Microsoft 'flaw' threat to 200m PCs

COMPUTER users were warned that hackers could gain control of their machines because of a flaw in the world's most popular software.

Experts said cyber criminals could exploit the fault in Microsoft Windows to access bank account details and credit card numbers. More than 200m computers worldwide, including millions in Britain, are vulnerable.

Microsoft said the flaw is found in all current versions of its operating system software - Windows NT, Windows 2000, Windows XP and Windows Server 2003 - which are used in the vast majority of home computers as well as companies of all sizes and government departments.

Now they face a race against time to correct the flaw before criminals find ways to exploit it.

It also raises the prospect of hackers gaining access to highly sensitive personal information stored in emails and confidential commercial documents.

David Cuss, of eEye Digital Security, the firm that detected the flaw, said that if companies did not act quickly the cost could outstrip the estimated £21.4bn damage caused by the Mydoom email virus.

He said: 'A hacker could take control of any computer with a Windows operating system and access everything on it. They could bring networks down and steal all sorts of information. Computer users have a period in which to act before hackers start to attack.'

Last night PC users were urged to download a 'safety patch'. Adam Oxford, editor of PC Format magazine, said: 'Home computer users shouldn't panic as they can protect against it.' eEye Digital said they informed Microsoft of the problem in July 2003. Some experts said Microsoft was right not to announce the flaw until it had a solution but that should have taken three months at the most.

Steven Philippsohn, a senior partner at law firm Philippsohn Crawfords Berwald, which specialises in 'cyber crime', said: 'They were under a duty to remedy the problem as soon as possible. If they didn't do that, any business which suffers could well have a good case to sue Microsoft.'

A Microsoft spokesman said: ' Security responses require a balance between time and testing but Microsoft will only release a patch when it is warranted. An incomplete patch can be worse than no patch at all if it serves to alert malicious hackers to a new issue.'

Simple solution

PC users should install a software 'patch' to overwrite the system flaw by logging on to www.microsoft.com/security and clicking on 'security update'.

Users should also ensure their computer has a firewall, which stops access to unauthorised users, and the latest anti-virus software.