Help and Support bug 'helps' attackers gain complete control of Windows PCs
A security researcher has warned of a vulnerability in older versions of the Windows operating system that allows attackers to take full control of a PC by luring its user to a booby-trapped website.
The flaw resides in the Windows Help and Support Center, a feature that provides users with online technical support. Malicious hackers can exploit the weakness of Windows by embedding commands in web addresses that activate the feature's remote assistance tool, which allows administrators to execute commands over the internet. The exploit works in XP and Server 2003 versions of Windows and possibly others.
“Upon successful exploitation, a remote attacker is able to execute arbitrary commands with the privileges of the current user,” researcher Tavis Ormandy wrote in an advisory published Wednesday. The attack works against most major browsers, including Internet Explorer 8 if the Windows Media Player is available.
