Microsoft warns of serious computer security hole

Jul 06, 2009 By JORDAN ROBERTSON , AP Technology Writer
Microsoft Windows XP logo

(AP) -- Microsoft Corp. has taken the rare step of warning about a serious computer security vulnerability it hasn't fixed yet.

The disclosed Monday affects Internet Explorer users whose computers run the Windows XP or Windows Server 2003 operating .

It can allow hackers to remotely take control of victims' machines. The victims don't need to do anything to get infected except visit a Web site that's been hacked.

Security experts say criminals have been attacking the vulnerability for nearly a week. Thousands of sites have been hacked to serve up that exploits the vulnerability. People are drawn to these sites by clicking a link in spam e-mail.

The so-called "zero day" vulnerability disclosed by affects a part of its software used to play video. The problem arises from the way the software interacts with Internet Explorer, which opens a hole for hackers to tunnel into.

Microsoft urged vulnerable users to disable the problematic part of its software, which can be done from Microsoft's Web site, while the company works on a "patch" - or software fix - for the problem.

Microsoft rarely departs from its practice of issuing security updates the second Tuesday of each month. When the Redmond, Wash.-based company does issue security reminders at other times, it's because the vulnerabilities are very serious.

A recent example was the emergency Microsoft issued in October for a vulnerability that criminals exploited to infect millions of PCs with the Conficker worm. While initially feared as an all-powerful doomsday device, that network of infected machines was eventually used for mundane moneymaking schemes like sending spam and pushing fake antivirus software.

---

On the Net:

Microsoft support page: http://tinyurl.com/kwh8ls


Join PhysOrg.com on Facebook!
Follow PhysOrg.com on Twitter!
©2009 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Explore further: Blink, point, solve an equation: Introducing PhotoMath

add to favorites email to friend print save as pdf

Related Stories

Don't fret about Conficker: Here's what to do

Mar 31, 2009

(AP) -- The Conficker worm, a nasty computer infection that has poisoned millions of PCs, will start ramping up its efforts Wednesday to use those machines for cybercrimes. It's unclear whether everyday PC users will even ...

Huge computer worm Conficker stirring to life

Apr 09, 2009

(AP) -- The dreaded Conficker computer worm is stirring. Security experts say the worm's authors appear to be trying to build a big moneymaker, but not a cyber weapon of mass destruction as many people feared.

Fix for Windows vulnerability due Jan. 10

Jan 03, 2006

Microsoft said Tuesday it would be about a week before it would release a fix for a vulnerability in Windows that opens the doors to viruses and spyware.

Microsoft Investigates IE 7 Vulnerability

Mar 16, 2007

The vulnerability leaves users open to potential phishing attacks. Microsoft is investigating a new flaw uncovered in Internet Explorer 7 that opens users up to phishing attacks.

No foolproof way to beat virus attack for now

Aug 17, 2005

Microsoft continues to be the prime target for those intent on wrecking havoc in cyberspace, but for now the software giant argues that only it can save users from computer-virus attacks.

Recommended for you

Report: Better shields needed for private tax data

44 minutes ago

Federal investigators say the IRS and the states should improve how they protect the security of confidential tax information of people getting benefits under the 2010 health care law.

Some online shoppers pay more than others, study shows

1 hour ago

Internet users regularly receive all kinds of personalized content, from Google search results to product recommendations on Amazon. This is thanks to the complex algorithms that produce results based on users' profiles and ...

Comcast wins more Internet customers, ad sales up

2 hours ago

Comcast Corp.'s third-quarter net income jumped 50 percent in the third quarter, helped by a one-time tax settlement, growth in Internet subscribers and fewer defectors from its cable service.

Christian Bale to play Apple's Steve Jobs

3 hours ago

Oscar-winner Christian Bale—best known for his star turn as Batman in the blockbuster "Dark Knight" films—will play Apple co-founder Steve Jobs in an upcoming biopic.

