ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Microsoft: 25,000 PCs attacked with latest Windows zero day

By | July 14, 2010, 9:34am PDT

Summary: According to Microsoft’s Holly Stewart, the attacks escalated significantly when the company announced the issue would be fixed in this month’s Patch Tuesday.

The Windows Help and Support Center vulnerability that was patched with yesterday’s MS10-042 bulletin was under active attack by malware miscreants, especially in Europe where Microsoft tracked about 25,000 attempts to exploit the vulnerability.

According to Microsoft’s Holly Stewart, the attacks escalated significantly when the company announced the issue would be fixed in this month’s Patch Tuesday. follow Ryan Naraine on twitter

In a blog post to the Microsoft Malware Protection Center (MMPC) blog, Stewart said the attacks started a few weeks ago and have continued to expand and some new attack patterns have come into play.

MS Patch Tuesday: Googler zero-day fixed in 33 days ]

The attacks that we have witnessed in the wild work only on Windows XP (not Windows 2003).  Early on, we saw attackers incorporate code to single out Windows XP targets, but more recently the attackers have been less discriminant, attempting this attack on a variety of operating systems, about half of which were not susceptible because the exploit code could have only been successful on a vulnerable version of Windows XP.

As of midnight on July 12 (GMT), over 25,000 distinct computers in over 100 countries/regions have reported this attack attempt at least one time, Stewart said.  There was a “fairly large increase” over this past weekend, shortly after Microsoft announced that an update would be provided to fix this issue with the July security bulletin release.

[ SEE: Googler Drops Windows Zero-Day, Microsoft Unhappy ]

Where were the attacks spotted?

Although Portugal has remained one of the most targeted areas, attacks on Russian systems have surpassed it over the past few weeks.  Russia has now seen more than ten times the number of attack attempts per computer in comparison to the global average.  Other countries/regions that have seen more than the global average are predominantly in Europe and the UK.  The UK, in particular, was one of the regions in which we witnessed a surge in attack attempts over this past weekend.

Stewart said Microsoft tracked attack attempts in over 100 countries/regions.

ALSO READ:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

118
Comments

Join the conversation!

Just In

RE: Microsoft: 25,000 PCs attacked with latest Windows zero day
yarinsiz Updated - 16th Apr 2011
Great! !! thanks for sharing this information to us!
sesli sohbet sesli chat
0 Votes
+ -
Your title is irresponsible
NonZealot Updated - 14th Jul 2010
It should be changed to 25,000 XP PCs attacked. Those running any other OS are 100% immune to this attack.

The other interesting thing is that these are attempts, not successes. Do we have any information on how many attacks were actually successful? As it stands, we've just found out that water is wet and that personal computers that are hooked up to the Internet get attacked every day.
@NonZealot

This particular one, yes, but keep in mind: "but more recently the attackers have been less discriminant, attempting this attack on a variety of operating systems"
@CobraA1 But again: ATTEMPT.
0 Votes
+ -
whaaaa.....whaaaaa....whaaaa.....
ahh so 15th Jul 2010
It should be changed to 25,000 XP PCs attacked. Those running any other OS are 100% immune to this attack.

And you have the hypocritical nerve to go around and complain about irresponsibility"?

whaaaa.....whaaaaa....whaaaa.....
0 Votes
+ -
@ahh so

Point lost.. was there one? It does point out the fact that many deny, that Windows 7 does implement better security measures and is better than previous OS' over and above just aesthetic changes.
0 Votes
+ -
@NonZealot

What? You speak the truth to power? LOL - without overhyped hyperbole (over the top joke inteded)?
0 Votes
+ -
And we have Ormandy to thank for these 25,000 PC attacks. I hope Microsoft holds him responsible for this and he has to pay his dues. Luckily for the rest of the world the migration to Microsoft Windows 7 is making this less relevant. Also we must thank Microsoft for having auto-update turned on by default so everyone now has the patch. This havoc was created by Ormandy and needs to end by him, either through litigation or termination but some action must be taken so he doesn't pull this stunt again.
no u have microsoft to thank for this problem. Keep blaming others son. FYI new ATM machines run windows XP. GOOD LUCK WITH THAT son....
0 Votes
+ -
@bspurloc
Wrong. Microsoft didn't create this exploit, they didn't release code for it. Ormandy is the man you want to go after.
  • Flagged
@bspurloc So... you're basically saying the criminal that started this attacks is not to blame? If I get carjacked it's my fault because I have a car? Nice to know where you stand.
0 Votes
+ -
@Lovecock Davidson

