COMMAND

    ActiveX

SYSTEMS AFFECTED

    Systems running ActiveX

PROBLEM

    ActiveX  is  an  attractive  technology  that  many  of you may be
    tempted to use  through your Web  browser. This is  fine and dandy
    if you trust every single site on the net that you visit. But,  if
    you're like most of us who  surf blindy from site to site  looking
    for new and exciting things, you just may be asking for trouble.

    ActiveX inherits the permissions of the user logged on locally  to
    the machine the controls run  on. In other words, if  your browser
    supports  ActiveX  and  you  have  this  feature enabled, then the
    control has the same authority you do. If you have  administrative
    rights,  so  do  the  ActiveX  controls  --  which  can be a nasty
    problem.

    There has  been a  great deal  of talk  about how ActiveX controls
    can be written to do  malicious things on the Internet.   However,
    what  has  not  being  recognized  is  that  even standard ActiveX
    controls  can  be  made  to  do  malicious  things  via  HTML  and
    VBScript.   Here  are  two  simple  examples  of  "good"   ActiveX
    controls being made to do "bad" things:

        The computer crashing URL - file:///aux

    If Microsoft's ActiveMovie  control is told  to play a  movie from
    the URL  file:///aux Internet  Explorer will  go into  an infinite
    loop under Windows 95.   Attempting to shutdown Internet  Explorer
    by doing an "End Task" will more often then not crash Windows  95.
    This bug can be exploited by  the "bad guys" to create HTML  pages
    that will crash people's  computers when the pages  are downloaded
    from a web site.

    Even  more  worrisome  are  ActiveX  controls that contain methods
    (i.e., function calls) that write  files to disks.  These  methods
    can be used by a  simple VBscript program to overwrite  key system
    files like AUTOEXEC.BAT, CONFIG.SYS,  REG.DAT etc.  The  damage is
    done simply  by viewing  an HTML  page that  contains the  ActiveX
    control  and  the  malicious  VBScript  code.   I know of at least
    three commercially  available ActiveX  controls that  have methods
    that will save files to disk.   Any of these controls, I  believe,
    can be exploited to  build a disk crash  HTML page.  At  least two
    of these  controls have  valid Authenticode  digital signatures so
    that they can be  automatically downloaded and executed  even with
    the highest security settings in Internet Explorer 3.

SOLUTION

    Disabled  all  ActiveX  scripts,  controls,  and  plug-ins on your
    browser. Then when you're certain  that a site is safe,  turn them
    on ONLY while  surfing that site  - and turn  them back off  again
    when you're done. Do the same thing for Java and Javascript too.