FBI agency advises turning off vulnerable XP feature

A government computer security agency is recommending that Windows XP users consider turning off XP’s universal plug-and-play (UPnP) service to close a security hole that can allow hackers to break into a user’s computer.

The recommendation, which follows a patch offered last week by Microsoft Corp., was posted Dec. 22 on the Web site of the FBI’s National Infrastructure Protection Center (NIPC) after discussions with Microsoft on the vulnerability.

The hole could lead to distributed denial-of-service attacks and other intrusions, according to the NIPC, which is recommending that UPnP be disabled in systems where it’s not being used. Full directions on how to disable UPnP are included in the NIPC security bulletin. The alert also suggests that systems administrators monitor and block ports 1900 and 5000, as increased activity on them can indicate active scanning by hackers seeking vulnerable systems.

On Dec. 20, Microsoft posted its own “critical” security advisory about the security hole, which also affects Windows 98, 98SE and ME when using the UPnP service. The UPnP service allows PCs to discover and use various network-based devices such as printers. Windows XP has native UPnP capability, which runs by default on the system. Windows ME also includes native UPnP capability, but it doesn’t run by default. With Windows 98 and 98SE, UPnP must be installed via the Internet Connection Sharing client that ships with Windows XP.

Spokespeople at the NIPC and Microsoft couldn’t be reached for comment at press time.

Alan Paller, research director at the SANS Institute, an IT security agency in Bethesda, Md., said the new Windows XP vulnerability highlights what has been a constant concern of many users: Software continues to arrive from vendors with major services turned on by default, rather than allowing users to choose the features they want to use.

“There’s a huge need in the user community to not be given something where everything is broken” as soon as it arrives from the vendor, Paller said. “We’re seeing it all over the place.”

Users want to see features included in products, he said, but they want to be able to turn them on as needed, not have them installed with every option available from the start, leaving them potentially vulnerable to security problems.

“This is only the first volley in what will be the biggest shift in computer security that’s taken place over the last two decades,” Paller predicted. “You’re just seeing the tip of the iceberg.”

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now