Ormandy publicly disclosed what hackers already knew and were already using you idiot... It's not the publicly known vulnerabilities that are the threat. It's the ones that everyone keeps quiet about that are the real threat... It was Microsoft's annoucement that cause the spike in the number of attacks, but it was Microsoft's vulnerability to begin with... It's Microsoft's fault for the 25K PC attacks... Sheesh Lovecock, Grow a friggin brain... You are clueless.
0 Votes
+ -
It is NOT Microsoft's fault ...
mwagner@... 14th Jul 2010
@i8thecat ... that three years after MS announced the upcoming retirement of XP, and two years after Service Pack 3 shipped, their are still MILLIONS of people still running Windows XP SP 2. The fact that only 25,000 machines (mostly in Europe) were hit is remarkable.
  • Flagged
0 Votes
+ -
Microsoft's OS, Microsoft's vulnerability. Just who's fault did you think it was??? XP SP3 still has this vulnerability... Go do some research dude...

XP won't be retired until 2020... People still run it because they don't like Vista and Windows 7. Many will be switching to OSX Ubuntu... XP has been around for a decade and will be around for another decade. Mainly due to moronic defunct IT departments who are too afraid to learn. Where are you getting that there are millions running SP2??? And really... what does it matter??? Microsoft's OS, Microsoft's vulnerability... Microsoft's fault.
0 Votes
+ -
Quick question
NonZealot 14th Jul 2010
It's Microsoft's fault for the 25K PC attacks.

How many of those attacks succeeded? I couldn't care less how many times my PC gets attacked. It could be attacked 9,999,999,999,999,999,999 times a second as long as none of those attacks got through. So far, Windows has kept me 100% safe. That's all that counts to anyone that doesn't have an anti-MS agenda!
  • Flagged
0 Votes
+ -
@i8thecat
How cute, you had to resort to name calling because you didn't have a valid point. Go you! That must make you proud. But none of this would have happened if Ormandy had worked with Microsoft instead of being stubborn about it. Then he had a hissy fit and released the code which is when the exploits came out. So you need to start looking at Ormandy for answers, and if he doesn't fess up we can bring some type of disciplinary action against him.
  • Flagged
0 Votes
+ -
Google's fault too
Cylon Centurion 14th Jul 2010
@i8thecat

Better communication was needed between both parties. Carelessly throwing out vulnerabilities does no one any good. Google wouldn't be too happy if Microsoft was throwing around Chrome/Docs/Whatever vulnerabilities.
@Lovecock Davidson
i8thecat is right.
http://seclists.org/fulldisclosure/2010/Jun/205

Do your research. Ormandy presented his findings to MS before going public. But sometime going public gets it fixed faster. Don't kill the messenger. He should be rewarded, not locked up. You lock up people like this, then people will shut up, and the hackers will do as they please as the vulnerabilities will not be fixed.
  • Flagged
@i8thecat : "Ormandy publicly disclosed what hackers already knew and were already using" - how do you know that ?
@i8thecat So, if I get robbed in any way, it is my fault because I have something the thieve wants? Microsoft is doing what it's supposed to do: release a fix for the problem. There's no excuse to launch an attack like that and specially not the "because it's there" reason. Those guys are terrorists.
@Loverock Davidson
IHMO this sort of special pleading is unworthy. This issue was known and open long before O reported it to MS; and the acceleration in attacks was largely due to MS announcing when the patch would come out. Patch Tuesday is a poor idea anyway, as it leaves vulnerabilities open longer than need be; using fixed patch dates also informs malware writers of their "best" windows of opportunities. Did I say that MS was responsible in the first instance by not designing the OS with a small kernel and with segmentation and permissions in the first instance? (methods already recommended at least in the 1960s)
0 Votes
+ -
That's a hilarious pun,...
ryanstrassburg 15th Jul 2010
@shtromer
"best windows of opportunities"...
0 Votes
+ -
news flash, windows has exploits....
bspurloc 14th Jul 2010
OMG... windows operating system is full of holes, there should be an article about ONE of the thousand and cause an uproar. for real? pc get hacked because of this dumbness of the obvious.
@bspurloc
Wrooong! That is attempted hack. Keep it truthful guys.
0 Votes
+ -
This is a Windows XP vulnerbaility, right?
mwagner@... 14th Jul 2010
Following right on the tail of yet another extension of Windows XP support, this time to 2015!

