Linux-Networking Digest #444, Volume #10 Wed, 10 Mar 99 04:13:37 EST
Contents:
latest MS virus (Bob)
----------------------------------------------------------------------------
From: Bob <[EMAIL PROTECTED]>
Crossposted-To:
linux.debian.user,dc.org.linux-users,alt.linux,alt.os.linux,comp.os.linux.setup
Subject: latest MS virus
Date: Wed, 10 Mar 1999 00:06:20 -0500
==============F3FDB72E3C8B7C7220E41CF1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Today a Microsoft press spokesman denied a persistent rumor that
MS plans to build a campus next door to CIA-Langley or
CIA-Rockwell-Dulles.
http://www.wired.com/news/news/email/tip/technology/story/18331.html
Sniffing Out MS Security Glitch
by Chris Oakes
5:30 p.m. 8.Mar.99.PST
A security vulnerability that hides unique
identifiers in Microsoft Office documents
may affect files created by other software
applications, according to the programmer
who identified the breach.
Other Office documents and browser
cookies, and possibly even software from
other companies, can store the unique
identity codes, according to Richard Smith,
president of Phar Lap Software in
Cambridge, Massachusetts, who first
reported the security glitch on Sunday.
Smith discovered that Excel and Word
applications fingerprint files with an
identifying number. That number is used
by the hardware that connects a PC to a
local area network. The 32-digit numbers
were designed long ago by developers of
networking hardware to identify individual
machines.
"These things are slippery. These
[numbers] are floating around -- it's hard to
say where they're showing up," said Smith.
Microsoft was not available for comment.
The identifying number is trapped in the
Windows registry file as a Globally Unique
Identifier, or GUID, and embedded in a
hidden part of documents created using
Office, including Word, Excel, and
PowerPoint.
"I got email for someone mentioning that
GUIDs are also put in Web-browser
cookies. I did a quick scan on my Netscape
cookies file and found a number of Web
sites that were indeed using GUIDs for
identification purposes," Smith said.
It goes to show the ubiquity of the ID
numbers, he said. "Anyone writing
applications can use them. [The privacy
issue] is an unintended side effect."
The unique number can be easily traced to
a person by searching for the number in
documents known to be created by that
person, according to Smith. Unknown
documents could also be associated with
that person using the identification number.
"If you're in some really weird office-politics
situation -- who knows?" he said.
He plans to explore whether other
Windows applications, such as software
for creating Web pages, use the ID
numbers. He's also interested in the
behavior of the company's Outlook email
software.
Smith said users can easily find their own
network address, then search their
hard-disk content for documents containing
the ID number to determine where it is
surreptitiously stored.
Users can find the number by selecting the
Run command under the Windows Start
menu and typing winipcfg to launch the
Windows IP configuration utility. One of the
fields appearing in the dialog box contains
the user's "network adapter" address.
"All I did was have a search utility scan the
hard disk for occurrences of the Ethernet
address," he said.
Smith used one called Grep. "Anyone can
do that and see how common it is."
Sniffing Out MS Security Glitch Page 2
5:30 p.m. 8.Mar.99.PST
continued
Certain types of text editors, known as
hexadecimal editors, will reveal the invisible
code in any file. One example of the editor
is HexEdit.
Smith made a related discovery when he
found Microsoft was collecting the
identification number users entered when
registering their new copies of the
company's Windows 98 operating system,
prompting Microsoft to post an open letter
to its customers.
It said the company would publish software
to remove the ID number from users'
Windows registry file, a move designed to
prevent the behavior from occurring in
future documents. The company also said
a subsequent update of Windows 98 would
disable the software's registration feature
so that the hardware ID would not be
collected "unless the user checks the
option to send hardware information to
Microsoft."
The company said it also plans to post a
software tool on its Web site that will allow
users to delete hardware-registration
information from the Windows registry.
But in a privacy advisory also issued
Monday, a privacy-watchdog group
demanded that Microsoft go further.
"What I think is unprecedented here is that
the problem is now on billions of
documents around the world. The problem
remains out there even if Microsoft fixed
the applications," said Jason Catlett,
president of Junkbusters. "We demand
they publish and publicize free software to
protect these files -- and that's not
something Microsoft in its open letter said it
would do.
"[Users] really don't have an effective
means of stopping [the problem] from
happening short of switching to [another
software product like] Corel WordPerfect,"
he said.
