One-year-old (unpatched) Windows 'token kidnapping' under attack
http://blogs.zdnet.com/security/?p=2894