Get with the program folks! Windows XP is outdated, it is slow, and most importantly, it is VULNERABLE!

Whether your too lazy or too cheap to get off Windows XP, every day you wait, is another day you could lose valuable data.
yeah cuz vista windows 7 and 2003 don't have ANY exploits.
for every tool in the world there is a nut. don't be both.
@bspurloc
Please enlighten all of us on these exploits of Windows Vista, 7 and 2003... We are awaiting.
0 Votes
+ -
@ryanstrassburg
ahh so 15th Jul 2010
Where would you like to begin?

http://www.crunchgear.com/2009/11/16/windows-7-exploit-the-first-confirmed-by-microsoft/

How about from the beginning? Hmm?
So XP will be around and without patching for 6 years before it is retired.
0 Votes
+ -
@i8thecat It always will be that way. Microsoft will continue to push new OS's out the door whenever they need money. (See for examples Windows 98, in 1999 windows 2000, than Windows ME (they are two different animals... Because 2k was horrible and buggy.), a few years later XP, and now... Vista... A year later Windows 7 (which they claimed at first was only an upgrade of Vista but consider that Vista was as horribly buggy as Win 2k...). When users switch to a solid Linux platform and stay there... Convincing their company bosses, and others to join the Linux movement than maybe Windows will become more stable and affordable, but for now... If there's $$ to be made than they'll keep pushing new crap out the door with little to no testing.
  • Flagged
@Dry_Land_Is_Not_A_Myth
Microsoft will continue to push new OS's out the door whenever they need money.

How does that make sense when you then tout using Linux? I use Fedora 12, and Linux Mint Helena. To my knowledge, Linux, especially the Ubuntu distro, updates several times a year (Ubuntu does it twice). Actually, the Kernel has not had a huge update in quite some times, but that's a separate issue. So what are you talking about? I'm not sure I get your argument for Linux stability.
0 Votes
+ -
The XP 2020 myth has been debunked.
Lester Young 14th Jul 2010
@i8thecat But that won't stop you from reciting it, will it? Reciting debunked myths about Windows is your hobby.
Well @Lester Young, since Steve Jobs is responsible for every natural disaster known to mankind, why don't you tell us about it....
0 Votes
+ -
@mwagner@...

It's funny reading you touting MS as one of the best platforms. You should work for Microsoft the way you promote them. Sadly, yes people are still using XP. And will continue to use it until all companies stop making XP compatible programs.

I agree people should upgrade from XP. Although, not to another buggy MS OS, but to a regularly updated, stable, and (nearly) bug free Linux OS. Linux OS (Ubuntu especially.) Is free! Can be downloaded, and you don't even need to install it. You can run it straight from a disk. (Helped so much when a windows machine went down but I needed access. Since I have to work on Windows machines everyday fixing problems.) You can also set up a dual boot. So you can choose Windows or Linux. But why anyone would want to make a choice is beyond me. The choice is obvious... Linux is more secure and cost effective.

Sadly, much of the world thinks like you. Microsoft throws big words around and screams "experience" constantly, and they believe it. Why? It's the standard OS for new computers. People don't know about all the choices out there. happy

It's time for a change. grin
0 Votes
+ -
@Dry_Land_Is_Not_A_Myth
Why does this seem to annoy you so much?

I'll say one thing for Linux, it is a million times better than OS X. happy
  • Flagged
0 Votes
+ -
"bug free Linux OS".. HA HA!
Lester Young 14th Jul 2010
@Dry_Land_Is_Not_A_Myth That sure wasn't my Ubuntu experience.
@Dry_Land_Is_Not_A_Myth,
We'll see if that ever happens. How many Win7 machines were affected? What is buggy about Win7?
@mwagner@...

You don't know what you are talking about. The only thing Windows 7 has is a crappy new UI. It'll prove to be as vulnerable as any other MS OS just wait and see.

Hope you enjoyed paying for your new UI and that spiffy snap "feature."
0 Votes
+ -
Well I'm waiting...
Cylon Centurion 14th Jul 2010
@Rodo1

And waiting, and waiting...













Still waiting...


