A vulnerability has been discovered that affects all versions of Microsoft\u2019s Windows operating system, including the long-unsupported Windows XP, going all the way back to Windows 95. The vulnerability, called BadTunnel, allows attackers to directly bypass system defenses and initiate a man-in-the-middle attack. The vulnerability isn\u2019t limited to just Windows, either; it also affects Internet Explorer, Edge, and other Microsoft software.<\/p>\n
<\/p>\n
This vulnerability is largely being called \u201cprobably the widest impact in the history of Windows,\u201d making it quite a big deal indeed. Yang Yu, a security researcher at Tencent\u2019s Xuanwu Lab, is the one responsible for finding the bug, and his actions in doing so were rewarded handsomely; he\u2019s one of the few who have managed to earn more than $100,000 through Microsoft\u2019s \u201cbug bounty\u201d program, and the discovery of BadTunnel netted him a modest $50,000.<\/p>\n
Forbes<\/em> reports: \u201cThis vulnerability can be exploited through Edge, Internet Explorer, Microsoft Office and many other third-party software on Windows. It can also be exploited through web servers \u2026 or even through thumb drives \u2013 insert the thumb drive into one of the ports on the system and the exploitation is complete.\u201d<\/p>\n Perhaps the most disconcerting thing about this vulnerability is that it\u2019s left Windows PCs vulnerable to attacks for the past 20 years. A successful exploit of the flaw can spoof connections over NetBIOS that allows computers to communicate with one another over a local area network. Essentially, the hacker could route traffic on a user\u2019s Windows PC to their own. Forbes<\/em> explains further: \u201cNot only could the hacker spy on non-encrypted traffic, they could intercept and tamper with Windows Update downloads. And they could inject further attacks in web pages visited by the victim. For instance, they could ensure that the \u201ctunnel\u201d between the target and the hacker would remain open by inserting code into web pages cached by the browser.\u201d<\/p>\n But, fear not – a patch for BadTunnel was issued in Microsoft\u2019s June 14th Patch Tuesday. However, not all businesses automatically deploy patches and updates, so communicate with your IT department to ensure that your business is protected from BadTunnel. If you ignore this vulnerability, there\u2019s a chance that your Windows PCs could be monitored and controlled remotely by malicious entities. You can view the official Microsoft security bulletin here.<\/p>\n Yu believes this vulnerability to be the first of its kind, and it\u2019s understood that Windows users should update as soon as possible. Yet, some users, like those who have Windows XP (still), will be out of luck. In these circumstances, researchers have recommended disabling NetBIOS over TCP\/IP. However, it might just be easier, and more secure, to just upgrade to a supported operating system. Whatever you decide to do, COMPANYNAME has your back.<\/p>\n Yu plans to discuss the finer details of BadTunnel later this month at the 2016 BlackHat Conference in Las Vegas, July 30th through August 4th.<\/p>\n For more technology news and security tips, reach out to COMPANYNAME at PHONENUMBER.<\/p>\n","protected":false},"excerpt":{"rendered":" A vulnerability has been discovered that affects all versions of Microsoft\u2019s Windows operating system, including the long-unsupported Windows XP, going all the way back to Windows 95. The vulnerability, called BadTunnel, allows attackers to directly bypass system defenses and initiate a man-in-the-middle attack. The vulnerability isn\u2019t limited to just Windows, either; it also affects Internet […]<\/p>\n","protected":false},"author":1,"featured_media":8249,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":""},"categories":[12],"tags":[23],"_links":{"self":[{"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/posts\/8248"}],"collection":[{"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/comments?post=8248"}],"version-history":[{"count":0,"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/posts\/8248\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/media?parent=8248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/categories?post=8248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging.datcomllc.com\/index.php\/wp-json\/wp\/v2\/tags?post=8248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}