Feeds

Hackers exploit MS design flaws

It's a question of trust, you see

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Bugs in Microsoft software have given rise to a new class of security problem for which antivirus software is completely ineffective. The problem arises because Microsoft decrees that IE can "trust" MS Office 97 programs and it is therefore possible for hackers to slip in something destructive through this route. This design loophole affects Windows 9x and NT, including Windows 2000. Microsoft acknowledged the problem only because of the publicity in a NYT article on Saturday. Andrew Dixon, the group product manager for MS Office, said Microsoft was "working on testing a solution". An AP follow-up revealed that Microsoft expected "to have an Office fix ready as early as Tuesday". These latest bugs involve a DLL in Office 97, where the JET version 3.5 engine "trusts" Office. The problem is not confined to versions of Office with Access, because JET is included with the standard version as well. Microsoft knew about this, and updated JET to version 4 in Windows 2000 to deal with the particular problem. With version 3.5, JET queries to databases can trigger commands to erase files or discs, as a result of a request from Office for data. Microsoft suggested downloading 8 megabytes of JET 4.0, but then withdrew this suggestion. Juan Carlos Cuartango, a programmer who had previously identified problems in IE and Navigator, found that the trust relationship was at fault, and could allow Trojan Horses to gallop in. Dangerous ActiveX controls An second problem is being experienced by users of recent Compaq and HP PCs, with Compaq admitting it and HP in denial. This concerns a digitally-signed applet that can execute programs when directed by a Web page. Even worse -- it is possible to email the applet. Again, Microsoft knew about this, starting with its discovery in November by Frank Farance of Farance Inc, and its more recent rediscovery by Richard Smith of Pharlap on an HP Pavilion last month. Smith pointed out that two ActiveX controls were dangerous, and could be used on a Web page to embed script code in an HTML email in Outlook or even Eudora. The ActiveX controls allow programs to read and write the Windows registry. As a result, Smith noted, a virus of malicious software could be installed; Windows security checking could be switched off; personal files could be read [by Microsoft for example]; documents could be deleted; and systems files could be removed to stop booting. Smith found four different ActiveX controls on the HP from three different vendors compromised security. He suggested that PC makers should take a closer look at the ActiveX controls that they ship with their hardware. Until Microsoft comes clean about all the problems that have been identified, it may be politic for users to switch off ActiveX controls in IE. ®

Next gen security for virtualised datacentres

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
Banking apps: Handy, can grab all your money... and RIDDLED with coding flaws
Yep, that one place you'd hoped you wouldn't find 'em
No, thank you. I will not code for the Caliphate
Some assignments, even the Bongster decline must
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Ballmer leaves Microsoft board to spend more time with his b-balls
From Clippy to Clippers: Hi, I see you're running an NBA team now ...
Video of US journalist 'beheading' pulled from social media
Yanked footage featured British-accented attacker and US journo James Foley
Primetime precrime? Minority Report TV series 'being developed'
I have to know. I have to find out what happened to my life
Broadband slow and expensive? Blame Telstra says CloudFlare
Won't peer, will gouge for Internet transit
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.