Microsoft Warns Windows, SCADA Systems Vulnerable to Hackers
Microsoft Corp. has warned customers about unusually serious security problems with its Windows software. Hackers may be able to secretly break into computers to steal files, delete data, or eavesdrop on sensitive information. And some computer systems controlling critically important water or power utilities are vulnerable.
According to a report by Ted Bridis, technology writer for The Associated Press, Microsoft learned about the flaws more than six months ago from researchers. The company said Tuesday that the only solution was to apply a repairing patch offered on its website. It assessed the threat to computer users as "critical," its highest rating.
A Microsoft security executive, Stephen Toulouse, said the flawed software was "an extremely deep and pervasive technology in Windows," and urged customers to apply the patch immediately.
The Department of Homeland Security also warned Americans about the software problems with e-mails sent across its new national cyber-alert system.
The disclosure comes just weeks before Microsoft Chairman Bill Gates is set to deliver a keynote speech in San Francisco at one of the industry's largest security trade conferences.
Microsoft has struggled in recent months against a tide of renewed criticism about security risks in its software, the engine for computers in most of the world's governments, corporations and homes.
Marc Maiffret of eEye Digital Security Inc. in Aliso Viejo, Calif., discussed the problem with The Associated Press. "The breadth of systems affected is probably the largest ever. This is something that will let you get into Internet servers, internal networks, pretty much any system," he said.
Maiffret predicts hackers will try to unleash a damaging Internet infection within weeks. Unlike earlier vulnerabilities that spawned such attacks, hackers can exploit the newly disclosed flaws to break into susceptible computers using dozens of methods, making any defense far more difficult.
"The race will be on," agreed Marcus Sachs, a former White House adviser on cybersecurity.
Researchers at eEye discovered the problems last July and agreed to keep quiet about them until Microsoft could fix them. Maiffret complained that the delay between eEye's discovery and Tuesday's public disclosure by Microsoft was "just totally unacceptable" because Windows users were broadly vulnerable during the period.
Toulouse said Microsoft took months because it wanted to ensure that a single repairing patch solved any related problems. "We really took the steps to make sure our investigation was as broad and deep as possible," he said.
Maiffret and Microsoft said they were unaware anyone had yet attacked Windows computers using the technique, although eEye had successfully tested the method to break into its own computers.
Microsoft's disclosure occurred just days before a presidential advisory council submits recommendations to the White House about ways technology companies should respond to major software vulnerabilities that could affect national security.
The 54-page report, obtained by The Associated Press, cautions that "long delays in remediation can result in prolonged risk to end users."
The problems affected a technology in the newest versions of Windows known as "abstract syntax notation," a way to share data across different computers. Some of Microsoft's built-in security features such as its Kerberos cryptography system rely on the flawed software.
Microsoft urged consumers to apply the repairing patch immediately if they are using Windows NT, Windows 2000, or Windows XP versions of its software, or its Windows NT Server, Server 2000 and Server 2003 software commonly found in corporations.