Microsoft Details Network Hack In Windows

[HardOCP News]

Microsoft is warning of an attack that could be used to divert someone's web traffic through a malicious proxy server. Microsoft has posted information on its support site regarding this issue along with details for administrators on how to configure DNS and WINS on their servers to help prevent this type of attack.

Applications such as Internet Explorer use the Web Proxy Automatic Discovery (WPAD) protocol to find a file that enables a browser to configure its proxy settings. However, it's possible to plant a configuration file that would route traffic through a malicious proxy, the company said.

 

[MorfiusX]

Yes, it's Microsoft's fault they follow RFC standards... Just like the story posted yesterday, this is nothing new. Any sensitive information should use SSL anyway.

 

[LonerVamp]

SSL won't help you when they are intercepting your communication anyway. They're just negotiate the SSL for you, unless your target site uses the SSL to verify your identity, which very few do (usually only corporate users).

 

[MorfiusX]

SSL won't help you when they are intercepting your communication anyway. They're just negotiate the SSL for you, unless your target site uses the SSL to verify your identity, which very few do (usually only corporate users).

If you encrypt using the public key, the only the private key can decrypt the packet. Only the web server you are connecting to is going to have a copy of the private key. If SSL could be decrypted that easily, then there would be absolutely no secure on the internet and e-commerce would not exist.