The real
lesson of the KaK worm
•Outlook had a bad security
policy: by default it allowed script code to automatically
execute in HTML email messages [14]
•This poor security
policy was first formally pointed out to Microsoft in August
1998
•The
problem wasn’t fixed until after the ILOVEYOU hit