Feb

6

ActiveX Takes Another Beating

Posted by Keith McMillan

February 6, 2008 | Leave a Comment

Earlier in the week, Symantec reported that there were new flaws found in a number of Microsoft’s ActiveX controls, and the recommendation from SANS was to disable these controls due to these problems.

Today, Symantec is reporting today (via CSO Online) that they’re already seeing exploits in the wild using the Yahoo Jukebox control:

The attack, which was first observed in the last few hours, is not widespread at present. Symantec Security Response Director Oliver Friedrichs said Tuesday that the company had identified just three Web sites that were hosting the attack code, all of which seem to be linked to the same criminals. But he believes that more attacks are inevitable as the bad guys work the code into their malicious toolkits of software.

So it’s past the academic, “yes we should do that” stage, folks: either stop using IE, or get those controls disabled. You’ve been warned.

It’s easy to pick on IE: it’s a very common platform, and it’s wealth of features and tight integration with the operating system make it an attractive target. It’s also frequently a corporate standard, so there’s that built-in base of targets as well. I’ll only point out in passing that MS hasn’t made this problem any easier by disentangling the browser from the OS.

It’s unfortunate that many web application developers take the easier road, and make their web apps such that they’re only compatible with Internet Explorer. This just forces people who might want to use a different browser to use IE as well. With this approach, you then get all the vulnerabilities of each browser.

It’s seductive to get all that power, however, so we’re back to the old continuum, secure on one end, usable on the other. You want it to do whiz-bang things, that may mean that it’s less secure as a result, or takes us an inordinate amount of work to get it going.

Of course, if you need a web application because it’s critical to your business, and that web app relies on one of those insecure controls, then you’re in trouble.


Comments

RSS feed | Trackback URI

Comments »

No comments yet.

Name (required)
E-mail (required - never shown publicly)
URI
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> in your comment.

Blogroll