Windows Zero-Day Security Hole Does Damage

Window's Worst Security Failing Since 2005

A dangerous security hole has been found in both old and new versions of Windows, which has caused a great deal of grief over the past few weeks. The hole, known as the zero-day bug, takes advantage of Microsoft's animated cursor, and enables websites and email messages to install malicious software on your computer. It is the worst problem of its kind since the Windows Metafile incident two years ago.

The animated cursor is a basic function that allows simple animations to be shown in the position of the cursor. It goes back a long way, and has never proved to be much of a problem, but a recent discovery enabled it to become a portal for malware to use to enter the computer. What makes the problem so scary is the fact that the damage can be done instantly, after merely accessing a web page.

Typically, infections enter the computer after the user has gone to a bad website or opened a malicious email. The hole then lets boatloads of spyware, viruses, and Trojan Horses onto the computer, quickly reducing it to a mess. Unlike traditional viruses, one does not have to actually open a file, but can get it merely by opening an email.

Currently, the hole is primarily being exploited through Microsoft's Internet Explorer, versions 6 and 7. Mozilla Firefix users are immune. Similarly, Microsoft's Outlook Express and Windows Mail (Vista) are immune to damage, since they preview messages, rather than opening them. This is an interesting reversal, since ordinarily Outlook is most vulnerable to viruses, being one of the most widely used email clients.

Microsoft has not yet released a patch for the bug. According to its normal release schedule, it would release a patch on April 10, but due to the gravity of the situation, it might act sooner than that. Already, EEye, a digital security company, has offered a patch as a stopgap measure. Their patch works by preventing any animated cursors from being installed on the system, and is designed to uninstall itself when the real Microsoft patch comes along.