XP users beware: highly dangerous attack gives hackers immediate control

Symantec today reported a new kind of attack that is exceptionally dangerous using Microsoft Help and Support Center Viewer. With this attack, hackers gain immediate access to the victims computer, rather than having to figure out a way to get the attack code to load (access to a start-up file, a reboot, social engineering).

An attacker tricks a victim into visiting a Web page that loads a binary file of malware via an arbitrary file-overwrite. It also overwrites a help system file, which has the power of executing scripts. The attacker uses this to execute the malicious binary file. Symantec says:

"It's worth noting at this point that in order for this attack to be successful the user must be logged in with Administrator privileges. However, since the standard Windows XP setup on stand-alone systems often has Administrator privileges enabled, and  most users don't follow best practices to set up a limited user for general use, this attack may be possible on a large number of machines."

The Symantec site has posted a video that shows the attack in action.

In seperate news, Microsoft today issued an emergency patch of the highest rating, MS08-067. In the first emergency patch since April, this critical update fixes a remote code execution vulnerability in the Windows Server Service. The hole could allow an attacker to execute what Microsoft calls a "wormable exploit" on Windows Server 2000, Windows XP and Windows 2003, but other Windows systems are vulnerable, too.

Visit the Microsoft Subnet home page for more news, blogs, podcasts.
More blog post from the Microsoft Subnet posts:

Also see:

12 tips for safe social networking
10 questions for Microsoft's Windows Server 2008 guy, Jason Hermitage
17 job-hunting resources for Windows pros
Under the hood of Hyper-V (master list of links).
Subscribe to all Microsoft Subnet bloggers.
Sign up for the bi-weekly Microsoft newsletter. (Click on News/Microsoft News Alert.)

 

• Microsoft
• Security
• Microsoft Security alert
• security vulnerabilities