Posted on 06/09/2010 8:03:48 PM PDT by Gomez
A security researcher has warned of a vulnerability in older versions of the Windows operating system that allows attackers to take full control of a PC by luring its user to a booby-trapped website.
The flaw resides in the Windows Help and Support Center, a feature that provides users with online technical support. Malicious hackers can exploit the weakness of Windows by embedding commands in web addresses that activate the feature's remote assistance tool, which allows administrators to execute commands over the internet. The exploit works in XP and Server 2003 versions of Windows and possibly others.
“Upon successful exploitation, a remote attacker is able to execute arbitrary commands with the privileges of the current user,” researcher Tavis Ormandy wrote in an advisory published Wednesday. The attack works against most major browsers, including Internet Explorer 8 if the Windows Media Player is available.
The advisory said Microsoft's security team was alerted to the vulnerability in the help and support feature on Friday. “I've concluded that there's a significant possibility that attackers have studied this component, and releasing this information rapidly is in the best interest of security,” Ormandy wrote.
“Microsoft is investigating public disclosure of a vulnerability affecting Windows XP and Windows Server 2003,” company spokesman Jerry Bryant said in a statement. “We will release more information as we determine the extent of the issue based on our investigation.”
Microsoft engineers place tight restrictions on the remote assistance tools to prevent them from being misused by attackers. But the advisory said it's possible to bypass those protections by tricking the whitelist verification through the use of invalid hex sequences. By combining that weakness with XSS, or cross-site scripting, holes in the Help and Support Center pages, attackers can take full control of a PC simply by exposing a browser to URLs with special commands in them.
“It's a great analysis,” H D Moore, CSO and chief architect of the Metasploit project, told The Register in an instant message. “The core issue itself (not checking the result of the hex decode) is brilliant in how simple it is, and it looks like it took a lot of investigation to determine that it was actually exploitable.”
The advisory provided a proof-of-concept that works for a variety of XP and Server 2003 configurations, but it went on to warn that techniques for exploiting other versions probably exist. The most useful mitigation is to turn off the remote assistance tool, but the advisory provides several other temporary fixes for those who rely on the feature.
ping
I never get online so I think I am ok
thank goodness I’m still using windows 3.1 on my 386 here.
Ping
Where is the "remote assistance tool?"
Control Panel => System => Remote tab
Sometimes I think that windows is akin to my attempts to do plumbing in my home. I fix one leak, only to find that I have caused two more.
From Windows Help....
Requesting help using Remote Assistance
Sometimes the best way to fix a problem is to have someone show you how. Remote Assistance is a convenient way for a distant friend to connect to your computer from another computer running a compatible operating system, such as Windows XP, and walk you through your solution.
By following the easy steps in Remote Assistance, you can use Windows Messenger Service or an e-mail message to invite a friend to connect to your computer. After he or she is connected, your friend will be able to view your computer screen and chat with you in real time about what you both see. With your permission, your assistant can even use his or her mouse and keyboard to work with you on your computer.
To start Remote Assistance
Click Start, and then click Help and Support.
Click Invite a friend to connect to your computer with Remote Assistance.
Notes
Both you and your helper must be using either Windows Messenger Service or a MAPI-compliant e-mail account such as Microsoft Outlook or Outlook Express.
You and your helper need to be connected to the Internet while using Remote Assistance.
If you are working on a local area network, firewalls might stop you from using Remote Assistance. In this case, check with your network administrator before using Remote Assistance.
If for some reason you are unable to send an invitation by using e-mail or Windows Messenger Service, you can create and save an invitation. On the first page of Remote Assistance, click Invite someone to help you. On the next page, click Save invitation as a file (Advanced), and follow the instructions to save the file. You can then send the saved invitation file to your helper in the manner you choose, such as copying it onto a floppy disk or a shared network location, sending it over another e-mail service or an FTP connection, and so on.
Another fine "feature" from our friends in Redmond that lets someone else muck around in the guts of your computer..
Thanks. That was easy. Just wanted to make sure it was shut off.
Thanks, but I wanted to shut it off, not turn it on.
There should be stiff criminal penalties on hackers and creators of vicious software purposely attacking other PC’s.
H’mmm, a real threat or disinformation to get everyone to buy Windows 7 or Mac’s?
Looks like a real threat to me. I normally use a Mac online, but I’m going to turn off the remote assistance tool in my XP computer if I can figure out how to do that.
I didn’t even know there was remote assistance tool on my XP.
Likewise. I’ll have to hunt for it.
Yet another reason why I use Linux as my OS of choice...
start > settings > control panel > system > remote tab > remote assistance > click advanced > uncheck 'Allow this computer to be controlled remotedly > click OK > uncheck 'Allow Remote Assistance invitations to be sent from this computer > click apply at the bottom > last, click OK
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.