Another New Microsoft Windows Flaw Puts Nearly Everyone at Risk

It’s being labeled by some security experts as one of the most serious vulnerabilities, if not the worst vulnerability to hit Windows in its history and may allow an attacker to hijack the network connection of an unsuspecting user. It can bypass firewalls and other network detection devices and does not involve malicious code and can be delivered in various ways. It affects all versions of the Windows operating system from Windows 95 to Windows 10, which covers pretty much everyone who uses Windows.

The malware is being called BadTunnel and typically is easily exploitable when a user is tricked into visiting a site via Microsoft Internet Explorer, Edge, or opens a special Office document. Therefore, be aware of email messages with unexpected links or documents, regardless of the sender. If in doubt, don’t click them as phishing tactics are getting better every day.

It can also be successful by being transferred from a USB drive or other third party apps on Windows, as well as via IIS and Apache Web servers.

Make sure to update Windows systems with the latest patches. There is a fix available for this flaw and those systems running Windows 10 or other newer versions of the operating system will have it applied automatically. However, older versions that allow the user to turn off the option to have these automatically updated will need to verify it has been applied. If you are unsure if it has been applied or how to check, ask for assistance.

If you are still using an unsupported version of Windows (which includes all versions prior to Windows Vista), there will not be a patch released. It is recommended that you update to a newer version as soon as possible so you are not unnecessarily putting yourself at risk.

The fix is discussed in security bulletin MS16-077 and is identified as CVE-2016-3213. More information and a demonstration on how this was found will be provided in a talk by the Chinese security researcher who discovered it at the Black Hat USA conference later this summer in Las Vegas. Microsoft has indicated that BadTunnel has not been exploited, yet. So you have time to update your system. Just don't put it off.