Neowin.net - Windows vulnerability a feature claims Microsoft

Windows vulnerability a feature claims Microsoft

Posted by Daniel Fleshbourne on 06 July 2006 - 11:19 · 19 comments & 6376 views

MICROSOFT CLAIMED a hacker trick that allows an executable file to be launched when a user types a Web address into Internet Explorer is a feature rather than any security vulnerability. But security boffins have warned that this particular 'trick' is unnecessary and expect it to be exploited by malware writers. ZD Net Australia quotes Michael Warrilow, of Hydrasight as saying that Volish "useful features" have been shown to result in security exposures that are ultimately exploited for malicious purposes. This will be no exception.

Another security expert James Turner of Frost and Allen said that he could imagine that malware writers could definitely exploit this feature particularly with a little social engineering.

View: The full story

News source: The Inq

Hide additional information

About the Author
Full name: Daniel Fleshbourne
Forum name: Daniel
Contact: via forum PM
Submissions: Normal · Headline

Total votes: 0

Bookmark on del.icio.us

Advertisement

#1 Posted by Stunna on 06 Jul 2006 - 11:27: "allows an executable file to be launched when a user types a Web address into Internet Explorer"

I've been doing that for years and I love it.
I heard they may take this out of windows vista oh well

#2 Posted by lunamonkey on 06 Jul 2006 - 11:51: I use the address bar in my taskbar to launch all my programs (like a run command)

they better not remove this useful feature, just because some people visit dodgy sites that'll exploit it.

(2 replies) #3 Posted by GreenMartian on 06 Jul 2006 - 12:18: A web browser should be just that. a WEB browser.
A FILE explorer/browser/manager should be the one handling files..

Yeah I believe in the separation of powers. That's one thing that the US of A got right.

#4 Posted by Jugalator on 06 Jul 2006 - 12:33: I just do Windows+R, type it in, and press enter, and hopefully that'll still work. Don't even have to use the mouse.

#5 Posted by icecaveman on 06 Jul 2006 - 13:43: I used this feature a lot and I made .bat files so I wouldn't need to type in the full names

#6 Posted by dangel on 06 Jul 2006 - 13:53: Yup, this is a very useful feature... it'd be silly to take it out tbh.

(3 replies) #7 Posted by Tim Wong on 06 Jul 2006 - 14:26: HA! at least make an option to turn it off

MS!

#8 Posted by ThePitt on 06 Jul 2006 - 15:54: Windows itself is a vulnerability a feature

(1 reply) #9 Posted by Brandon Live on 06 Jul 2006 - 16:05: How the hell is this a vulnerability?

Are they really saying that some "hacker" is going to use "social engineering" to get you to make a shortcut to a file ALREADY ON YOUR HARD DRIVE, name it "www.microsoft.com" and then go there and subsequently launch the app? I mean, you're requiring a huge amount of user action including DOWNLOAD A MALICIOUS FILE or creating a destructive shortcut. But if they can get you to make a shortcut to "format c: /q" or whatever (and then give it the name of a common web address!, they could just as well get you to type it in the Run box or command line.

Seriously, what the hell are these guys smoking?

(1 reply) #10 Posted by lbmouse on 06 Jul 2006 - 16:32: Everyday I try to tell our end users, "It's not a bug, it’s a feature", but that never works for me. Where do I get a hold of the spin-doctors that work for MS? I need to uncover their secret formula.

#11 Posted by aristotle-dude on 07 Jul 2006 - 02:31: Ah, yes. The old "it's not a bug, it's a feature" ploy. I try telling QA that all the time but it never works for me.

#12 Posted by Sacha on 07 Jul 2006 - 12:33: Yes, I find it very annoying when I type "calc" into firefox and instead get redirected to openoffice.org. I wanted the calculator, damn you!

[1]

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Scroll to the Top