New Book Throws FUD at Microsoft

While it might suprise some of my readers, I am about to come to defense of the Microsoft Corporation. If you recall, yesterday I posted about the assertion contained in Lance James new book, Phishing Exposed, that Microsoft Outlook was potentially a phisherman's paradise because it did not display the url behind a hyperlink when hovered over. Carl Tyler of Instant Technologies quickly let me know that this was not a problem with Outlook 2003. I wanted to test it with other versions of the program. However, I never have used, and never will (if I can help it) use Outlook, so I had no way of testing. So I sent an email off to the author for clarification. The answers stunned me and I feel that both the author and the publisher, Syngress Press, be called on the carpet for publishing FUD and leaving out information about how Microsoft is upgrading its tools to fight phishing.

What The Author Did (or Did Not Do)

It is on page 225 of the book that the reader is presented with the screenshot of an email message in the Outlook client. Along with this picture, the author states that "most popular email client in the world has no default status bar" to display a URL when hovering over a link, identifying this as a vulnerability
in Outlook. I asked him to clarify this and to explain what kind of testing program he used to verify the statement. His response was "I believe (emphasis added) Outlook 2002 is the one I tested with".

My basic problem with this is that there was no disciplined methodology taken and the result of the "test" that was taken has been generalized to the whole universe of Outlook clients. There is no indication in the book of what client was tested, or the fact that this is no longer a vulnerability in Outlook 2003. He said that:

"The book was under-edited so they have missed my footnote on the version. I'm pretty sure I originally put that in there. 2002 is still pretty recent though and a lot of users still use that."  

I will address the under-editing in a bit. However, the author either did or did not include a footnote. There should be no "pretty sure" about it. In addition, it does not matter that "a lot of users" still use Outlook 2002. This is where the author should have stepped in and encouraged users to upgrade to Outlook 2003 or switch to another mail client that does not have the vulnerability. All that was dome was to compare this generalized statement about outlook to the functionality of Thunderbird. Thunderbird is a decent product as far as POP clients go, but it is nowhere near ready for primetime as an enterprise-grade collaboration tool. If this book is truly targeted for security professionals and others that work in corporate environments, the author should have, at minimum in passing, mentioned that this vulnerability does not exist in Lotus Notes/Domino and, if appropriate, Groupwise.

I responded to Lance with the same thing I have been saying in my reviews of Syngress Books this past year:

I have had a lot of heartburn with the editing, or lack thereof, on the part of Syngress and this has been reflected in many of my reviews of their titles. This type of thing always gives me pause for concern because it hits the credibility of the author(s), i.e. "if this is so wrong, how can we trust the rest of the content?"

The Under-Editing By Syngress

This case is just another major mistake that has made its way into books put out by Syngress Press. The mistakes have included some real gems such as the "fact" that there was an Internet cafe in Iraq during the first gulf war, the inclusion of an urban legend about RFID tags being in the new US$20 bills, and the publication of a book about Sarbanes-Oxley that should, in my opinion, never been published.

Syngress has got to step up to the plate and do a better job in making sure that their books get a real technical edit and that mistakes and FUD-spreading like this stop making it into print. It speaks to their credibility as a publisher and the credibility of their distribution partners.

An Apology Is Due To Microsoft

In this particular case, I feel that both the author and Syngress Press owe Microsoft a public apology and that the misstatement be corrected in future printings of the book. It is a shame that a good book has to be tarnished with something like this. Some of us may have come to expect this from certain industry analysts or magazine writers, but not from technical books.