Microsoft working to close 8-year-old Web proxy vulnerability
By
John Fontana
,
Network World
, 11/26/2007
- Share/Email
- Tweet This
- Print
Microsoft is working on a fix for an eight-year-old flaw in Windows that lets hackers exploit a Web proxy autoconfiguration protocol
and take over groups of machines via a single attack. Microsoft has yet to release the update it has been working on since
last week that addresses the vulnerability in the Web Proxy Autodiscovery Protocol (WPAD) in Windows.
The flaw was first discovered in 1999, and some experts say it has never been adequately patched.
The flaw affects all versions of Windows including Vista, but does not affect computers in the United States. Microsoft reportedly
patched the flaw eight years ago to protect computers that use the “.com” domain as part of their corporate identity. The
fix, however, does not work for computers that use domain country codes, such as .nz (New Zealand) or .uk (United Kingdom).
WPAD is a method used by Web browsers to locate a proxy configuration file called wpad.dat that is used to configure a Web
browser’s proxy settings. Part of the flaw lets the search for the configuration file leave the safety of the corporate network,
thus opening an avenue for a hacker to hijack the request and deliver a configuration file to the browser that could then
be then exploited to intercept and modify the user’s Web traffic.
The Windows WPAD feature was designed so administrators would not have to configure browser proxy settings on each desktop
manually. All the automated WPAD configuration work takes place out of view of the user.
Last week, Beau Butler, who also goes by the name Oddy and the title “ethical hacker,” presented his rediscovery of the WPAD
flaw at the annual Kiwicon security conference at Victoria University of Wellington in New Zealand. Butler told conference
attendees and Australia’s The Age Web site that he found 160,000 computers in New Zealand using the .nz domain that were vulnerable to the WPAD flaw. The Age said Microsoft
asked it not to publish the details over fears they could be used by cybercriminals to seize control of workstations. Microsoft
confirmed it was a serious issue, The Age said.
Some details about the vulnerability, however, are available by doing simple queries on Microsoft’s own Live Search Web site.
Additionally, Microsoft publishes Knowledge Base articles on its Web site describing how WPAD works.
The Kiwicon conference’s session abstracts said Oddy (Butler) would be “explaining all the ways in which networks can be configured
in order to make WPAD leakage a non-problem.” According to the Microsoft Web site “WPAD lets services locate an available
proxy server by querying a DHCP [dynamic host configuration protocol] option or by locating a particular DNS [domain name
system] record.”
Web caching expert Duane Wessels, who helped develop Squid, a high-performance proxy-caching server, has a Web site
that explains the flaw to users. “Basically, it works like this: When the browser starts, it issues a DNS address lookup for
‘wpad.foo.com’ where ‘foo.com’ is the domain name of the computer. Due to some Microsoft bug, some browsers look up ‘wpad.com,’
which is my host,” he wrote on his Web site. Wessels made the post after getting angry letters for network administrators
who saw traffic funneling to his Web site.
Comments (2)
RE: Microsoft working to close Web-proxy vulnerabilityBy cara mitchell on November 26, 2007, 5:05 pmthis is a good idea from microsoft. i think that they can improve on their revenue with this idea.
Reply | Read entire comment
Proxy Fix? HhahahahahahahahaBy meatpieandtatters on November 28, 2007, 7:21 amMS only fixes something when they absolutely have to and only does enough to cover their rear ends. Their usability paradigm is the antithesis of security.
Reply | Read entire comment
View all comments