Way Too ActiveX
 Joe Wilcox
What does Microsoft know that we simple users of Internet Explorer don't? |
With Internet Explorer 7, Microsoft made some hefty changes to ActiveX controls, turning off a bunch by default and flipping on the security warning switch for many others. If timing means anything, the ActiveX changes are possibly quite important.
Today, over at Symantec's Security Response Weblog, Greg Ahmad reveals startling--and I do mean shocking--increases in ActiveX vulnerabilities. According to Symantec, ActiveX vulnerabilities stayed in the 12- to- 15-a-year range from 2002 to 2005. For 2006, the number of vulnerabilities "reached 50," with 42 in the second half of the year--coincidentally, the same time period Microsoft finished up and released Internet Explorer 7.
"During the first quarter of 2006, three ActiveX vulnerabilities were reported. This was followed by nine in the second quarter, 13 in the third quarter, and 26 in the fourth," Ahmad wrote.
"This rise of vulnerabilities in ActiveX controls can be attributed to a variety of reasons," Ahmad explained. "These include an increasing number of vendors shipping insecure ActiveX controls and the availability of a variety of security testing tools and ActiveX fuzzers that allow researchers and attackers to rapidly find vulnerabilities with relative ease."
In security discussions with Microsoft about Internet Explorer, insecure or exploited ActiveX controls emerged as ongoing concerns. Both problems pose risks end users probably wouldn't understand unless a security breach was obvious. In the exploited scenario, a Web site would use an ActiveX control designed for one purpose and exploit it for malicious purpose. A simple example would be an ActiveX control for Word designed for the desktop accessed by a Web site in the Internet Zone.
"The rise of vulnerabilities might also be due to the prospects of finding critical vulnerabilities that facilitate remote unauthorized access in the context of the client application," Ahmad wrote.
Microsoft was right to turn off many ActiveX controls.
Ahmad attached a "Part 1" to his post, which raises the question, "What next?" Isn't the large increase in ActiveX vulnerabilities bad enough? What could be worse?
Create, Communicate, Collaborate with IT Professionals at Ziff Davis Enterprise IT Link.
Comments (6)
This is a perfect article that follows-up on the "Vista Security: A Petulant Child" simply because it justifies UAC. Just like in my comment, "today's ever-increasing threats" (just what this article states) demand Microsoft action and UAC is a perfect response. By raising the bar via having many limits on the user and developer (security-wise), companies will have to fnially get their ActiveX signed and start building apps that are not going to be hassling the consumer. It's going to take extra work on everyone's part, but it needs to be done; it's the only way that Windows essentially becomes more secure and companies can deliver a better experience.
Posted by Mario | January 17, 2007 12:25 AM
Are these really "ActiveX" issues, or issues with the software written - which just happens to be ActiveX?
I mean if I wrote buggy application software that crashed the operating system, an informed person wouldn't say that the OS was the problem, they'd say it was the app.
Posted by Big Fuzz | January 17, 2007 2:01 PM
> Are these really "ActiveX" issues, or issues with the software written -
They're ActiveX issues, because ActiveX technology is supposed to provide an isolated process area in which to run, and they shouldn't have access to any memory or disk or hardware resources that could cause the operating system to crash. If they do cause such a crash, then they accessed something they weren't supposed to be able to, and that's a vulnerability.
Posted by jeffcogs | January 17, 2007 4:40 PM
It can also be argued that the OS should not be allowing the ActiveX access to any memory or disk or hardware resources that could cause the operating system to crash.
Posted by Amusedgeek | January 23, 2007 1:25 PM
ActiveX, by its nature and design, is fundamentally security flawed. The "Security" in ActiveX is that the vendor signs the component, saying "I promise that this will not do any harm"
In addition to poorly coded and poorly designed controls, the ActiveX system does not block the control from using or accessing resources on the computer. In fact, anything the user account that is running the browser can do, the ActiveX control can do - read any file the user can, write any file the user can, update any software, etc.
What makes this worse is that the user, when running as Administrator, can actually update the operating system via ActiveX - even Microsoft's Windows Update web site uses some ActiveX controls within the browser to update the OS. This means that any web site can do the same if it wishes to. And if they take the time to sign their ActiveX control, the user may not even get a security requester before it goes and does its thing.
Add to that the ActiveX controls from other vendors that have had security design flaws, and the whole ActiveX design and you get just one massive hole that should scare everyone.
Posted by Michael | January 24, 2007 6:15 AM
Microsoft DOESN'T CARE... they just need reasons to sell you more releases of "updated" os. Vista is still fundamentally flawed... the UAC is annoying and in the end USELESS because and it just puts responsibility to users... and eventually users will click ok to all UAC request. It's totally useless if the sw vendors writes a program that vulnerable. It's a blame game for MS, they are just pushing responsibility of security to users and sw vendors (they think just making someone "sign" and activeX control will keep vulnerabilities out). Windows update uses ActiveX to get users to "THINK" it's secure. With all the resources that MS has, they can simply make a proprietary secure connection just for windows update.
I'm sure MS just makes their employees "sign" ... "I will not steal information from company" and let them work there without 24/7 watch...
Posted by steve | January 24, 2007 10:12 AM