Will Moderate For Cigars
Date registered: Apr 2005
Vehicle: 2002 ML320, 2005 S430 4MATIC, 2010 F150 Crew Cab
Location: City on the TN River
Mentioned: 3 Post(s)
Quoted: 204 Post(s)
Curse that Window's Cursor!
Yep. That all reliable and stable Windows is in trouble again. I . . . can . . . see . . . you . . . through . . . the . . . cursor . . . hole!
Cursor hole puts Windows PCs at risk
Posted 1h 35m ago
Joris Evers for News.com
A new security vulnerability puts Windows users at risk of serious cyberattacks, Microsoft warned late Wednesday.
The vulnerability affects all recent Windows versions, including Vista, which Microsoft has promoted heavily for its security. The operating system software is flawed in the way it handles animated cursors, Microsoft said in a security advisory.
An attacker could exploit the vulnerability through a Web page or e-mail message with rigged computer code, Microsoft said.
"Upon viewing a Web page, previewing or reading a specially crafted message, or opening a specially crafted e-mail attachment, the attacker could cause the affected system to execute code," Microsoft said in its advisory.
Such holes are often exploited by cybercrooks to do "drive-by" installations of malicious software. Spyware and remote control tools that turn PCs into drones for the attacker are silently loaded onto vulnerable computers by tricking people to visit a rigged website or hacking a trusted site. The website for the Super Bowl stadium is a recent example of a drive-by attack.
FIND MORE STORIES IN: Microsoft | Windows | PCS | Spyware
Sample code that demonstrates the vulnerability has already been posted on the Web, McAfee said in a security alert sent to customers. "Malware exploiting this vulnerability has been observed in the wild," the security company said in the alert.
Other security experts also raised an alarm. "I expect attackers will pick up on this as soon as they figure out how to, we'll very shortly see the usual suspects using it," said Roger Thompson, chief technology officer at security software maker Exploit Prevention Labs. "The sample site is already offline; this could be a prelude to a bigger attack."
Animated cursors allow a mouse pointer to appear animated. The animated-cursors feature is designated by the .ani suffix, but a successful attack is not constrained by this file type, Microsoft said. As a result, simply blocking such files won't protect a PC.
The exposure to attacks that exploit the flaw is mitigated on Vista machines with Internet Explorer 7, Microsoft noted. IE 7 protected mode shields the computer against drive-by installations because the browser is restricted to where it can write files.
2005 S430 4Matic 'Morton' W220.183 • 722.671 Rest in Peace
Bells and whistles are thorns and thistles.