Netflix to stream new online TV series, 'Bloodline'

3 hours ago

Fresh from commercial and critical success with hit shows "House of Cards" and "Orange is the New Black," Netflix on Thursday announced a new online series, "Bloodline," set for release in March.

User comments : 11

Adjust slider to filter visible comments by rank

Display comments: newest first

gmurphy
5 / 5 (1) Jul 06, 2009
yet another triumph of mediocrity for Microsoft
dirk_bruere
5 / 5 (1) Jul 06, 2009
Yet another reason to stay well clear of IE
jimbo92107
5 / 5 (3) Jul 06, 2009
Another reason to try Linux.
DGBEACH
not rated yet Jul 06, 2009
Right on jimbo!
LuckyBrandon
3 / 5 (2) Jul 07, 2009
ok yes, its definitely a security flaw, but hardly one that can be entirely blamed on microsoft.

first off, the article states the typical method it uses to get tpeople to the site is a link in spam mail...

"Thousands of sites have been hacked to serve up malicious software that exploits the vulnerability. People are drawn to these sites by clicking a link in spam e-mail."



ok so thats ID10T user right fkn there right....



Second off, which the article doesnt provide enough info, depending on HOW it exploits IE and the OS, it may be preventable, however, IF the default security settings on the OS of any given windows version are not locked down enough out of the box, that could of course open MANY holes..



But before you no MS likers actually swear off of Microsoft, you should look at the abilities to lock down the OS (at least in the "professional", "business", "ultimate", and server editions of ever OS since Win2000)...most exploits can be prevented, as long as you know how youre being attacked :)
Dig
5 / 5 (3) Jul 07, 2009

ok so thats ID10T user right fkn there right....


LuckyBrandon, haven't you learned that here in the USA all the smart people are responsible for protecting the dumb people from themselves? That's why we have so many lawyers. LOL.

I know how to fix this.... send a spam email that goes to a site that explains to people (in simple terms) the dangers of clicking on links in spam emails. Oh, and put the words "Click me first" in the subjectline!!!! LOLOLOLOL :)
LuckyBrandon
1 / 5 (1) Jul 07, 2009
LMAO

I like it Dig :D
Damon_Hastings
not rated yet Jul 11, 2009
All kidding aside, these security holes are a serious problem. The compromised computers are often used as a platform to launch massive cyberextortion attacks against anyone who refuses to pay a ransom. These DDoS attacks are very much on the rise, as they are generally successful, profitable, and untraceable -- and it usually costs more to defend against them than to pay the ransom. Also, the extortionists launch these attacks at virtually no cost. These attacks are now happening at the rate of hundreds per DAY. On at least two separate occasions during a 2 year period, my own website was knocked out for several days as collateral damage. My website wasn't even the intended target, but the DDoS attacks were so massive and so successful that they each took out hundreds of websites which just happened to be too close to the target. I only know this because I knew one of the datacenter techs that worked on it; they were telling everyone else that it was "unscheduled maintenance". I have since changed datacenters, but this does not seem to have reduced the incidence of "unscheduled maintenance."



I don't think Microsoft has a responsibility to protect people from their own stupidity; but I do think they have a responsibility to prevent their software from being weaponized into a platform for attacking and extorting innocent people.







EvgenijM
not rated yet Jul 12, 2009
I'm glad I am using Linux. Even if someone writes i virus for all Linux browsers - the virus will still need root access. This means that even if virus executes - it won't be able to do anything with system itself.
frogz
not rated yet Jul 13, 2009
Bah.. just reboot. Everything will be just fine.
LuckyBrandon
1 / 5 (1) Jul 15, 2009
damon-the same can be said for any OS, as any OS technically could be weaponized. But who cares about hijacking 20 unix based systems when there are 20,000 windows systems. the problem is, you cant find all exploits before a malicious individual does (maybe in the quantum days it will be)...

evgen-if you put 20,000 linux systems out there in place of windows, i guarantee you that would not be a problem for long at all