The security hole

Published: 2 September 1999 y., Thursday
A team of computer scientists has discovered a bug in tens of millions of Microsoft Windows computers that lets an attacker take control of a PC by sending an email message. The security hole, present in most copies of Windows 95 and all versions of Windows 98, would allow a malcontent to conceal malicious computer code in an email message or Web page that can surreptitiously modify files, reformat a hard drive, or execute any DOS command. "It_s the Melissa virus, but even worse," says Dan Wallach, an assistant professor of computer science at Rice University who is one of the team members. "The Melissa virus required someone to click OK. This doesn_t." Microsoft has acknowledged the backdoor. This week, after the researchers contacted the company, it released an upgraded version of its Java virtual machine that fixes the problem. But the tens of millions of Windows users who have not downloaded the patch and have not disabled Java remain vulnerable to anyone who knows the technical details of the bug. At risk are Windows users who read email using programs like Outlook, Outlook Express, and Qualcomm_s Eudora that use Microsoft_s viewing software and have fairly recent versions of its Java virtual machine. A Trojan Horse sent via email will be executed as soon as the message is viewed -- without any prompting. Web browsing with Internet Explorer 4.0 and 5.0 can be dangerous if users click on a Web site with malicious Java -- but Netscape_s browsers are immune. Other members of the team include Drew Dean and Dirk Balfanz of Xerox PARC, and Princeton computer science professor Ed Felten, best known for his testimony as the government_s technical expert in the Microsoft antitrust case. All are current or former members of Princeton_s Secure Internet Programming group, which has revealed many security vulnerabilities in Java implementations over the last four years. This attack works by repeatedly sending a specific message to a Java thread, exploiting what computer scientists call a race condition. Usually, Microsoft_s Java virtual machine does the right thing by barring a program from executing dangerous functions. But the attacking program the researchers showed to Wired News doesn_t give up.
Šaltinis: Wired News
Copying, publishing, announcing any information from the News.lt portal without written permission of News.lt editorial office is prohibited.

Facebook Comments

New comment


Captcha

Associated articles

Apple Starts Selling Unlocked iPhone 4 in the U.S

Confirming rumors that surfaced over the weekend, Apple has started selling the unlocked version of the iPhone 4 in Apple Retail stores. more »

Anonymous Begins Attacks on Spanish Police Websites

You didn’t expect Anonymous to take the recent Spanish police action against them lying down, did you? more »

Taiwan brings foldable touch-screens closer to reality

The era of foldable touch screens is rapidly approaching, with scientists in Taiwan leading the charge to develop computer and cell phone screens that can folded away or rolled up for storage. more »

The virtual finger language was created in Japan

During the exibition „Technology Open House 2011“ japanese creators of technologies presented the automatic system, which can translate words into the finger language. more »

China threatens Google over hacking claims

China has warned Google that its business could suffer if it continues to suggest that Chinese spies have been targeting the emails of United States' officials. more »

Zero carbon office-building a sign of things to come

South Korea is showing off what it says is the world's first totally eco-friendly business building, a structure that emits zero carbon and uses only renewable energy. more »

Facebook rejects NY man's claim of half-ownership

Facebook founder Mark Zuckerberg has said that an alleged contract and e-mails that a New York man claims entitle him to a 50% stake in the social networking site are "forgeries". more »

Toshiba prices its new tablet to undercut Apple's iPad2

The growing popularity of tablets has seen many new players enter the market. more »

Top 5 social networking hacks

Anthony Weiner, a Democratic congressman, has claimed his Twitter account was hacked after a photograph of a bulging pair of underpants was sent to a follower. Here are some of the most memorable social networking 'hacks'... more »

Google e-mail accounts attacked by Chinese hackers

Hace China have compromised personal e-mail accounts of hundreds of top US officials, military personnel and journalists, Google has said. more »