News

Hackers Exploiting Windows XP Help Flaw

Microsoft today revised its security advisory on a Windows help function flaw, noting that the proof-of-concept code to exploit the flaw is now being used by hackers.

The flaw, described last week, just affects Windows XP systems. Microsoft ruled out earlier concerns that Windows Server 2003 might have been vulnerable, according to security advisory 2219475 revised on June 15, 2010.

"Microsoft is aware that proof-of-concept exploit code has been published for the vulnerability," the revised advisory now states. "Microsoft is also aware of limited, targeted active attacks that use this exploit code. Based on the samples analyzed, Windows Server 2003 systems are not currently at risk from these attacks."

The active attacks were also confirmed on Tuesday by software security firm Sophos. In a blog post, Sophos identified the malware as "Sus/HcpExpl-A," which is spreading through a compromised Web site. The malware will drop a Trojan (called "Troj/Drop-FS") on a user's computer.

Microsoft has published a Fix it solution that provides an automated workaround for the vulnerability. Otherwise, IT pros would need to unregister the HCP Protocol by editing the Windows Registry to ensure against possible attacks to Windows XP systems. The exploit requires the victim to click on a link in an e-mail or visit a specially crafted malicious Web page.

Microsoft is saying that it will provide any further details at its Microsoft Security Response Center blog or via its Twitter page. Possibly, the company could issue an out-of-band patch or wait to issue a fix with the next security update cycle in July. Microsoft hasn't rated the threat level of the flaw, but Sophos described it as "high."

Meanwhile, the security researcher who first disclosed details about the flaw, Tavis Ormandy, who works for Google, received additional criticism. Graham Cluley, a senior technology consultant at Sophos, chimed in that the five days notice given by Ormandy was insufficient for Microsoft to respond to a zero-day threat.

Ormandy responded to his critics on Twitter by stating that "those five days were spent trying to negotiate a fix within 60 days."

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

  • MIT Finds Only 1 in 20 AI Investments Translate into ROI

    Despite pouring billions into generative AI technologies, 95 percent of businesses have yet to see any measurable return on investment.

  • Report: Cost, Sustainability Drive DaaS Adoption Beyond Remote Work

    Gartner's 2025 Magic Quadrant for Desktop as a Service reveals that while secure remote access remains a key driver of DaaS adoption, a growing number of deployments now focus on broader efficiency goals.

  • Windows 365 Reserve, Microsoft's Cloud PC Rental Service, Hits Preview

    Microsoft has launched a limited public preview of its new "Windows 365 Reserve" service, which lets organizations rent cloud PC instances in the event their Windows devices are stolen, lost or damaged.

  • Hands-On AI Skills Now Outshine Certs in Salary Stakes

    For AI-related roles, employers are prioritizing verifiable, hands-on abilities over framed certificates -- and they're paying a premium for it.