Subject: Secret conversations
James Love (love@cptech.org)
Date: Fri, 12 Jun 1998 18:27:22 -0400
Message-Id: <3581AB4A.AAE5AFA0@cptech.org> Date: Fri, 12 Jun 1998 18:27:22 -0400 From: James Love <love@cptech.org> To: Roundtable <roundtable@cni.org> Subject: Secret conversations
Taken from am-info
-------
Subject: Secret conversations
Date: Fri, 12 Jun 1998 17:21:06 -0400 (EDT)
From: Mitch Stone <mstone@vc.net>
To: Multiple recipients of list AM-INFO <am-info@essential.org>
http://www.zdnet.com/macweek/1223/op_macintouch.html
Secret conversations
A new, subtle and apparently undocumented mechanism in Microsoft Office
98 raised a few other concerns about system intrusion. The easiest way
to see this is to open an HTML file in Word 98. This action triggers
Word to attempt a hidden conversation over the Internet with a Microsoft
Web server. If you have an Internet connection, Word checks your
software against the server's database and reports back with a dialog if
it finds a newer version than you have. (You then can download it.) If
no new version is found, Word remains silent.
This "AutoUpdate" mechanism does not appear in Word 98's online help
system, nor could I find it in the printed Word documentation. It
apparently works only with certain Word modules - opening an HTML file
triggers the invisible conversation, but opening a regular Word document
does not.
Also, when you open an HTML file or template, AutoUpdate appears in
Word's Tools menu, and you can manually trigger the process by selecting
this item.
A detailed packet analysis (see http://www.macintouch.com/o98autoupdate.html)
shows that Word sends Microsoft your computer's host name (or IP
address) and Word version information, using Web (HTTP) protocols.
Microsoft's server, in turn, sends back any dialog text and URLs in its
HTTP response.
Mitch Stone
Editor, Boycott Microsoft
http://www.vcnet.com/bms/
+---
We're the leaders, wait for us! --- Microsoft motto
This archive was generated by hypermail 2a16 : Tue Mar 23 1999 - 03:33:26 EST