Smith and privacy advocates worry that
Microsoft already has built up a database
of registration numbers, although the
company said it plans to purge its own
databases of any hardware-identification
information that may have been
inadvertently gathered without customers'
consent.
Microsoft said it was confident "that the
hardware information is not being stored in
our marketing databases, and we are
investigating whether it is stored in any
database at all within Microsoft."
Catlett believes an independent auditor
should oversee any such effort to purge the
data, which could have been transferred to
backup systems or related databases.
"For me, the bottom line is Microsoft is
getting information off of people's computer
[that] they have no business getting."
Addressing that issue, he said, "sounds
like a patch to me."
Catlett is disturbed by this wide-reaching
impact. Combined with Microsoft's push
for required registration, a possibility Catlett
documented last week, he sees a
quagmire for users trying to protect
themselves.
"If Microsoft starts compelling people to
register, then its going to take a lot of time
for people to disentangle their lives from
Microsoft's sticky tentacles."
Related Wired Links:
MS Patches Privacy Peephole
7.Mar.99
Advocate Issues Windows Warning
4.Mar.99
Privacy Bug Rash Spreads to IE
9.Oct.98
Microsoft Plugs IE Hole
28.Sep.98
Msoft Bug Opens Site Secrets
2.Jul.98
MS Office Leaks Sensitive Data
29.Jun.98
==============F3FDB72E3C8B7C7220E41CF1
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
Today a Microsoft press spokesman denied a persistent rumor that
<br>MS plans to build a campus next door to CIA-Langley or
<br>CIA-Rockwell-Dulles.<a
href="http://www.wired.com/news/news/email/tip/technology/story/18331.html"></a>
<p><a
href="http://www.wired.com/news/news/email/tip/technology/story/18331.html">http://www.wired.com/news/news/email/tip/technology/story/18331.html</a>
<p>
Sniffing Out MS Security Glitch
<br>
by Chris Oakes
<p>
5:30 p.m. 8.Mar.99.PST
<br>
A security vulnerability that hides unique
<br>
identifiers in Microsoft Office documents
<br>
may affect files created by other software
<br>
applications, according to the programmer
<br>
who identified the breach.
<p>
Other Office documents and browser
<br>
cookies, and possibly even software from
<br>
other companies, can store the unique
<br>
identity codes, according to Richard Smith,
<br>
president of Phar Lap Software in
<br>
Cambridge, Massachusetts, who first
<br>
reported the security glitch on Sunday.
<p>
Smith discovered that Excel and Word
<br>
applications fingerprint files with an
<br>
identifying number. That number is used
<br>
by the hardware that connects a PC to a
<br>
local area network. The 32-digit numbers
<br>
were designed long ago by developers of
<br>
networking hardware to identify individual
<br>
machines.
<p>
"These things are slippery. These
<br>
[numbers] are floating around -- it's hard to
<br>
say where they're showing up," said Smith.
<p>
Microsoft was not available for comment.
<p>
The identifying number is trapped in the
<br>
Windows registry file as a Globally Unique
<br>
Identifier, or GUID, and embedded in a
<br>
hidden part of documents created using
<br>
Office, including Word, Excel, and
<br>
PowerPoint.
<p>
"I got email for someone mentioning that
<br>
GUIDs are also put in Web-browser
<br>
cookies. I did a quick scan on my Netscape
<br>
cookies file and found a number of Web
<br>
sites that were indeed using GUIDs for
<br>
identification purposes," Smith said.
<p>
It goes to show the ubiquity of the ID
<br>
numbers, he said. "Anyone writing
<br>
applications can use them. [The privacy
<br>
issue] is an unintended side effect."
<p>
The unique number can be easily traced to
<br>
a person by searching for the number in
<br>
documents known to be created by that
<br>
person, according to Smith. Unknown
<br>
documents could also be associated with
<br>
that person using the identification number.
<p>
"If you're in some really weird office-politics
<br>
situation -- who knows?" he said.
<p>
He plans to explore whether other
<br>
Windows applications, such as software
<br>
for creating Web pages, use the ID
<br>
numbers. He's also interested in the
<br>
behavior of the company's Outlook email
<br>
software.
<p>
Smith said users can easily find their own
<br>
network address, then search their
<br>
hard-disk content for documents containing
<br>
the ID number to determine where it is
<br>
surreptitiously stored.
