Microsoft: Woes Continues on Security System

Was just passing through the sites i found this news regarding Microsoft's plan to fight against vulnerabilities. Experts have been involved in discussions over Microsoft's (MS) new system Window's Vista which have motto of "Wow" but it seems, we really need to say WOW. Wondered why, MS delayed it's product by almost 3 years stating it needs to work on security to make it most protected system ever, but ops! it seems there have been many loopholes. Worked so hard and still problems? Who don't say "Wow! Still problem? Great Job Hacker." Reports have been that many crackers have already cracked it's strong holds. On February 1, 2007 MicroSoft admitted it had loopholes.It admitted that speech recognition features in Vista could be hijacked so that a PC tells itself to delete files or folders. Vista can respond to vocal commands and concern has been raised about malicious audio on websites or sent via e-mail. In one scenario outlined by users an MP3 file of voice instructions was used to tell the PC to delete documents. Microsoft said the exploit was "technically possible" but there was no need to worry.

To add more pain, now there have been other problems for Windows XP/2000 users also. See the news below taken from BBC.

Windows users are being urged to install Microsoft's February security update which contains 12 patches for 20 vulnerabilities. The bumper package includes fixes for loopholes that malicious hackers are known to be already exploiting.

Another vulnerability is in the program Microsoft designed to spot viruses and spyware that has infected PCs. Half of the patches in the update have been rated as critical; criminals exploiting these could take over a PC.

Hijack trick

The fixes were issued as part of Microsoft's regular monthly security update that falls on the second Tuesday of every month. Loopholes in Word, Excel, PowerPoint, Internet Explorer and Microsoft's Malware Protection Engine are closed by the updates in the patch. Versions of these programs used on Windows 2000 and XP could have these loopholes.

Users worried that they are at risk are being encouraged to check information about which programs are vulnerable via Microsoft's security site. Some of the loopholes, particularly those in Word, have been actively exploited by malicious hackers for several weeks.

Many Windows XP owners are likely to get the patches automatically, but any user can download the patches from the Windows Update site. The "critical" rating usually means that a cyber criminal exploiting such a vulnerability could take over a PC via a booby-trapped webpage or by tricking a user into opening an attachment on an e-mail. None of the patches affected Vista - the newest version of the Windows operating system which was released on 30 January.

Source: BBC NEWS