BBC Homepage World Service Education
BBC Homepagelow graphics version | feedback | help
BBC News Online
 You are in: Sci/Tech
Front Page 
UK Politics 
Talking Point 
In Depth 
Thursday, 18 May, 2000, 15:46 GMT 16:46 UK
When paper clips attack
Paper clip BBC
Paper Clip: He likes to tap your screen
By BBC News Online internet reporter Mark Ward

Now you have another reason to be irritated by the pop-up paper clip that many Microsoft programs use to give help and advice to users.

Security experts have found a security hole that could be used by malicious hackers to subvert the paper clip and turn it against users.

Usually the screen-tapping paper clip turns up in Microsoft Office programs when people press F1 with a query.

One option for confused computer users is "Show Me" in which the paper clip walks them through the menu options to complete a task.

But in order to offer help and show users how to carry out some tasks, the Office Assistant is given privileged access to the workings of the Microsoft software.

Security settings

The clip can launch macros, small programs, on behalf of users and take control of the PC. Now a hacker known as Dildog has found that this ability can be hijacked.

The Love Bug virus that caused havoc around the world earlier this month exploited a similar weakness.

Power Pup BBC
Tired of Paper Clip? Change him for Power Pup
Dildog, who works for the security firm @Stake, found the hole and warned Microsoft of its existence.

"The fact that this control exists and is installed in the particular fashion would permit the construction of a worm of unparalleled devastation," @Stake wrote in its advisory.

Dildog created a test program to see what the clip could be made to do and how much damage could be done via the hole.

He found that it could be used to reset security settings to "low" and copy documents onto the hard disk of the computer.

Microsoft has now issued a patch program that will stop the paper clip being hijacked. This is available from its website.

Search BBC News Online

Advanced search options
Launch console
See also:

11 May 00 | Sci/Tech
Love Bug may have been accident
11 May 00 | Americas
Tackling cyber crime
12 May 00 | Talking Point
Net viruses: Can we ever stop them?
Internet links:

The BBC is not responsible for the content of external internet sites

Links to more Sci/Tech stories are at the foot of the page.

E-mail this story to a friend

Links to more Sci/Tech stories