[ insider_reports_insider ]
ActiveX Undermining IE Security
David Utter
Staff Writer
2007-03-26
 Insider Reports RSS Feed
Although ActiveX is part of Microsoft's components beyond the Internet Explorer browser, its place in IE has made it an ongoing concern for users and security companies.
 | | ActiveX Undermining IE Security |  |
Attackers have grown to love ActiveX controls, with a variety of exploits and other malware using it as a conduit into the PCs of users worldwide.
Symantec saw a big increase in attacks aimed at ActiveX through the second half of 2006. Just as Internet Explorer has the dominant share of the browser market, it also draws the lion's share of attacks coming at it.
Joe Blackbird blogged about the ActiveX issue at Symantec's Security Response blog. It doesn't bode well for the latest version of Microsoft's browser, IE 7:
Internet Explorer 7 attempts to deal with these issues by disabling ActiveX controls by default. Unfortunately, I am not sure that this type of solution will work all that well in the Web browser environment.
The problem is that disabling functionality reduces usability; things that people once did with their browser are no longer possible. Most people are frustrated by security features that restrict usability.
As a consequence, people will probably simply enable ActiveX controls, and then their security will likely be compromised.
Similar concerns have been raised about the new User Access Controls in Vista, Microsoft's latest iteration of the Windows operating system. Familiarity breeds contempt, so the saying goes, and people may be tempted just to click away pesky boxes when they can.
If that happens in IE with people accepting ActiveX requests as they come in, coupled with visiting less-than-reputable websites, the security problems we have been seeing in recent years keyed by such activity will continue. Although Blackbird cast the issue of browser security as one that Microsoft will likely fail, it doesn't help that a multitude of users work against Microsoft through bad habits, either.
---
Tags: ActiveX, Internet Explorer, Microsoft
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
