New attack allows for hijacking of web traffic

By

Vulnerability could send users to phishing sites.

New attack allows for hijacking of web traffic
Microsoft is warning users and administrators of a new exploit that could allow an attacker to control which sites a user can visit.

The vulnerability lies within the Web Proxy Auto Discover (WPAD) component used to connect a PC to a web proxy server.

Microsoft disclosed the flaw earlier this year and issued a patch. The company has also issued a tutorial for administrators on how to configure DNS servers to prevent attackers from setting up the malicious proxy.

An attacker could exploit the security hole through a specially crafted website or email message that installs a malformed WPAD file on the user's system.

The malicious file then directs the user's PC to connect to a Domain Name System or Windows Internet Names Service server run by the attackers, giving them total control over their internet traffic.

Vince Wong, a group product manager for Symantec, said that the ramifications of a user running through an attacker's proxy would be similar to those of a cross-site-scripting attack.

Users could be redirected to phishing sites or sent to pages that may attempt to exploit other vulnerabilities.

Although there is little danger at the moment, users should install Microsoft's latest patches and keep their security software up to date, he recommended.

"Patching this is highly recommended, and it is almost critical at this point," Wong said.

"Right now it's a low risk, but it's not unimaginable that unsuspecting users could get duped."
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Log In

  |  Forgot your password?