e-Business blog

After a few days of head scratching, Microsoft told Windows XP users today not to press the F1 key when prompted by a Web site.

The warning is part of the software giant’s emerging reaction to an unpatched vulnerability that hackers could exploit to hijack PCs that run Internet Explorer.

Microsoft is investigating new public reports of a vulnerability in VBScript that is exposed on supported versions of Microsoft Windows 2000, Windows XP, and Windows Server 2003 through the use of Internet Explorer.

But good news for Vista and Win7 users: Their investigation has shown that the vulnerability cannot be exploited on Windows 7, Windows Server 2008 R2, Windows Vista or Windows Server 2008.

The main impact of the vulnerability is remote code execution.

The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer. If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed.

On systems running Windows Server 2003, Internet Explorer Enhanced Security Configuration is enabled by default, which helps to mitigate against this issue.

Until a patch is ready, users can protect themselves by not pressing the F1 key if a Web site tells them (repeatedly) to do it.

Another workaround: Disable Windows Help by modifying the ACL on winhlp32.exe to be more restrictive on Windows 2000, Windows XP and Windows Server 2003 by running the following command from an administrative command line:

echo Y | cacls "%windir%\winhlp32.exe" /E /P everyone:N

Employers with the urge to listen in on workers’ phone calls, take heart: A city that maintained an automated system for recording workplace phone calls isn’t liable for violating its employees’ civil rights. 

Current and former employees of the Providence, RI, police and fire departments sued their employer for recording the calls. Their lawyers argued that the employees’ Fourth Amendment rights were violated when the department’s automated system recorded calls at the city’s public safety complex for about eight months back in 2002.

But the First Circuit federal court reversed a $1 million judgment when its judges decided the city officials were immune because at the time, public safety employees did not have a “clearly established” right NOT to have calls made at work recorded under either the Fourth Amendment or federal wiretap laws.

The court also let the city itself off the hook for the recordings.

The court explained that to “find municipal liability, we have required that the custom or practice ‘be so well-settled and widespread that the policymaking officials of the municipality can be said to have either actual or constructive knowledge of it yet did nothing to end it.’”

“The recordings in this case were neither so widespread nor so well-settled as to be a custom or practice. They occurred at a single building and for a period of eight months … nor did plaintiffs show the city’s policymaking officials had constructive knowledge of it and yet did nothing to end it.”

So, the judges decided, a little recording for a little while that not everybody in charge knew about? No problem.