The security hole

Published: 2 September 1999 y., Thursday
A team of computer scientists has discovered a bug in tens of millions of Microsoft Windows computers that lets an attacker take control of a PC by sending an email message. The security hole, present in most copies of Windows 95 and all versions of Windows 98, would allow a malcontent to conceal malicious computer code in an email message or Web page that can surreptitiously modify files, reformat a hard drive, or execute any DOS command. "It_s the Melissa virus, but even worse," says Dan Wallach, an assistant professor of computer science at Rice University who is one of the team members. "The Melissa virus required someone to click OK. This doesn_t." Microsoft has acknowledged the backdoor. This week, after the researchers contacted the company, it released an upgraded version of its Java virtual machine that fixes the problem. But the tens of millions of Windows users who have not downloaded the patch and have not disabled Java remain vulnerable to anyone who knows the technical details of the bug. At risk are Windows users who read email using programs like Outlook, Outlook Express, and Qualcomm_s Eudora that use Microsoft_s viewing software and have fairly recent versions of its Java virtual machine. A Trojan Horse sent via email will be executed as soon as the message is viewed -- without any prompting. Web browsing with Internet Explorer 4.0 and 5.0 can be dangerous if users click on a Web site with malicious Java -- but Netscape_s browsers are immune. Other members of the team include Drew Dean and Dirk Balfanz of Xerox PARC, and Princeton computer science professor Ed Felten, best known for his testimony as the government_s technical expert in the Microsoft antitrust case. All are current or former members of Princeton_s Secure Internet Programming group, which has revealed many security vulnerabilities in Java implementations over the last four years. This attack works by repeatedly sending a specific message to a Java thread, exploiting what computer scientists call a race condition. Usually, Microsoft_s Java virtual machine does the right thing by barring a program from executing dangerous functions. But the attacking program the researchers showed to Wired News doesn_t give up.
Šaltinis: Wired News
Copying, publishing, announcing any information from the News.lt portal without written permission of News.lt editorial office is prohibited.

Facebook Comments

New comment


Captcha

Associated articles

Broadband Service Speedier in Lithuania than in U.S.

South Korea leads the world in providing broadband services. The United States (No. 15) did not make the Top 10 and lag behind Lithuania (No. 14). more »

Gemalto Sets Up Payment Card Personalization Facility in Indonesia

Gemalto, the world leader in digital security, today announced that it will inaugurate its first personalization center in Indonesia before the end of the year. more »

Wincor Nixdorf wins first order from State Bank of India

State Bank of India (SBI), the country’s largest lender, has awarded Wincor Nixdorf and its local partner AGS Infotech an order for 1,000 ATMs. more »

Gemalto's Trusted Services Management Solution Certified by MasterCard

Gemalto today announced it has achieved MasterCard certification for its TSM (Trusted Services Management) offer. more »

SmartCards Expo 2009

International Conference and Exhibition of Smart Card Technology and Applications will show showcase the latest in Smart Cards, e-security, Biometrics, RFID, and e-payments products and solutions. more »

Gemalto acquires Trusted Logic, a leading provider of secure software platforms

Gemalto today announced that it has completed the acquisition of Trusted Logic from its founders and other shareholders. more »

Thales appointed mission system design authority for TALISMAN

Thales UK today announces the signing of a contract valued at around £25m with the UK Ministry of Defence (UK MoD) to undertake the role of Mission System Design Authority (MSDA) for the TALISMAN Urgent Operational Requirement (UOR) programme. more »

Nigeria's InterSwitch Selects Gemalto's Complete Strong Authentication Solution to Secure their e-Payment Services

Gemalto announced that InterSwitch is deploying its complete Ezio strong authentication solution to secure their e-payment services in Nigeria. more »

Directing traffic in cyberspace

Commission calls for international talks on managing internet traffic. more »

Tweeting to God in Israel

Israeli student Alon Nir is using the website as a way for people to communicate with the Almighty. He's preparing people's prayers, posted on Alon's twitter page, to take to Jerusalem's Western Wall. more »