Vista Accessibility Vulnerabilty, Not So Much

Yesterday, Vinoo Thomas proclaimed a vulnerability in Vista accessibility feature called StickyKeys.  Vinoo, a McAfee researcher goes on to call this a “legacy backdoor” that has been around since Win2000 and XP. He doesn’t mention that for this to be a problem you need administrative rights to replace the file sethc.exe on your system. .

I’m not really annoyed at Vinoo for bringing up this issue. More people should be aware of the StickyKeys feature. Application developers should especially be aware of StickyKeys so they can verify their applications support it.

( Check out StickyKeys by tapping your Shift key 5 times in a row. )

While I don’t agree this is a vulnerability, he brings up some good issues.  Calling it a BackDoor is however misleading. You can read what he says and decide for yourself by clicking…  Windows Vista Vulnerable to StickyKeys Backdoor

I’m more annoyed at the technical press for putting out large headlines that make this out to be some kind of critical flaw for the handicapped.
ZDNet puts it in the “neat-find-department” but acknowledges it could only occur “under perfect circumstances”.  PC Advisor UK at least called Microsoft for a comment but wasn’t able to connect with a spokesperson. Everyone else just reprinted an article from the IDG News Service which also points out…

“Although it is interesting that Vista is also vulnerable, it's not clear how useful the backdoor would be to an attacker because one must first gain access to the machine in order to replace the StickyKeys file.”

Right… so why are you bothering to report on this?