Security Experts Warn of New Way to Attack Windows

Security experts have found a new way to exploit a critical vulnerability in Windows that evades a workaround and enables the attacker to compromise a number of machines at one time. The new attack could also lead to the creation of another fast-spreading Windows worm, the experts warned.

The workaround in question is for the buffer overrun flaw in the Windows Workstation Service, which is enabled by default in Windows 2000 and XP. An attacker who successfully exploits the weakness could run any code of choice on the vulnerable machine.

Microsoft Corp. issued a patch for the vulnerability in November, but the security bulletin also listed several workarounds for the flaw, including disabling the Workstation Service and using a firewall to block specific UDP and TCP ports. But penetration testers at Core Security Technologies, a Boston-based security company, discovered a new attack vector that uses a different UDP port. This attack still allows the malicious packets to reach the vulnerable Workstation Service.

The attack takes advantage of several characteristics of the UDP protocol. Unlike TCP, UDP is “connectionless,” meaning that there is no TCP-style handshake, and you need not establish a connection with a remote machine in order to send a UDP packet. Also, because the Internets DNS service uses the protocol, UDP packets usually have no trouble traversing firewalls.

These factors combine to make it possible for an attacker to send a broadcast UDP packet containing the malicious code to multiple machines on a given network. The traffic can be disguised to look like DNS packets, further obscuring the attack.

“If someone hasnt applied the patch but blocked the ports as they should have, theyre still vulnerable,” said Max Caceres, a product manager at Core Impact.

The patch for the Workstation Service vulnerability does protect against this latest attack, Caceres said. Core Security notified Microsoft of its findings earlier this week.