XP Help Center request wipes out HD..

Discussion in 'other security issues & news' started by Paul Wilders, Sep 13, 2002.

Thread Status:
Not open for further replies.
  1. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    A malicious Win-XP Help Center request can easily and silently delete the contents of any directory on your Windows machine. Worse, MS has rolled the fix silently into SP1 without making a public announcement. A good sketch of the problem in English, along with a harmless self-test, can be found here, thanks to Mike at http://unity.skankhouse.org, who did some tinkering after noticing a tip on a BBS.

    Another, slightly earlier, mention comes from VSAntivirus, but the page, unfortunately, is en español, though there are some handy screen shots in their bulletin.

    more..
     
    Paul Wilders, Sep 13, 2002
    #1
  2. Checkout

    Checkout Security Rhinoceros

    Joined:
    Feb 11, 2002
    Posts:
    1,226
    I wonder how M$ can possibly fix all their outstanding security/privacy problems when they themselves create them faster than they can fix 'em.
     
    Checkout, Sep 13, 2002
    #2
  3. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    Gibson does offer (some sort of) solution in this context. Have a look at here.

    Most probably, a manual registry hack will make this exploit useless, without the need of installing SP1:

    - Open Regedit
    - Delete HKEY_CLASSES_ROOT\hcp
    - Close Regedit

    note: this could affect the Help & Support Center

    Still pending...

    regards.

    paul
     
    Paul Wilders, Sep 13, 2002
    #3
  4. Vampirefo

    Vampirefo Guest

    Looks like Gibson has created a program, that replaces one file, and this closes the hole. http://grc.com/xpdite/xpdite.htm
     
    Vampirefo, Sep 13, 2002
    #4
  5. Checkout

    Checkout Security Rhinoceros

    Joined:
    Feb 11, 2002
    Posts:
    1,226
    Vampirefo...Security Expert? Surely not the same guy who tried to spread molten lava all over DCS a while ago?

    Confused. o_O
     
    Checkout, Sep 13, 2002
    #5
  6. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    Yep. All settled and in the past now. And as for the title: one can hardly deny Vamperifo's skills ;)

    regards.

    paul
     
    Paul Wilders, Sep 13, 2002
    #6
  7. Checkout

    Checkout Security Rhinoceros

    Joined:
    Feb 11, 2002
    Posts:
    1,226
    Hmm...a remarkable change of writing style. I always suspsected there was more there than met the eye! :)
     
    Checkout, Sep 13, 2002
    #7
  8. MickeyTheMan

    MickeyTheMan Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    1,017
    Agreed . One's opinion don't make him/her less competent because of not being in agreement with you.
     
    MickeyTheMan, Sep 14, 2002
    #8
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...