<p>
Users can find the number by selecting the
<br>
Run command under the Windows Start
<br>
menu and typing winipcfg to launch the
<br>
Windows IP configuration utility. One of the
<br>
fields appearing in the dialog box contains
<br>
the user's "network adapter" address.
<p>
"All I did was have a search utility scan the
<br>
hard disk for occurrences of the Ethernet
<br>
address," he said.
<p>
Smith used one called Grep. "Anyone can
<br>
do that and see how common it is."
<br>
<br>
<br>
<p>
Sniffing Out MS Security Glitch Page 2
<br>
5:30 p.m. 8.Mar.99.PST
<p>
continued
<br>
Certain types of text editors, known as
<br>
hexadecimal editors, will reveal the invisible
<br>
code in any file. One example of the editor
<br>
is HexEdit.
<p>
Smith made a related discovery when he
<br>
found Microsoft was collecting the
<br>
identification number users entered when
<br>
registering their new copies of the
<br>
company's Windows 98 operating system,
<br>
prompting Microsoft to post an open letter
<br>
to its customers.
<p>
It said the company would publish software
<br>
to remove the ID number from users'
<br>
Windows registry file, a move designed to
<br>
prevent the behavior from occurring in
<br>
future documents. The company also said
<br>
a subsequent update of Windows 98 would
<br>
disable the software's registration feature
<br>
so that the hardware ID would not be
<br>
collected "unless the user checks the
<br>
option to send hardware information to
<br>
Microsoft."
<p>
The company said it also plans to post a
<br>
software tool on its Web site that will allow
<br>
users to delete hardware-registration
<br>
information from the Windows registry.
<p>
But in a privacy advisory also issued
<br>
Monday, a privacy-watchdog group
<br>
demanded that Microsoft go further.
<p>
"What I think is unprecedented here is that
<br>
the problem is now on billions of
<br>
documents around the world. The problem
<br>
remains out there even if Microsoft fixed
<br>
the applications," said Jason Catlett,
<br>
president of Junkbusters. "We demand
<br>
they publish and publicize free software to
<br>
protect these files -- and that's not
<br>
something Microsoft in its open letter said it
<br>
would do.
<p>
"[Users] really don't have an effective
<br>
means of stopping [the problem] from
<br>
happening short of switching to [another
<br>
software product like] Corel WordPerfect,"
<br>
he said.
<p>
Smith and privacy advocates worry that
<br>
Microsoft already has built up a database
<br>
of registration numbers, although the
<br>
company said it plans to purge its own
<br>
databases of any hardware-identification
<br>
information that may have been
<br>
inadvertently gathered without customers'
<br>
consent.
<p>
Microsoft said it was confident "that the
<br>
hardware information is not being stored in
<br>
our marketing databases, and we are
<br>
investigating whether it is stored in any
<br>
database at all within Microsoft."
<p>
Catlett believes an independent auditor
<br>
should oversee any such effort to purge the
<br>
data, which could have been transferred to
<br>
backup systems or related databases.
<p>
"For me, the bottom line is Microsoft is
<br>
getting information off of people's computer
<br>
[that] they have no business getting."
<br>
Addressing that issue, he said, "sounds
<br>
like a patch to me."
<p>
Catlett is disturbed by this wide-reaching
<br>
impact. Combined with Microsoft's push
<br>
for required registration, a possibility Catlett
<br>
documented last week, he sees a
<br>
quagmire for users trying to protect
<br>
themselves.
<p>
"If Microsoft starts compelling people to
<br>
register, then its going to take a lot of time
<br>
for people to disentangle their lives from
<br>
Microsoft's sticky tentacles."
<p>
Related Wired Links:
<p>
MS Patches Privacy Peephole
<br>
7.Mar.99
<p>
Advocate Issues Windows Warning
<br>
4.Mar.99
<p>
Privacy Bug Rash Spreads to IE
<br>
9.Oct.98
<p>
Microsoft Plugs IE Hole
<br>
28.Sep.98
<p>
Msoft Bug Opens Site Secrets
<br>
2.Jul.98
<p>
MS Office Leaks Sensitive Data
<br>
29.Jun.98</html>
==============F3FDB72E3C8B7C7220E41CF1==
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and comp.os.linux.networking) via:
Internet: [EMAIL PROTECTED]
Linux may be obtained via one of these FTP sites:
ftp.funet.fi pub/Linux
tsx-11.mit.edu pub/linux
sunsite.unc.edu pub/Linux
End of Linux-Networking Digest
******************************
