Posted on 01/02/2006 3:54:03 PM PST by Swordmaker
Computer security experts were grappling with the threat of a newweakness in Microsofts Windows operating system that could put hundreds of millions of PCs at risk of infection by spyware or viruses.
The news marks the latest security setback for Microsoft, the worlds biggest software company, whose Windows operating system is a favourite target for hackers.
The potential [security threat] is huge, said Mikko Hyppönen, chief research officer at F-Secure, an antivirus company. Its probably bigger than for any other vulnerability weve seen. Any version of Windows is vulnerable right now.
The flaw, which allows hackers to infect computers using programs maliciously inserted into seemingly innocuous image files, was first discovered last week. But the potential for damaging attacks increased dramatically at the weekend after a group of computer hackers published the source code they used to exploit it. Unlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.
We havent seen anything that bad yet, but multiple individuals and groups are exploiting this vulnerability, Mr Hyppönen said. He said that every Windows system shipped since 1990 contained the flaw.
Microsoft said in a security bulletin on its website that it was aware that the vulnerability was being actively exploited. But by early yesterday, it had not yet released an official patch to correct the flaw. We are working closely with our antivirus partners and aiding law enforcement in its investigation, the company said. In the meantime, Microsoft said it was urging customers to be careful opening e-mail or following web links from untrusted sources.
Meanwhile, some security experts were urging system administrators to take the unusual step of installing an unofficial patch created at the weekend by Ilfak Guilfanov, a Russian computer programmer.
Concerns remain that without an official patch, many corporate information technology systems could remain vulnerable as employees trickle back to work after the holiday weekend.
Weve received many e-mails from people saying that no one in a corporate environment will find using an unofficial patch acceptable, wrote Tom Liston, a researcher at the Internet Storm Center, an antivirus research group. Both ISC and F-Secure have endorsed the unofficial fix.
Microsoft routinely identifies or receives reports of security weaknesses but most such vulnerabilities are limited to a particular version of the Windows operating system or other piece of Microsoft software. In recent weeks, the company has been touting its progress in combating security threats.
The company could not be reached on Monday for comment.
Ever think it might be that we have been ill and been cured? Most of us have been Windows users... I work every day with Windows, curing them of what ails them. It's nice to come home to a computer that doesn't get sick.
Get a clue.
Thank you, already got one... and a Mac.
Yes, I do. They have entire websites dedicated to this.....ever heard of assembly language?.....
bttt
I'm computer stupid, please help me.
I store no private info on my puter, no passwords are stored, I have to input them each time. I always turn off the computer when not using it, what can a hacker do?
.
There are entire websites set up to debunk Mr. Gibson....you can start here: http://grcsucks.com/
What an adorable picture!
I've had the same experience with Mosilla and WMF files. It doesn't open them but prompts for a program to open them with.
No, just more of the same old same old.
I was only pointing out that most software, if someone spends the time looking for a way, can be exploited. It was a response to the implication that MACs are invulnerable to viruses.
There is a dangerous anti-corporate element (anarchists) that want to attack MS and therefore do so.
It is one thing to say MACs are not being targeted and another to say they are invulnerable. I was simply pointing out that the former is true.
I could care less if people use PCs or MACs. I have a PC because it meets my needs. If MACs were capable of supporting the same apps with ease, and costed the same, I would have no problem moving to a MAC.
I know what a WINZIP file is, whats a RAR file?
Swordmaker, I would think it would be extremely difficult to exploit this vunerability for Windows 95 or Windows 98 machines. The primary functions of these vunerabilities is presumably to install spyware, and for spyware to run you have to have a genuine multitasking OS. I think a Windows 98/95 machine with even a modest spyware infection would become unusable and so I don't think this vunerability is going to be serious on those ancient machines.
I must agree that Steve is probably not entirely unhappy about recent developments at his rival.
Just a guess, mind.
Paloma, there are people who would work night and day to produce an exploit for the Mac, just to show that it's doable. Their egos would be enormously gratified by it. The fact that it hasn't yet been done make me think it's an extremely difficult task and that the MacOS is hardened quite a bit better than Windows is.
I think Mac users, including myself, are in pretty good shape as long as we keep our systems updated.
D
RAR is a compressed file like WINZIP (just a different company).
The RAR file icon looks like this:
If you've never seen this icon before, then no worry.
Let's see....you don't use a PC, you're a Mac fan and you like to post threads like this just to harangue PC users....does that about cover it?
What about encrypting your entire hard drive? And are there any downsides to so doing?
As far as being a great problem in reporting what spyware reports, you are probably correct about Windows 95 and 98... but on a useability level, either machine becoming infected could slow it to a stop, thereby prevent its owner from using it. That would be a problem until cleaned.
...Steve...
I think he will be grinning fom ear to ear after looking at Mac sales. 2005 showed sales topping 4.5 million units.
In terms of Mac sales, Apple set a record of 634,000 iBook and PowerBook shipments for the quarter, 139,000 more than last year, but the strongest growth year-on-year came from desktop and server sales. Mac Mini, iMac, eMac, PowerMac and Xserve were up 56 per cent in terms of units and 42 per cent higher measuring revenue. Portable revenue was up 22 per cent on 41 per cent more units shipped.
Thanks for posting this along with the temporary fix. I wouldn't have known about it otherwise.
It's not the machine; it's the better-constructed OS.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.