Feeds

Hackers exploit MS design flaws

It's a question of trust, you see

  • alert
  • submit to reddit

Intelligent flash storage arrays

Bugs in Microsoft software have given rise to a new class of security problem for which antivirus software is completely ineffective. The problem arises because Microsoft decrees that IE can "trust" MS Office 97 programs and it is therefore possible for hackers to slip in something destructive through this route. This design loophole affects Windows 9x and NT, including Windows 2000. Microsoft acknowledged the problem only because of the publicity in a NYT article on Saturday. Andrew Dixon, the group product manager for MS Office, said Microsoft was "working on testing a solution". An AP follow-up revealed that Microsoft expected "to have an Office fix ready as early as Tuesday". These latest bugs involve a DLL in Office 97, where the JET version 3.5 engine "trusts" Office. The problem is not confined to versions of Office with Access, because JET is included with the standard version as well. Microsoft knew about this, and updated JET to version 4 in Windows 2000 to deal with the particular problem. With version 3.5, JET queries to databases can trigger commands to erase files or discs, as a result of a request from Office for data. Microsoft suggested downloading 8 megabytes of JET 4.0, but then withdrew this suggestion. Juan Carlos Cuartango, a programmer who had previously identified problems in IE and Navigator, found that the trust relationship was at fault, and could allow Trojan Horses to gallop in. Dangerous ActiveX controls An second problem is being experienced by users of recent Compaq and HP PCs, with Compaq admitting it and HP in denial. This concerns a digitally-signed applet that can execute programs when directed by a Web page. Even worse -- it is possible to email the applet. Again, Microsoft knew about this, starting with its discovery in November by Frank Farance of Farance Inc, and its more recent rediscovery by Richard Smith of Pharlap on an HP Pavilion last month. Smith pointed out that two ActiveX controls were dangerous, and could be used on a Web page to embed script code in an HTML email in Outlook or even Eudora. The ActiveX controls allow programs to read and write the Windows registry. As a result, Smith noted, a virus of malicious software could be installed; Windows security checking could be switched off; personal files could be read [by Microsoft for example]; documents could be deleted; and systems files could be removed to stop booting. Smith found four different ActiveX controls on the HP from three different vendors compromised security. He suggested that PC makers should take a closer look at the ActiveX controls that they ship with their hardware. Until Microsoft comes clean about all the problems that have been identified, it may be politic for users to switch off ActiveX controls in IE. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.