran's Natanz uranium enrichment facility.

Staying power

Stuxnet—which New York Times reporter David Sanger said was the product of a joint operation between the US National Security Agency and its counterpart in Israel—took great pains not to spread outside of Iran. That effort famously failed. The worm has infected an estimated 100,000 or more computers around the world, the vast majority of which had nothing to do with Iran's uranium-enrichment program. The .LNK vulnerability was also exploited around 2009 by Naikon , a Chinese-speaking hacking group, and roughly two years later by Gauss, a piece of state-sponsored malware used to spy on targeted individuals in Lebanon, Syria, Israel, and the Palestinian region.

Kaspersky Lab's finding that CVE-2010-2568 was the most widespread exploit in 2015 and 2016 is a testament to its potential for longevity. Because attacks require little interaction on the part of users other than the use of an infected USB drive, the exploits propagate spontaneously in networks where vulnerable computers are installed. More generally, the finding also underscores the awesome staying power of worms, which by definition are pieces of malware that self-replicate. Conficker, another worm that targeted a critical Windows vulnerability Microsoft patched in 2008, has proven similarly difficult to extinguish.

Other key findings in Kaspersky Lab's report include:

The number of computer attacks that used exploits—defined as malicious code that uses software bugs to infect devices with malware—increased by 24.5 percent in 2016, to 702 million.

The number of Kaspersky Lab users attacked by one or more exploits in 2016 fell by 20.9 percent more than in 2015, to 4.3 million.

Browsers, Windows, Android, and Oracle's Java software framework were the products exploited most often in 2016, with exploits numbering 1.5 million, 1.3 million, 750,716, and 226,852. Exploits of Microsoft Office more than doubled in 2016 to 367,167.

Attackers have used and reused exploits targeting more than 80 vulnerabilities in the years 2010 to 2016. Roughly two-thirds of those exploits were used by more than one attacker.

A link to the Kaspersky report is here.