Posted on 06/09/2010 8:03:48 PM PDT by Gomez
A security researcher has warned of a vulnerability in older versions of the Windows operating system that allows attackers to take full control of a PC by luring its user to a booby-trapped website.
The flaw resides in the Windows Help and Support Center, a feature that provides users with online technical support. Malicious hackers can exploit the weakness of Windows by embedding commands in web addresses that activate the feature's remote assistance tool, which allows administrators to execute commands over the internet. The exploit works in XP and Server 2003 versions of Windows and possibly others.
“Upon successful exploitation, a remote attacker is able to execute arbitrary commands with the privileges of the current user,” researcher Tavis Ormandy wrote in an advisory published Wednesday. The attack works against most major browsers, including Internet Explorer 8 if the Windows Media Player is available.
The advisory said Microsoft's security team was alerted to the vulnerability in the help and support feature on Friday. “I've concluded that there's a significant possibility that attackers have studied this component, and releasing this information rapidly is in the best interest of security,” Ormandy wrote.
“Microsoft is investigating public disclosure of a vulnerability affecting Windows XP and Windows Server 2003,” company spokesman Jerry Bryant said in a statement. “We will release more information as we determine the extent of the issue based on our investigation.”
Microsoft engineers place tight restrictions on the remote assistance tools to prevent them from being misused by attackers. But the advisory said it's possible to bypass those protections by tricking the whitelist verification through the use of invalid hex sequences. By combining that weakness with XSS, or cross-site scripting, holes in the Help and Support Center pages, attackers can take full control of a PC simply by exposing a browser to URLs with special commands in them.
“It's a great analysis,” H D Moore, CSO and chief architect of the Metasploit project, told The Register in an instant message. “The core issue itself (not checking the result of the hex decode) is brilliant in how simple it is, and it looks like it took a lot of investigation to determine that it was actually exploitable.”
The advisory provided a proof-of-concept that works for a variety of XP and Server 2003 configurations, but it went on to warn that techniques for exploiting other versions probably exist. The most useful mitigation is to turn off the remote assistance tool, but the advisory provides several other temporary fixes for those who rely on the feature.
See post 20 for complete step-by-step... 8^)
Thanks for the ping.
Yowza!
Who thought enabling that by default would be a good idea?
Will need to change all computers.
Okay all you people on the almost ten year-old Windows XP, it’s finally time to upgrade. And you don’t have the “but Vista sucks!” excuse anymore.
Does windows 7 have this “feature”?
Well,...generally the attackers are interested in criminal activities,...looking for access to online banking accounts ,....etc.
I found it last night. It was in the properties section of the control panel
I’m out in Hoosierland after a long day of driving. Good weather, dry roads, not too much construction. Back to base camp on Monday.
Turned off... thanks.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.