Feeds

Hackers exploit MS design flaws

It's a question of trust, you see

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Bugs in Microsoft software have given rise to a new class of security problem for which antivirus software is completely ineffective. The problem arises because Microsoft decrees that IE can "trust" MS Office 97 programs and it is therefore possible for hackers to slip in something destructive through this route. This design loophole affects Windows 9x and NT, including Windows 2000. Microsoft acknowledged the problem only because of the publicity in a NYT article on Saturday. Andrew Dixon, the group product manager for MS Office, said Microsoft was "working on testing a solution". An AP follow-up revealed that Microsoft expected "to have an Office fix ready as early as Tuesday". These latest bugs involve a DLL in Office 97, where the JET version 3.5 engine "trusts" Office. The problem is not confined to versions of Office with Access, because JET is included with the standard version as well. Microsoft knew about this, and updated JET to version 4 in Windows 2000 to deal with the particular problem. With version 3.5, JET queries to databases can trigger commands to erase files or discs, as a result of a request from Office for data. Microsoft suggested downloading 8 megabytes of JET 4.0, but then withdrew this suggestion. Juan Carlos Cuartango, a programmer who had previously identified problems in IE and Navigator, found that the trust relationship was at fault, and could allow Trojan Horses to gallop in. Dangerous ActiveX controls An second problem is being experienced by users of recent Compaq and HP PCs, with Compaq admitting it and HP in denial. This concerns a digitally-signed applet that can execute programs when directed by a Web page. Even worse -- it is possible to email the applet. Again, Microsoft knew about this, starting with its discovery in November by Frank Farance of Farance Inc, and its more recent rediscovery by Richard Smith of Pharlap on an HP Pavilion last month. Smith pointed out that two ActiveX controls were dangerous, and could be used on a Web page to embed script code in an HTML email in Outlook or even Eudora. The ActiveX controls allow programs to read and write the Windows registry. As a result, Smith noted, a virus of malicious software could be installed; Windows security checking could be switched off; personal files could be read [by Microsoft for example]; documents could be deleted; and systems files could be removed to stop booting. Smith found four different ActiveX controls on the HP from three different vendors compromised security. He suggested that PC makers should take a closer look at the ActiveX controls that they ship with their hardware. Until Microsoft comes clean about all the problems that have been identified, it may be politic for users to switch off ActiveX controls in IE. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
The 'fun-nification' of computer education – good idea?
Compulsory code schools, luvvies love it, but what about Maths and Physics?
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Lords take revenge on REVENGE PORN publishers
Jilted Johns and Jennies with busy fingers face two years inside
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Yes, yes, Steve Jobs. Look what I'VE done for you lately – Tim Cook
New iPhone biz baron points to Apple's (his) greatest successes
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.