Feeds

MS Love Bug cure worse than the disease?

It's sandbags at dawn...

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Microsoft's remedy to the ILOVEYOU virus may cause more problems than the original virus.

As we reported Tuesday, Microsoft posted three patches as an answer to the Outlook email virus and its copycat cousins.

"Microsoft has reported several cases of functionality failure surrounding the Outlook updates. The most significant of these involves the updates' installation procedures," reports Windows Web site EntEnt.

Also affected are the updates themselves, users of Palm and Windows CE synchronisation software, recipients of PowerPoint presentations, users who route documents from Word, and a long list of third party software. According to Microsoft itself, there is no uninstall procedure and if the patch installation goes awry - as Microsoft has admitted has happened 'in some cases' the recommendation is to uninstall and then reinstall the Microsoft Office suite from scratch.

Only users of Outlook 97, Outlook 98, Outlook 2000 or Exchange Server are affected. The full list of glitches can be found here.s

But if the sound of pigeons coming home to roost could be heard when ILOVEYOU struck, then there should be enough for a string of The Birds sequels now.

Compared to the clunky but effective Java sandbox, Microsoft has no clean way of discriminating between legitimate file and disk accesses and what could be the destructive payload of a worm or virus. As an example of how indiscrimating this is, Microsoft warns: "When accessing the Address Book from within Word or Microsoft Excel, the prompt indicating a program is trying to access your Address Book is displayed."

Well obviously. But it shouldn't, should it?

After ILOVEYOU the lion's share of attention was focussed on the ease of scripting the virus, but this dealt with the propagation, not the payload. And, lest we forget, ILOVEYOU corrupted data files.

With its patches this week, Microsoft typically went for the symptoms, rather than try and tackle the root cause of the problem. And that's going to be a lot harder, as so many of Microsoft's own applications depend on the broken model. For example Microsoft warns users of the Small Business Customer Manager (SBCM) of the Microsoft Office Small Business Tools, "many prompts are displayed; however, the Customer Manager still works". And because emailed PowerPoint presentations are kicked off by a .js script, that's broken too.

So when Microsoft launches it's NGWS next month - which automates business to business data flows on a grand scale - we'll be curious to see if how it addresses security. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.