ITinfo: Windows 98 Security Bug More Serious Than Previously Thought

We Know Who You Are
And we know where you surf!

ITINFO Sponsor
Work Smarter, Not Harder.

Don't you get tired of hearing people say that?
Well shove it right back in their face!

With FastTips Newsletters your clients will rave about how well you treat them by sending them up-to-the-minute technical bulletins, and you won't have to lift a finger.

Oh, and by the way, it won't cost you a fortune.

Click to Start Working Smarter

Internet Poll

Have you attended a seminar via e-learning?

	yes
	no
poll archive

Win98 Security Bug More Serious Than Previously Thought
by Dave Murphy
ISSN 1535-3613

A few days ago I posted two articles discussing a newly-found bug in Windows 98, Excel 97, and Word 97 that allows a PC's Globally Unique Identifier (GUID), a hardware serial number that is unique to each PC, to be attached to files. This would allow a spreadsheet or document to possibly be traced back to a specific author. In addition, the GUID is passed to Microsoft during routine software registration procedures, even when the user explicitly requests that information not be transmitted to Microsoft Corp.

These two articles generated quite a firestorm of response from ITINFO subscribers, and I've kept an eye out for more developments. Here's what I just found: your computer's GUID can be passed to any unscrupulous website operator (not just to Microsoft), if you use Windows 98 and Internet Explorer 4.x.

This means that websites can track your activities without error because you're publishing the unique ID number of your PC. Intel has taken a big PR hit in the past month with the new ID code built into early Pentium III chips. But hats off to Microsoft, they figured out how to get the same perfect result last year, and privacy advocates missed it. Win98 users have been at risk of publishing their activities because of the GUID - the unique ID code within each of our PCs.

To see a demonstration of the GUID problem, use Win98 and IE4 to visit a demonstration page created by Richard Smith, the programmer who I reported last week first discovered the GUID problem.

Microsoft Corp.

Articles In This Series
Microsoft Documents Secretly Track Author
Microsoft To Help Users Remove GUID From Document
Win98 Security Bug More Serious Than Previously Thought
Microsoft Patches Win98 GUID Privacy Bug

Damar Group, Ltd. helps business use technology.

ITINFO is again accepting sponsors. Sponsor messages are included in ITINFO's email newsletter and are permanently posted to DGL's website and online reference areas.

ITINFO is an electronic publication of Damar Group, Ltd., publisher of Training Express computer learning guides. Comments and submissions to info@dgl.com.

Previous issues are on our website at http://dgl.com/itinfo/.

updated March 10, 1999
http://dgl.com/itinfo/1999/it990310.html