Microsoft Letting the World in for a Bit

• Content
• Smart Buildings & Technology
• Microsoft Letting the World in for a Bit

12 May 2017 | Updated 01 January 1970

We've been on to Microsoft to ask about security flaws as it emerged in-house hackers proved bad arse hackers could have taken over any (Microsoft) computer in the world with a single email.

Microsoft employs and rewards hackers who find flaws in the organisations systems (deployed in the majority of computers worldwide). Two hackers found a flaw that could allow genuine bad guy hackers to submit a simple email that did not need to be opened in order to takeover any computer of their choice.

The in-house hackers were amazed at even their paymaster's speed of response - the loophole being fixed an notified within minutes.

"Customers were protected by an update released on Monday, May 8 and more information is available in our security advisory," - a Microsoft spokesperson told ThisWeekinFM. "We are releasing this security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft.

"The update addresses a vulnerability that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file (that dodgy email mentioned above). An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system.

"The Microsoft Malware Protection Engine ships with several Microsoft antimalware products. Administrators of enterprise installations should follow their established internal processes to ensure that the definition and engine updates are approved in their update management software and that clients consume the updates accordingly.

"Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration."

Version 1.1.13704.0

If your version of the Microsoft Malware Protection Engine is equal to or greater than this version, then you are not affected by this vulnerability and do not need to take any further action.

Picture: Microsoft have responded to a security flaw

Article written by Brian Shillibeer | Published 12 May 2017

Share

Related Articles