Categories: PCSecurityWorkspace

Hackers Now Targeting Windows Zero-Day Exposed By Google

In a development sure to do nothing to improve the frosty relations between Google and Microsoft, comes the news that hackers are now actively attacking a zero-day vulnerability affecting Windows XP, five days after it was publicly disclosed by a Google engineer.

According to Sophos Senior Technology Consultant Graham Cluley, a legitimate website pushing open-source software was seen serving the exploit to PC users. Cluley declined to name the site, but Microsoft confirmed that it was aware the bug was being exploited and said the exploits had been “taken down.”

Updated Advisory

An analysis of the exploits found that Windows Server 2003 systems are not being targeted, according to an updated advisory. However, the vulnerability lies within the Windows Help and Support Centre function delivered in both XP and Windows Server 2003, meaning that Windows Server 2003 systems could eventually be targeted.

A successful exploit could allow an attacker to remotely execute code if the user views a specially crafted or compromised web page like the ones found by Sophos.

“The malware that is downloaded is a very large Delphi-based Trojan, which includes an entire portable version of Firefox,” Cluley said. “It appears that they are trying to distribute this ‘customised’ version of Firefox to make money through clickable banner ads.”

Responsible Disclosure

The vulnerability was uncovered by Google engineer Tavis Ormandy, who published exploit code on the Full Disclosure mailing list five days after notifying Microsoft of his findings.

Some have criticised Ormandy’s actions, saying he did not give Microsoft enough time to patch before going public with details of the attack. Ormandy defended himself in his Full Disclosure post on the grounds that had he gone public without a working exploit he “would have been ignored.”

Microsoft did not offer a definitive timeline for a patch, but told eWEEK a security update for the issue is forthcoming.

In the meantime, the company has included information on a workaround in its advisory. Customers concerned about the exploit can disable the HCP protocol, which “will break all local, legitimate help links that use hcp://.”

A tool that can be used to disable the HCP protocol can be downloaded here.

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

View Comments

  • For sure the attackers had the power over the Internet. But the BBC has just announced a new solution, disclosed during an international conference in Asia.
    A company created new weapons that can attack the attackers.
    The future of Internet is not so far, and maybe those genious guyz found the solution for cyber peace.
    Source BBC:
    http://news.bbc.co.uk/2/hi/technology/10349001.stm

Recent Posts

Craig Wright Sentenced For Contempt Of Court

Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…

2 days ago

El Salvador To Sell Or Discontinue Bitcoin Wallet, After IMF Deal

Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…

2 days ago

UK’s ICO Labels Google ‘Irresponsible’ For Tracking Change

Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…

2 days ago

EU Publishes iOS Interoperability Plans

European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…

3 days ago

Momeni Convicted In Bob Lee Murder

San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…

3 days ago