InfoWorld
Lead with Knowledge
HOME/ SITEMAP
SUBJECT INDEXES
App Development
Broadband
Business Intell.
Business News
Business Strategies
Careers & Mgmt
Collab. Software
Content Mgmt
CRM
Database
E-Business
End-User Apps
End-User Hardware
Enterprise Apps
Ethics
Government
Licensing
Middleware
Mobile Computing
Networking
Online Community
Operating Systems
Processors
Security
Servers
Storage
Telecomm.
Web Services
Web Technologies
Wireless
XSPs
NEWS
CTO ZONE
TEST CENTER
FEATURES
COMMUNITY
OPINIONS
INTERVIEWS
FORUMS
RESEARCH
EVENTS
WEBCASTS
ADVERTISE
ABOUT InfoWorld
Reprints
ABOUT US
About InfoWorld
Services
Advertise
Contact us
Reprint
Employment
WHITE PAPERS

Learn to secure your PCs from new and unknown hacker attacks.

Free IDC White Paper - Discover Secure File Sharing for the Enterpriseattacks.
SEARCH:  
Home  //  Community //  Opinions //  Article
Print Article    Email Article
Window Manager
Brian Livingston
SP1: gangs of fun

I'VE REPORTED on patches OVER the past five weeks, especially the latest service packs for Windows 2000 and XP, which contain new license language. SP3 for Windows 2000 gives Microsoft the right to issue fixes "that will be automatically downloaded to your computer." SP1 for XP had the same language during beta testing, but the final text now says SP1 will install "technological measures that are designed to prevent unlicensed use."

It's these new "measures" in XP SP1 that we'll scrutinize in this and upcoming columns.

Horrid Help. First, I have to warn you about a serious security weakness that affects every XP installation. This problem allows a malicious person to erase all the files in an entire Windows XP folder -- such as 0C:\Windows -- merely by sending victims an e-mail, no attachment required.

I'm choosing not to say exactly how to do this. But the gist is that Microsoft has created a new protocol it calls hcp:// for the Help and Support Center introduced in XP. This protocol can be initiated by a Web page or an e-mail. Help then runs with elevated privileges, to devastating effect.

This hole is closed if you install SP1. But many people aren't embracing SP1 because it involves a 30MB to 140MB download and has a bad reputation due to its many quirks (more on them later).

Although Microsoft has known of the Help flaw at least since June, "for inscrutable reasons they chose not to proactively act to close the hole before SP1," says white-hat hacker Steve Gibson.

As a result, Gibson has posted an explanation and a small 30KB utility called XPdite at http://www.grc.com/xpdite/xpdite.htm. This utility tests for and patches only vulnerable XP systems. XPdite can be inserted by system admins into corporate log-on sequences to fix all their XP machines.

You break it, you bought it. Those quirks I mentioned above include the fact that installing SP1 breaks a surprising number of things. For instance, reader John Galus found that running SP1 shuts down the "multiple identity" feature of Outlook Express. Microsoft has confirmed this and offers a workaround at http://support.microsoft.com/default.aspx?scid=kb;en-us;Q329084.

Bruce Kratofil, my Windows 2000 Secrets co-author, notes that two dozen SP1 installation issues are already documented at http://support.microsoft.com/default.aspx?scid=kb;en-us;Q324722. He warns, "There could be a whole lot of grief if this stuff gets automatically updated without you knowing about the issues ahead of time."

Key to the future. That brings us to the new technological measures SP1 adds to automatic updates of XP. In a nutshell, your numeric "product key" is now sent back to Microsoft via the Internet when XP's Product Activation is run with SP1 present. If a corporate product key was used to illegally install a copy of XP, a download of SP1 will refuse to run. Most interesting, Microsoft will be able to ban certain keys in the future, which could prevent updates and/or activations.

We'll look at the implications of that next week.


Send tips to Contributing Editor Brian Livingston at brian@brianlivingston.com. Get Window Manager and his E-Business Secrets e-zine free at http://www.iwsubscribe.com/newsletters .



RELATED ARTICLES

Pick a pack of patches
Welcome, new admin
Sneaky service packs

RELATED SUBJECTS

Operating Systems
Security
Click here for all of Brian Livingston's past columns.
SUBSCRIBE TO:    E-mail Newsletters  InfoWorld Mobile InfoWorld Magazine
Home  //  Community //  Opinions //  Article Print Article    Email Article
Back to Top
 ADVERTISEMENT
 

SPONSORED LINKS

Learn to secure your PCs from new and unknown hacker attacks.
SPEED, PERSONALIZATION AND INTEGRATION: THE KEY TO E-COMMERCE SUCCESS.
Protect Your Data: Get your FREE Enterprise Backup Intelligence Kit from ADIC.
New HP digital projectors — click now for limited-time introductory offers.
SeeBeyond Webinar - Topic: UCCnet, Thurs., 9/26/02 , 8-9 am PST

SUBSCRIBE
E-mail Newsletters
InfoWorld Mobile
Print Magazine
Web-based training
ABOUT INFOWORLD  |  SITE MAP  |  EMPLOYMENT  |  PRIVACY  |   CONTACT US

Copyright 2002 InfoWorld Media Group, Inc.