Security Response

Earlier this year I wrote a series of poststhat highlighted the rise in vulnerabilities affecting ActiveX controlsduring 2006. I mentioned that there had been an increase in the numberof ActiveX vulnerabilities over the last six years, but moreimportantly there had been a significant rise in 2006. The first halfof 2006 saw the release of 12 vulnerabilities, while there were morethan 40 vulnerabilities in the second half.

I also stated that although 2006 saw a significant increase in thenumber of vulnerabilities in ActiveX controls, this trend would likelycontinue in 2007 due to the availability of tools and increasedinterest in ActiveX security in the community. The analysis of thethreat landscape during the first half of 2007 supports thisprediction. It also appears that issues affecting ActiveX controls makeup almost 89% of all vulnerabilities that were reported in browserplug-ins.

According to the...

In my previous post,I talked about the sudden rise in vulnerabilities affecting ActiveXcontrols. In this post, I would like to talk a bit about the technologybehind ActiveX and various steps that may be taken to prevent attacks.

An ActiveX control is essentially an Object Linking and Embedding(OLE) object. OLE allows objects to be shared using Component ObjectModel (COM) technology, which is a model that permits softwarecomponents to communicate with each other. Distributed COM (DCOM) is anextension of COM that allows for the sharing of components over anetwork. ActiveX technology essentially facilitates the functionalityof OLE on the World Wide Web. The controls can run on platforms thatsupport COM or DCOM.

According to Microsoft, ActiveX controls must provide an interface named “...

The year 2006 saw the rise of numeroussecurity trends such as attacks against social networks, initiatives byresearchers to sequentially disclose many flaws in Web browsers andoperating system kernels, attacks being used for financial gain, and adramatic increase in the number of vulnerabilities affecting Webapplications. During the last few months of the year, I have noticedanother trend that did not receive much attention. There has been asignificant increase in the vulnerabilities that affect ActiveXcontrols. These vulnerabilities can facilitate an assortment of attacksthat may simply cause the disclosure of sensitive information to anattacker or, in the worst-case scenario, allow them to execute code togain unauthorized access to an affected computer.

During the last few years there has been an increase in the numberof vulnerabilities affecting ActiveX controls shipped by variousvendors. In the year 2001, DeepSight Alert Services reported a...