Analysts: Microsoft flaw opened door to scammers
676164
(InfoWorld) - MicrosoftÂ on Tuesday fixed a bug in its Windows Live ID registration that let users deceptively register a false e-mail address. The false e-mail address could then be used as an ID for Microsoft's Live Messenger program, which could trick a user into thinking they are chatting with someone who is not whom they appear to be, such as steveballmer@microsoft.nl. Erik Duindam, a Web developer in Leiderdorp, the Netherlands, reported the problem to Microsoft on Monday. Microsoft acknowledged it had fixed the bug but did not have further information on the flaw's impact. It's unclear how long the flaw may have existed or how many accounts with deceptive instant messenger IDs could have been created. Duindam said a fake ID he created was still active on Tuesday morning. If a user attempts to create a Windows Live ID, Microsoft sends a confirmation e-mail to the e-mail address entered by the user. Without confirmation, Microsoft includes a warning with future messages sent by instant message, which appear as: fake@emailaddress (E-mail Address Not Verified). However, accounts created over the weekend with fake e-mail addresses were still active as of Tuesday and carried no such warning. "It's heaven for scammers," Duindam said via instant message on Tuesday. An attacker could use the flaw as part of a social-engineering ploy, where users are tricked into doing something that puts their machine at risk. For example, victims could receive an instant message from someone who appears to have their boss's e-mail address. At that point, victims could be tricked into thinking they are communicating with their boss. The hacker could then send a link to a malicious Word document, for example, that could install a keystroke logging program on a machine. "In one swoop, you can become the boss, or human resources or accounts," wrote Chris Boyd, senior research manager with FaceTime Communications, via instant message. Boyd said if the original spoofed accounts are still active, Microsoft should try to shut them down as soon as possible. But it could be difficult, especially if Microsoft was not aware of the flaw and can't track the spoofed accounts. Â
267586
Security researchers have warned of a vulnerability in most web browsers that could let scammers launch phishing attacks from pop-up windows on trusted websites.
512728
Security researchers warned today of a vulnerability in most Web browsers that could allow scammers to launch phishing attacks from pop-up windows on trusted Web sites.
395103
The emergence of a new Internet virus targeting a Microsoft Windows security flaw could cause more damage than usual because the company&#39;s system for fixing the problem is so complex that many
387750
Hackers have come up with a way to get around one of Microsoft's antipiracy mechanisms for Vista.
241353
The new flaw is unrelated to the help-file flaws discovered by a Chinese security company last week. Microsoft took the Chinese security group to task for disclosing the vulnerability without giving the company a chance to develop a fix.
57262
A flaw in Microsoft Word 2000, and possibly Word 2002, could be used by hackers to crash PCs or run other code on the compromised machine.
323110
Code that exploits a weakness in the way many Microsoft applications process JPEG images has been published on the internet. Microsoft only discovered the security flaw, which could allow software viewing
315052
The latest Microsoft Windows security flaw could result in more harm than usual because the company's system for fixing it could prove too vexing for some PC users to deal with, security experts warned. -washingtonpost.com
134795
NEW YORK - In a harbinger of security threats to come, hackers have exploited a newly announced flaw in Microsoft Corp. programs and begun circulating malicious code hidden in images that use the popular JPEG format.
224030
An 18-month-old flaw in Microsoft Windows -- patched by Microsoft in 2006 -- continues to allow hackers to infect PCs with advanced rootkits and launch infections from thousands of compromised Web sites.
300814
Security experts warned on Wednesday that &quot;exploit code&quot; has been released for the critical flaw discovered in the way Windows and other Microsoft products handle JPEG images (see our previous coverage).
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
262500
The glitch, which could permit an attacker to secretly search the contents of a personal computer via the Internet, is the kind of flaw that emerges when separate components interact.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
665260
For some security researchers who uncover flaws in leading computer programs, a nod of appreciation from software companies is no longer enough. Now they want money.
65120
Microsoft is investigating a security flaw in the Windows Internet Name Service that could allow an attacker to gain control over systems running the software.