Prevent One-Click Hack Attacks

Stuart J. Johnston

If your name is Microsoft, you may be an 800-pound gorilla, but you can never sleep. You're the target of every bug hunter and hacker out there. So it's no surprise that sleuths have exposed a new swarm of bugs in Microsoft's products. The most serious problems this month affect Internet Explorer and some versions of Windows. With these flaws, one fatal click by you could allow PC pirates into your machine.

Bug: The first hole could allow a hacker to take over your computer and even reformat your hard drive. Here's how it might happen: A malicious Web site operator tricks you into clicking a specially crafted link at a Web site or in an e-mail message formatted in HTML. If you fall for the trickery and your system runs any version of IE (including the latest version, 5.5), you're vulnerable. The flaw lies in the Java Virtual Machine (or VM) that works with IE. The purpose of the VM is to run Java applets securely. Java applets perform a range of tricks to enliven drab Web pages--from popping up new windows to playing a song. The weakness would let a malicious hacker bypass the VM's security and wreak havoc on your PC.

Fix: Microsoft is shipping updated versions of the VM to prevent hackers from sidestepping its built-in security. You first need to figure out which of the several versions of the VM your PC has; then you pick the appropriate patch. You can determine which version you have and get the patch you need from Microsoft's security pages. Alternatively, you can get a double-barreled version of the VM that fixes both this problem and another, less-significant bug in the VM.

Bug: South American firm Underground Security Systems Research discovered a particularly nasty bug that could allow hackers to easily snare Windows users--as with the first bug, all it takes is one click. Imagine you're surfing the Web and you click an innocuous-looking hyperlink or a link in an e-mail message. This link, however, secretly starts up a Windows utility called HyperTerminal and uses it to take over your machine. Even if your PC doesn't have HyperTerminal running (or if you've never used it), the link automatically starts the program, deliberately crashes it, and allows a cunning hacker to run arbitrary code on your system. HyperTerminal is an old program that lets you connect to a remote PC over the Internet using DOS-like commands. Rarely used, it still ships with current versions of Windows. If you run Windows 95, 98, or Me, your machine could be at risk.

Fix: Microsoft provides several different patches that prevent hackers from taking advantage of HyperTerminal. Check out the security bulletin to figure out which one you need. The bulletin is posted at Microsoft's security site. For additional details, check out the slew of FAQs in the same bulletin.

Bugged?

Found a hardware or software bug? Tell us about it via e-mail at bugs@pcworld.com.

Stuart J. Johnston is a contributing editor for PC World. He is based in Bellevue, Washington.

In Brief

Windows Me Video Drivers Lag Behind

Users reported that some video drivers shipping with Windows Me are out-of-date. If you installed Me and are having trouble with the video card, check the maker's site for updates. Microsoft says that it also updates drivers as they become available.

HP Pavilion Identity Crisis

A small number of owners of HP's Pavilion 8755C PC (equipped with a Pentium III-800 processor) got a nasty surprise when they checked the PC's configuration. Windows incorrectly told them that the 8755C has a Celeron CPU instead. HP plans to have a BIOS fix by the time you read this. For more details, go to HP, select Support, click the link for Home PCs, and type 8755C.

Media Player Brings Outlook to Its Knees

Microsoft discovered a problem with one of the controls supporting its Media Player 7 that could enable an attacker to crash Outlook or Outlook Express. The problem lies in a piece of code called an OCX Control that's associated with the Media Player--though it's not part of the Player proper. The OCX Control provides support functions to the player. The hacker could send you a copy of the control embedded in a Rich Text Format (RTF) e-mail message. (Ordinarily, the control would not be embedded in a message, so its inclusion can't be accidental.) When you open the infected message, it will crash your e-mail. Get the patch or learn more details from Microsoft's security bulletin.