[ news_security_news ]
Microsoft: You Say “Security Threat,” I Say “Feature”
Doug Caverly
Staff Writer
2006-07-06
 Insider Reports RSS Feed
It turns out that something Microsoft considers a "legitimate feature" of Windows XP and Internet Explorer is also something of a security risk. By entering an address into the Web browser, users could inadvertently (or intentionally, as Microsoft argues) open an executable file.
This process isn't quite as devious as it first sounds. In order for it to happen, the file would have to be represented by a shortcut on the desktop, and that icon would have to have the same name as the website to which Internet Explorer was being pointed.
Peter Watson, chief security adviser at Microsoft Australia, gave a statement to ZDNet Australia defending the trick. "It's important to clarify the difference between security problems and legitimate features," he said. "A security hole helps an attacker do something they shouldn't be able to do, which is not the case in this instance. Software that the user legitimately has installed on the computer might need exactly this sort of feature provided by IE."
Others disagree. In the same ZDNet article, Michael Warrilow of Hydrasight weighed in. "Microsoft's so-called useful features have been shown time and again to result in security exposures that are ultimately exploited for malicious purposes. This will be no exception," he said.
James Turner, a security analyst, sided with Warrilow. "I would imagine that malware writers could definitely exploit this-particularly with a little social engineering."
Microsoft may have been trying to create a clever little feature, but it seems like many people view the result as a security hole.
Add to | DiggThis | Yahoo! My Web
Technorati: Microsoft
About the Author:
Doug is a staff writer for SecurityProNews. InternetFinancialNews, SearchNewz, and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
