Feeds

Microsoft sees spike in attacks targeting 0day Windows bug

With help like that ...

Beginner's guide to SSL certificates

The number of malicious attacks exploiting an unpatched vulnerability in older versions of Windows has mushroomed over the past week, prompting Microsoft to warn customers to deploy countermeasures until an update is released.

Microsoft said on Wednesday that its security team has detected more than 10,000 distinct computers that have experienced the attack against the bug in the Windows Help and Support Center. The vulnerability, which was disclosed on June 10 by researcher Tavis Ormandy, makes it possible for attackers to remotely install malware on computers running Windows XP and Server 2003 by luring end users to booby-trapped websites.

For the first 10 days following the disclosure, attacks were targeted and relatively few. But over the past week and a half, they have suddenly increased, Holly Stewart, a member of the Microsoft Malware Protection Center, warned here. Geographies with the biggest attack volume are the US, Russia, Portugal, Germany, and Brazil.

Stewart advised vulnerable Windows users who have not implemented one of the countermeasures listed here to strongly consider doing so now.

The surge of attacks appear to be carried out by “seemingly-automated, randomly-generated html and php pages,” Stewart said. When the attacks began, they mostly installed a backdoor known as Obitel, which is used to download other malware. But over time the exploits have marshaled a variety of other trojans, which Microsoft detects as Win32/Swrort.A, Win32/Tedroo.AB, Win32/Oficla.M, and Win32/Neetro.A, among others.

Microsoft has said it's working on an update to patch the gaping security hole. In additional to deploying workarounds, users can find some protection from Security Essentials, Forefront Client Security, and other anti-virus products from Microsoft.

The spike in attacks shows the darker side of so-called full disclosure, which is the belief among some security professionals that all information about vulnerabilities should be communicated as broadly as possible so that individuals are fully informed about risks and companies have an incentive to fix the bugs as soon as possible. It's a position your reporter has regularly and sometimes vociferously advocated. But it also seems fair to say that these attacks probably wouldn't have happened had Ormandy been more reticent. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.