Big-name companies like America Online Inc. (AOL) and Adobe Systems Inc. could do a better job of writing secure software, according to a recent report by two Princeton University researchers.
The researchers looked at a number of popular applications, including AOL Instant Messenger and Photoshop, and determined that many of them made changes to the operating system that could allow attackers to bypass some Windows security mechanisms.
“Vendors are making mistakes when they write programs for Windows,” said Sudhakar Govindavajhala, a Ph.D. student and one of the authors of the paper. “It’s worrying that your computer can become insecure on installation of new programs.”
An attacker would first need to gain access to a local account on a computer to take advantage of the problems described in the paper, Govindavajhala said. “These attacks are not exploitable over the Internet, but if someone can get a handle of your machine, then one can do interesting things.”
