Microsoft's Latest Patch: More Than Three Months In The Making, Exploits Unleashed FirstMicrosoft's Latest Patch: More Than Three Months In The Making, Exploits Unleashed First

Microsoft lost its latest race against the bad guys. It was alerted to the .ANI vulnerability in December and began working on a patch immediately. Even so, the fix wasn't ready before exploits started to hit two weeks ago. Once that happened, Microsoft assigned nearly 100 technicians to work round the clock on the patch, which it released April 3.

The vulnerability was in a core area of Windows, complicating patch development, says Mark Miller, director of the Microsoft Security Response Center. "The time line is longer because you have to deal with this core area," he says.

The .ANI vulnerability affects how Windows handles malformed animated cursor files and could let a hacker remotely take control of an infected system. All recent releases of the Windows operating system, including Vista, are at risk, and Internet Explorer is the main attack vehicle, though Firefox users are at risk, too. Users get infected when they visit a Web page that has embedded malware designed to take advantage of the vulnerability or by opening an infected e-mail or attachment.

Researchers expect the attacks to worsen despite the release of the patch. As of last week, more than 700 Web sites were spreading the .ANI exploit, says Dan Hubbard, senior director of research at Websense, a security software company. Exploits are appearing in spam, and automated rootkits are popping up online that let unsophisticated hackers build malware.

Early last week, just before the patch was released, .ANI exploits were the most detected piece of code coming out of Asia, says Craig Schmugar, a McAfee threat researcher. It will become the most utilized exploit around the world in a week or two, he says.

"Getting the patch out early definitely was the right call to make," Schmugar says, but "now that toolkits are posted publicly, more and more hackers will find them and this will just get worse." Not a good prognosis for IT shops trying to stay on top of the malware.