Wanna try again with "just a new UI" crap while I wait too? 7 is more than that.
0 Votes
+ -
Hey Nicholas...
ahh so 15th Jul 2010
Quit falling asleep on the spacebar. Don't you know you can damage your windoze that way?

silly
@mwagner@...
I agree with you. However, I'm not so sure they will leave now. A twelve year-old OS that no one is paying attention to, repels 25,000 attacks. Phenomenal!
0 Votes
+ -
APPLE is to blame
thofts 14th Jul 2010
Yes, Apple and Steve Jobs are behind all this. They exploited this XP vulnerability to deflect blogger-wanna-be-journalist attention from the iPhone 4 little issue.
@thofts
Very droll. Of course the original "villain" was IBM. Their contracts people apparently found Motorola's legal people too picky, so they went with smaller companies (Intel and MS) with their respectively inferior architecture and (course drop-out's) minimal OS as they thought they could control them without detailed formal agreements (chutzpah vs hubris?). Once established, MS had the commercial savvy to make hay, and Intel to use consequent revenue and proprietary technology match to maintain an almost unassailable technology lead (at least as regards systems running MS). BTW, I do have some sympathy with MS's present architects - they are rather stuck with legacy...
0 Votes
+ -
Let's play the blame game...
Dry_Land_Is_Not_A_Myth 14th Jul 2010
Why can't MS just take responsibility for having inferior OS's? You can see the trend, though. Anyone who uses MS products seems to think they are above blame and reproach. Every one of you think you are right, and you're also the ones who come to a page and post the lame saying "First".

Your excuses are:

Everyone should have upgraded to Windows 7 by now. (Sorry, not everyone wants to spend a whole paycheck on a poorly planned and created OS. I'll go with Linux before MS products. Free and much more secure!)

Apple, Google, and the government are all to blame. Microsoft can't be expected to test their own products! (How silly of us to assume a company would keep their OS's secure...)

MS always pushes blame to other sources. They can't step up and take responsibility. If any of their crap OS's were worth snot they wouldn't need constant patching.

Keep giving Micro$oft your money, Sheeple!
@Dry_Land_Is_Not_A_Myth Funny though that MSFT has already sold 150 million Windows 7 licenses!
@MSFTWorshipper
Are you trying to suggest that "you can fool most of the people most of the time"?
Don't forget all those unsold licenses. They must be worth 150 million.
0 Votes
+ -
What a bunch of bull
Cylon Centurion Updated - 14th Jul 2010
@Dry_Land_Is_Not_A_Myth

Sorry, not everyone wants to spend a whole paycheck on a poorly planned and created OS

Windows 7!? Marketshare uptake and consumer views should speak for the amount of crap thrown around here.

Microsoft can't be expected to test their own products! (How silly of us to assume a company would keep their OS's secure...)

They do extensive testing. I can assume you don't work in software development. I can also assume you haven't touch Windows very often since XP, while nothing can prevent user stupidity ( You have one FREE ringtone! Click here to download! -), Windows' security has increased ten-fold since XP, I ran Vista for 5 whole months without any sort of AV or AM software installed. Guess what? Nothing. NADA. I run MSE now, but even after installing it, it found nothing on my system, and has had nothing on it to this day. Same with my Win7 installation. And if you click on the link I gave, you will see what has been put in place to better protect the system and the user.
They have also made considerable leaps in protecting the business setting as well. I implore you to take a look at that. But the key thing here is that XP was designed in a day where at home, dial-up networking was king. Downloading anything over 1MB took forever, and malware wasn't as complex. Today, that has changed, and one can blame Microsoft for not seeing the advent of high speed networking.
Yes, XP runs fast (Considering you're not using new hardware - XP can't take advantage of it), and may run your programs, but the truth is, the sooner we can get rid of it, instances of malware will drop, and I am willing to put money on that statement.

So don't sit there and tell us that they can't "step-up" and take responsibility, because they already have - 3 years, 8 months, and 6 days ago.
@NStalnecker
Amen brother...
0 Votes
+ -
Nice speech, Nicholas
ahh so 15th Jul 2010
But I don't think we're gonna run out and buy windoze7 anytime soon.

XP's gonna be around for a long time to come. Might as well stop moping about it.
0 Votes
+ -
A whole paycheck
Michael Alan Goff 14th Jul 2010
@Dry_Land_Is_Not_A_Myth

I feel bad for the people who only make 90$ a paycheck. I really do.
0 Votes
+ -
Great! !! thanks for sharing this information to us!
sesli sohbet sesli chat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix