Feeds

Bug gives attackers complete control of Windows PCs

Hijacking Microsoft's Help and Support

5 things you didn’t know about cloud backup

A security researcher has warned of a vulnerability in older versions of the Windows operating system that allows attackers to take full control of a PC by luring its user to a booby-trapped website.

The flaw resides in the Windows Help and Support Center, a feature that provides users with online technical support. Malicious hackers can exploit the weakness of Windows by embedding commands in web addresses that activate the feature's remote assistance tool, which allows administrators to execute commands over the internet. The exploit works in XP and Server 2003 versions of Windows and possibly others.

“Upon successful exploitation, a remote attacker is able to execute arbitrary commands with the privileges of the current user,” researcher Tavis Ormandy wrote in an advisory published Wednesday. The attack works against most major browsers, including Internet Explorer 8 if the Windows Media Player is available.

The advisory said Microsoft's security team was alerted to the vulnerability in the help and support feature on Friday. “I've concluded that there's a significant possibility that attackers have studied this component, and releasing this information rapidly is in the best interest of security,” Ormandy wrote.

“Microsoft is investigating public disclosure of a vulnerability affecting Windows XP and Windows Server 2003,” company spokesman Jerry Bryant said in a statement. “We will release more information as we determine the extent of the issue based on our investigation.”

Microsoft engineers place tight restrictions on the remote assistance tools to prevent them from being misused by attackers. But the advisory said it's possible to bypass those protections by tricking the whitelist verification through the use of invalid hex sequences. By combining that weakness with XSS, or cross-site scripting, holes in the Help and Support Center pages, attackers can take full control of a PC simply by exposing a browser to URLs with special commands in them.

“It's a great analysis,” H D Moore, CSO and chief architect of the Metasploit project, told The Register in an instant message. “The core issue itself (not checking the result of the hex decode) is brilliant in how simple it is, and it looks like it took a lot of investigation to determine that it was actually exploitable.”

The advisory provided a proof-of-concept that works for a variety of XP and Server 2003 configurations, but it went on to warn that techniques for exploiting other versions probably exist. The most useful mitigation is to turn off the remote assistance tool, but the advisory provides several other temporary fixes for those who rely on the feature. ®

5 things you didn’t know about cloud backup

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?