Microsoft confirms VIsta can be pwn3d just by talking to it. Repeat after me: "Delete Star Dot Star"

[matcom]

:eyes:

<snip>

Microsoft is investigating public reports of a possible vulnerability in Windows Vista’s speech recognition feature. Microsoft’s initial investigation reveals that this vulnerability could allow an attacker to use the speech recognition feature in Windows Vista to verbally execute commands on a user’s computer. The attackers’ commands are limited to the rights of the logged on user. User Account Control prohibits the attacker from executing any administrative level commands.

In order for an attack to be successful, the user would have to have a microphone and speakers connected to their system. In addition, the user would have had to configure the speech recognition feature. The attackers’ audio file would then issue verbal commands via the systems speakers that could potentially be carried out by the speech recognition feature. Based on the initial investigation, Microsoft recommends customers take the following action to protect themselves from potential exploitation of the reported vulnerability:

A user can turn off their computer speakers and/or microphone.
If a user does run an audio file that attempts to execute commands on their system, they should close the Windows Media Player, turn off speech recognition and restart their computer.

Microsoft will continue its investigation and will provide additional guidance and mitigation to further help protect customers as necessary. Upon completion of this investigation, Microsoft will take further action to help protect our customers.

It’s important to note that Windows Vista has been developed with the highest attention to security and is the first client-based operating system to go through the complete Security Development Lifecycle (SDL). Building on the significant security advances in Windows XP Service Pack 2, Windows Vista includes fundamental architectural changes that will help make customers more secure from evolving threats, including worms, viruses, and malware. These improvements minimize the operating system’s attack surface area, which in turn improves system and application integrity and helps organizations more securely manage and isolate their networks.

http://blogs.zdnet.com/Ou/?p=418

[ZombieNixon]

1. Ha!

:rofl:

[AlCzervik]

2. are you a Farker?

[matcom]

4. go over there to see the photoshops - couldn't resist

:D

[AlCzervik]

5. love the Fark!

"Do not want".

[LSK]

3. K&R

:thumbsup:

[Deja Q]

6. I saw it in action today

Not entirely impressed, though big corporations will love it if they believe the bafflegab about how it will reduce helpdesk and other service-related calls (meaning bye-bye staff that the end user base loves so well.)

[billyskank]

7. That is brilliant

"this vulnerability could allow an attacker to use the speech recognition feature in Windows Vista to verbally execute commands on a user’s computer."

:rofl:

[Little Wing]

8. Hey Boss! Put me on speaker, I have an announcement to make

Delete star dot star

and I QUIT!