Possible Windows XP security issue.

Post by **Jerry** » Wed Sep 11, 2002 5:16 pm

I don't know if this is correct or a hoax... but you may want to review this if you are running Windows XP. (Also Possible ME user.)
http://grc.com/default.htm

With only one finding I would have let it pass as a possible hoax... but I also found this: http://www.newsfactor.com/perl/story/15458.html

Then this... http://special.northernlight.com/windowsxp/security_flaw.htm

I'm thinking it's pretty real. In a nutshell... a web page could contain data that would be transmitted along with your web page... not a big deal because normally there would be no way to execute it. The bug here is that now via the hole... the web page could tell the computer to EXECUTE the file and gain control of your computer.

Once they have control... they can browse your files, delete stuff, copy files, etc. If you have your bank account information in there.... well... you get the picture.

Kinda nasty.
Jerry
[img]modules/Forums/images/smiles/icon_frown.gif[/img]

hockeyfan · Post by **hockeyfan** » Wed Sep 11, 2002 7:39 pm

Nope, this information is absolutely true. Gibson Research is a very good whistle blower, pun semi-intended [img]modules/Forums/images/smiles/icon_smile.gif[/img]. (MS Whistler I salute you!)
BTW, anyone using XP and doesn't have an automated house full of X10 crap, should follow the Unplug N Pray freeware/software on GRC site, I disabled mine manually, however it gets turned on after those "Windows Updates" to fix the 3 holes it shipped with...

If Microsoft keeps pissing me off, I may install Linux on everything x86, and start buying Apple Powerbooks from now on. Why am I pissed off? Well after 32 MS quickfix updates (I counted them in add/remove programs), this box that I am using is still not even close to being secure to browse the internet.

Service Pack 1 came out Monday 09/09/02 on Windows Update and the network full install has timed-out for 2 days... [img]modules/Forums/images/smiles/icon_frown.gif[/img]

ME users are not affected with this "gapping security hole", however they probably are getting tired of their OS being so unstable, I have helped 5 people "down-grade" their new computers with ME to 98SE. [img]modules/Forums/images/smiles/icon_frown.gif[/img]

No one has ever been fired for buying Microsoft products.. (Quote from an old boss.)

Well they should have! (Thought in my head.)
HockeyFan

Wolverine · Post by **Wolverine** » Fri Sep 13, 2002 1:35 pm

You are so true! It is for real... <BLOCKQUOTE><font size="1" face="Verdana, Helvetica, sans-serif">quote

It has recently been repaired in Service Pack 1.

Being a PC tech, I have to deal with all MS OS's, and ME sucks Dogs for Beer money!!! What a piece of CRAP! I've had to deal with ME on my Notebook PC, screwing up constantly!! and currently BTW. You kinda touched a nerve with me on that one, sorry to get carried away....

Corben_99 · Post by **Corben_99** » Fri Sep 13, 2002 11:15 pm

Hey on a side note I think that shit was intended! My Microsoft X-box has the ability to send information back to the Microsoft HQ. This little gaming machine remembers when you last played a game. How you played it. And how many times you turn on the system, what CD's do you listen too, and probably the temperature of your ass to boot. It's just waiting for the user to get on their online game plan X-box live, just to send back all the collected data on the person who's been playing the system. [img]modules/Forums/images/smiles/icon_eek.gif[/img] Kinda creepy huh?

Wolverine · Post by **Wolverine** » Sat Sep 14, 2002 7:48 am

Microsoft as "Big Brother".

hockeyfan · Post by **hockeyfan** » Sat Sep 14, 2002 12:59 pm

The "Ministry of Love" must be where you go to be "Microsoft Certified".

The Marketing Dept at Microsoft recently changed its name to "Ministry of Truth".

You may be onto something here Wolverine!!!

HockeyFan [img]modules/Forums/images/smiles/icon_tongue.gif[/img]

LatexShrapnel · Post by **LatexShrapnel** » Wed Oct 16, 2002 4:09 pm

Not for anything this flaw can be used in a positive manner. Lets say you had confidential information on a network hard drive. Lets say some hacker makes his way onto one of the nodes and you detect it, what better way than to pull up a intranet page that deleted the files instantly...then again...theres always a security fix sent to me every other week for windows xp in windows update.....gonna go for a mac