Zero-day Vulnerability

 Sandworm affecting all versions of Windows

On 10/21/14, Microsoft issued a warning about a Zero-day vulnerability that cyber criminals are exploiting through PowerPoint files sent as email attachments!  

Although Microsoft provided a "Fixit" line that blocks the attacks seen so far and users can use it to protect their PCs until a patch is available, it is not same as " four-step threat scoring system it uses for security updates". This bug, after a successful exploit, allows hackers to hijack the PC and steal information and/or inject viruses

"The vulnerability affects all versions of Windows, from the aging Windows Vista to the very newest Windows 8.1, and is within the operating system's code that handles OLE (object linking and embedding) objects". The OLE is used by Microsoft Office for embedding data from Excel spreadsheet in Word document. Yet, hackers might use the flaw for other purposes!

iSight slapped the moniker "Sandworm" on 
the cyber-spy gang.

Although Microsoft patched a similar vulnerability in the same month with eight updates including OLE bug, hackers used it to make other attacks by exploiting " malformed PowerPoint files". Yet, According to researchers at iSight Partners, Russian hacker crew used MS14-060 to attack Ukrainian government agencies, NATO, Western European government agencies and companies in the telecommunications and energy sectors since December 2013.

Microsoft did not release a new patch yet, but they should as soon as possible.

Microsoft also urged windows users to pay a close attention to the "User Account Control (UAC) pop-ups" that alerts them before any action such as file downloads. However, this still not an effective solution since most users click without a second thought.

Source
http://www.computerworld.com/article/2836722/microsoft-warns-of-windows-zero-day-hackers-serve-exploits-in-powerpoint-files.html