Microsoft confirmed XP zero-day vulnerabilities have been exploited by hackers

According to foreign media reports, Microsoft confirmed on Tuesday that hackers have begun to use the Windows XP zero-day vulnerability announced by Google engineers last week to launch attacks.
Has been exploited by hackers

Although Microsoft did not disclose too much detail, other researchers gave relevant information. Graham Cluley, senior technology consultant at Sophos, a network security company, said the hacker had hacked a website and exploited the vulnerability to attack Windows XP users, but he did not disclose information about the site.

Crowley said that Windows XP users can be infected as long as they visit a website with malicious code. This is also one of the two attacks that Microsoft has announced. Another way is to distribute malicious code via email.

Microsoft said that the hacked website has removed malicious code, but more similar attacks may occur in the future. Jerry Bryant, general manager of Microsoft Security Response, said: "Since the full details of this issue have been announced, we expect more attacks in the future."

Google security engineer Tavis Ormandy disclosed the security flaw on Microsoft last Thursday, and he also released a series of "proof-of-concept" attack code. However, Ormandi said that he had reported the vulnerability to Microsoft in the past five days, but the move was still questioned by Microsoft and other researchers.

Google is the first to announce

Crowley said in his blog that Omanti’s behavior is “completely irresponsible”. He said: "I want Microsoft to develop a patch that is not enough for five days. Microsoft needs to thoroughly test it to ensure that it does not cause more problems in order to fix this vulnerability."

Mandy said through Twitter last week that he disclosed the vulnerability because Microsoft did not promise to fix the vulnerability within 60 days. Microsoft confirmed that the company's team had discussed with Ormandi about the release date of the patch.

Microsoft released a security advisory on the vulnerability last Thursday. In addition to acknowledging the existence of this vulnerability, it also provides a temporary solution to help users defend against attacks. The next day, a tool was introduced to automatically unregister the HCP protocol processor. Microsoft said that this will help users block the attack path before the security patch is released.

Crowley said that the attack code currently used by hackers is very similar to the "proof of concept" attack code provided by Omanti. Other security experts believe that this is entirely unexpected.

Microsoft said that although Windows Server 2003 also includes this vulnerability, the system is currently not threatened by related attacks.

According to the regular plan, Microsoft's next patch release will be July 13, but it will still break the rules in an emergency. But Microsoft did not comment on this. Bryant said: "We will continue to monitor the threat situation and will post the latest information through our blog and Twitter."