Microsoft working to close 8-year-old Web proxy flaw

Flaw first discovered in 1999

Microsoft is working on a fix for an eight-year-old flaw in Windows that lets hackers exploit a Web proxy autoconfiguration protocol and take over groups of machines via a single attack. Microsoft has yet to release the update it has been working on since last week that addresses the vulnerability in the Web Proxy Autodiscovery Protocol (WPAD) in Windows.

The flaw was first discovered in 1999, and some experts say it has never be adequately patched.

The flaw affects all versions of Windows including Vista, but does not affect computers in the United States. Microsoft reportedly patched the flaw eight years ago to protect computers that use the ".com" domain as part of their corporate identity. The fix, however, does not work for computers that use domain country codes, such as .nz (New Zealand) or .uk (United Kingdom).

WPAD is a method used by Web browsers to locate a proxy configuration file called wpad.dat that is used to configure a Web browser's proxy settings. Part of the flaw lets the search for the configuration file leave the safety of the corporate network, thus opening an avenue for a hacker to hijack the request and deliver a configuration file to the browser that could then be then exploited to intercept and modify the user's Web traffic.

The Windows WPAD feature was designed so administrators would not have to configure browser proxy settings on each desktop manually. All the automated WPAD configuration work takes place out of view of the user.

Last week, Beau Butler, who also goes by the name Oddy and the title "ethical hacker," presented his rediscovery of the WPAD flaw at the annual Kiwicon security conference at Victoria University of Wellington in New Zealand. Butler told conference attendees and Australia's The Age Web site that he found 160,000 computers in New Zealand using the .nz domain that were vulnerable to the WPAD flaw. The Age said Microsoft asked it not to publish the details over fears they could be used by cybercriminals to seize control of workstations. Microsoft confirmed it was a serious issue, The Age said.

Some details about the vulnerability, however, are available by doing simple queries on Microsoft's own Live Search Web site. Additionally, Microsoft publishes Knowledge Base articles on its Web site describing how WPAD works.

The Kiwicon conference's session abstracts said Oddy (Butler) would be "explaining all the ways in which networks can be configured in order to make WPAD leakage a non-problem." According to the Microsoft Web site "WPAD lets services locate an available proxy server by querying a DHCP [dynamic host configuration protocol] option or by locating a particular DNS [domain name system] record."

Web caching expert Duane Wessels, who helped develop Squid, a high-performance proxy-caching server, has a Web site

that explains the flaw to users. "Basically, it works like this: When the browser starts, it issues a DNS address lookup for '' where '' is the domain name of the computer. Due to some Microsoft bug, some browsers look up ',' which is my host," he wrote on his Web site. Wessels made the post after getting angry letters for network administrators who saw traffic funneling to his Web site.

In actuality, the DNS lookup only happens if DHCP does not turn up the wpad.dat file. DNS is the next option, and the lookup for "" happens as WPAD crawls down the network DNS hierarchy searching for the address of the wpad.dat proxy configuration file. WPAD typically can guess rather accurately that it is searching on a company's own internal network, but the country code domains derail the process and let the search go off the corporate network.

Regardless of where the search progresses, once the location of the wpad.dat file succeeds, the browser makes a connection and gets the file and configures the browser. If a hacker succeeds in getting his own wpad.dat file to configure the browser, the attacker can point the browser to his proxies and intercept and modify all the browser's HTTP traffic.

Although the available data on WPAD's inner workings points to how it can be exploited, Butler has not discussed his specific exploit except during his Kiwicon presentation last week.

Microsoft was contacted for input on the issue, but had not responded by the time this article was posted.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John Fontana

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?