Hackers Exploiting Windows XP Help Flaw

Microsoft this week revised its security advisory on a Windows help function flaw, noting that the proof-of-concept code to exploit the flaw is now being used by hackers.

The flaw, described last week, just affects Windows XP systems. Microsoft ruled out earlier concerns that Windows Server 2003 might have been vulnerable, according to security advisory 2219475 revised on June 15, 2010.

"Microsoft is aware that proof-of-concept exploit code has been published for the vulnerability," the revised advisory now states. "Microsoft is also aware of limited, targeted active attacks that use this exploit code. Based on the samples analyzed, Windows Server 2003 systems are not currently at risk from these attacks."

The active attacks were also confirmed Tuesday by software security firm Sophos. In a blog post, Sophos identified the malware as "Sus/HcpExpl-A," which is spreading through a compromised Web site. The malware will drop a Trojan (called "Troj/Drop-FS") on a user's computer.

Microsoft has published a Fix it solution that provides an automated workaround for the vulnerability. Otherwise, IT pros would need to unregister the HCP Protocol by editing the Windows Registry to ensure against possible attacks to Windows XP systems. The exploit requires the victim to click on a link in an e-mail or visit a specially crafted malicious Web page.

Microsoft is saying that it will provide any further details at its Microsoft Security Response Center blog or via its Twitter page. Possibly, the company could issue an out-of-band patch or wait to issue a fix with the next security update cycle in July. Microsoft hasn't rated the threat level of the flaw, but Sophos described it as "high."

Meanwhile, the security researcher who first disclosed details about the flaw, Tavis Ormandy, who works for Google, received additional criticism. Graham Cluley, a senior technology consultant at Sophos, chimed in that the five days notice given by Ormandy was insufficient for Microsoft to respond to a zero-day threat.

Ormandy responded to his critics on Twitter by stating that "those five days were spent trying to negotiate a fix within 60 days."

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

  • three silhouetted education technology leaders with thought bubbles containing AI-related icons

    Ed Tech Leaders Rank Generative AI as Top Tech Priority

    In a recent CoSN survey, an overwhelming majority of ed tech leaders (94%) said they see AI as having a positive impact on education. Respondents ranked generative AI as their top tech priority, with 80% reporting their districts have gen AI initiatives underway, or plan to in the current school year.

  • laptop screen displaying a typed essay, on a child

    McGraw Hill Acquires Essaypop Digital Learning Tool

    Education company McGraw Hill has announced the acquisition of Essaypop, a cloud-based writing tool that will enhance the former's portfolio of personalized learning capabilities.

  • illustration of an open book with lines and circles around it

    Foundations in Learning Launches Fluency for All Movement

    Ed tech company Foundations in Learning, creator of the WordFlight literacy assessment and intervention for students in grades 3-8, has kicked off a new movement aimed at improving reading literacy.

  • pattern of icons for math and reading, including a pi symbol, calculator, and open book

    HMH Launches Personalized Path Solution

    Adaptive learning company HMH has introduced HMH Personalized Path, a K-8 ELA and math product that combines intervention curriculum, adaptive practice, and assessment for students of all achievement levels.