Microsoft's 'Clippy' a security nightmare?
That's the hard lesson learned after last week's discovery of a security hole that subverts the powerful functions of Microsoft Office Assistant.
The hole, which allows an attacker to write a script that can do anything once on a user's computer, gets activated by clicking on a Web page or HTML-enabled e-mail. The script can then add or delete files.
"Because its abilities are marked 'safe for scripting,' anything is possible," said the security researcher that found the hole, a hacker known as "Dildog" who works for the security firm @Stake Inc.
Microsoft has released a patch to fix the permissions on the hole, but users still need to download the patch and update their Office program.
Microsoft was not immediately available for comment.
When it debuted, the Office Assistant -- also known as Clippy, because of its paper clip persona -- was dismissed by critics as the equivalent of training wheels for computer newbies. Yet the friendliness of the Office Assistant hides a great deal of power. In fact, it's essentially a back door for Microsoft to allow macros that can take control of a PC and help out users.
That control, however, can be manipulated to hurt users as well. A test program created by @Stake can set the system security to "low" and copy a text document to the hard drive.
"The fact that this control exists and is installed in the particular fashion would permit the construction of a worm of unparalleled devastation," @Stake wrote in its advisory.
While Dildog praised Microsoft (msft)for being quick to act in this case, he still criticized the low security of the Windows scripting system.
"You don't mark something safe for scripting unless you are going to let someone activate it remotely," he said. At the heart of the matter is the industry's penchant for marking most security holes as need-to-know information. Most of the time, only company insiders are those considered to have a need to know.
"Microsoft has this habit of keeping people in the dark," Dildog said. "It is totally undocumented control."