Windows Magazine Exclusive: OS Experts Craft the First Solution for the Win 98 Privacy Bug.

MANHASSET, N.Y.--(BUSINESS WIRE)--March 18, 1999--CMP Media's Windows Magazine's exclusive fix for the Windows 98 privacy bug is available today on its Web site, almost two weeks before users can download an operating system bug patch from Microsoft. Literally thousands of users have already accessed both the demonstration and the step-by-step solution--authored by Dave Methvin, executive editor, Windows Magazine.

Demo: http://www.winmag.com/web/regwiz.htm Solution: http://www.winmag.com/web/regwizoff.htm

Windows Magazine developed this solution after discovering that the Win98 Registration Wizard bug would make it not only possible for any web site to read information that uniquely identifies you and your PC, but that the information can be modified and/or sent to Microsoft without your consent. Richard Smith of Phar Lap Software first identified a risk with the Registration Wizard, or RegWiz.

"Our investigation shows that these numbers, thought to be unique forms of identification that are generated by Microsoft, are so easy to change, that they can no longer be relied on," says Dave Methvin, executive editor, Windows Magazine.

Win 98 uses RegWiz to process your product registration form and submit it to a Microsoft server over the Internet. Two identification numbers are generated based on your PC configuration and the data you enter during registration. The first number, called the hardware identification number (HWID), can, in most cases, uniquely identify the computer. A second number, called the Microsoft ID (MSID), uniquely identifies a user and is placed in a browser cookie for access to services on Microsoft's Web site.

Windows Contributing Editor Martin Heller examined the interface to RegWiz and discovered not only does the control allow the HWID and MSID numbers to be read by any site, but it also lets them be changed. That means any Web page can alter these ID numbers, and can even do so without your knowledge.

RegWiz also includes the ability to send a PC's registration information to Microsoft. This can be triggered from any Web page without the user's consent. When this function is used, a small window appears that says "Sending the registration information to Microsoft ... Please wait." Other than disconnecting from the Internet, there is no way for a user to stop the transfer once it has started.

In response to the privacy concerns raised by the Registration Wizard, Microsoft has said it will no longer record the HWID information when a user registers, and will eliminate any use of the HWID information that might currently be in their databases. The company said it also expects to have a utility available within two weeks that deletes the HWID personal registration data from the registry. It is possible to disable RegWiz and remove the information manually by using the Win 98 registry editor, and we have provided instructions for doing this at http://www.winmag.com/web/regwizoff.htm.

CMP Media's Windows Magazine is the business computer publication that drives the application of Windows technology for business, from Windows CE to Windows 2000. It provides 800,000+ technology buyers with the information and perspective they need most (what's new, what to buy, how to apply it) to make the most of their business computing investment. Windows Magazine: It's how business really operates. (www.winmag.com)

CMP Media Inc. (Nasdaq: CMPX) is a leading high-tech media company that provides essential information and marketing services to the entire technology spectrum--the builders, sellers and users of technology worldwide. With its portfolio of newspapers, magazines, custom publishing, Internet products, research, consulting and conferences, CMP is uniquely positioned to offer marketers comprehensive, integrated solutions tailored to meet their individual needs. Online editions of the company's print publications, along with products and services created exclusively for the Internet, can be found on CMPnet at http://www.CMPnet.com. NSTL, the company's independent testing lab and consulting organization, serves government, corporate and technology vendor clients around the world.