When you run Spybot S&D, it may complain that your system is vulnerable to something called a “DSO exploit.” What’s that all about? Maybe a lot less than you think. I stumbled across this excellent article: “dso Exploit” Explained” href=”http://forums.net-integration.net/index.php?showtopic=23930″>”dso Exploit” Explained at the Net-Integration Forums.

In a nutshell, this specific security exploit is old and has long since been fixed. However, a bug in Spybot S&D 1.3 incorrectly detexts this as a problem even if it has been fixed. Bottom line, according to this article’s author, is that you can safely ignore the warning from Spybot S&D if you are current on your Windows security updates.

Bonus: The Net-Integration Forums have a very nice page listing malware removal procedures.

Professor Michael Froomkin of the University of Miami School of Law is one of my favorite bloggers. His insights on civil rights and legal issues are always worth reading. However, when the good professor strays into territory where he’s not an expert, things sometimes go a little wrong. Witness this post from today: Fix a Microsoft Vulnerability

If you read the blog entry in question, it sounds alarming. Unfortunately, the third-party security advisory that Prof. Froomkin references was from February 2002. It has long since been corrected. Any Windows user who is up to date with security patches – a procedure that is required with ALL operating systems, including the Mac OS and all variants of Linux – is protected from this.

It’s also one of the least problematic security issues I know. An attacker who successfully exploited this issue on an unpatched machine could not plant a program on your computer or execute a program from another location. He could only run an existing program on your PC, and then only if he knows the exact location of that program on your PC. It was an interesting proof of concept but it required a lot more work before it could be used for a hostile action.

And in fact, the system worked. GreyMagic published this security advisory in February 2002. On March 28, 2002, Microsoft published Security Bulletin MS02-015, which publicly addressed the problem. A fix was included in an accompanying Internet Explorer Security Update. This fix is included in Windows XP with Service Pack 1 or later.

I promise to chat with Professor Froomkin before I write about complex legal issues here. In exchange, I offer my technical expertise on Windows and Windows security advisories to my favorite law professor the next time he thinks about wrinting another Windows-related post.

Update: Professor Froomkin, in the comments below, notes that he was misled by a false report from Spybot S&D. This is indeed an error in Spybot, as I note in a follow-up post to this one. Click here for details about the phony “DSO exploit” error in Spybot S&D 1.3. Oh, and I meant what I said about his blog, Discourse.net. His work is just excellent, and it’s on my list of essential blogs to follow.

In today’s Seattle Times, Paul Andrews writes Tired of spyware? Try another browser. The trouble is, he appears to know just enough to spread misinformation.

During a recent six-week period, I conducted a small spyware experiment on my Windows computer.

I kept track of days I opened Microsoft Internet Explorer. At the close of each day, I ran Spybot, a detection and prevention program.

Here’s what happened: On nearly every day I used Internet Explorer, I was infected with a new batch of malware — spyware or adware. On days I used Mozilla Firefox for browsing and avoided IE, without exception I remained uninfected.

Oh really? I wonder what sorts of programs were getting installed on Paul’s computer, if any. Because on any computer running Windows XP, there are only two ways a program can be installed:

• You install it yourself. This can be accomplished by clicking OK to a dialog box or by downloading a setup file and running it.
• It installs itself, without your approval. This happens ONLY on a computer that does not have the latest security patches installed. The only way a program can be planted on your computer without your permission is to take advantage of a known security flaw.

Look, I take care of a dozen computers for friends, family, and neighbors. On not one of those computers would the situation that Paul describes be accurate. None of these people are experts, none of them scan their computers for spyware daily. So what’s the difference?

This quote from later in Paul’s story provides a clue:

What drove me to my experiment was sheer desperation at a constant, growing barrage of attacks on my Windows PC. Not only was the computer slowed to a crawl, it was almost impossible to perform any function without being assaulted by pop-ups.

Aha! It sounds like some particularly nasty piece of malware had infected the computer some time ago – the sort that Spybot S&D couldn’t remove. Every day, it was reinstalling itself or some variant of itself. At least that’s my guess.

Paul’s mistake is to assume that this is the normal course of events. It’s not normal, not by a long shot. And to write a story that implies that this is the normal state of affairs that anyone should expect when using Internet Explorer is misleading and inaccurate.

Paul, call someone for help. Once you get that piece of junk off your computer, you’ll find that the experience is completely different.

Update: Reading through the article again, I found another inaccuracy. Paul says that installing another browser (Firefox) is the only cure for spyware and adds: “You need to configure it to block cookies from third-party sites. That means the occasional inconvenience of having to re-enter logins and passwords on certain Web pages.” No, no, and no! First, you don’t need to block third-party cookies, although it can’t hurt and I think it’s a reasonable security precaution. Second, you can easily block third-party cookies with IE as well. The impact on spyware in either case will be nonexistent. Finally, blocking third-party cookies has ZERO effect on login prompts.

This article is horribly, horribly wrong.