CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web

2.3.4.1  Java Script 1 2 2.3.4.3  Buffer Overflows

ActiveX and Digital Signatures

In the ActiveX model, the programmer can write code to do whatever they please. The emphasis is not so much on prevention (since a control downloaded from any arbitrary web site is free to do whatever it wishes on the user’s computer), as it is on using digital code signing (discussed in 2.3.4.5) to enable a victim of an ActiveX-based attack to determine who was responsible for it and to go after them. Think of this process as a digital signature to verify the origin of the component. This is not necessarily the best model for secure client/server communications in situations where the client has any reason to distrust the server (read: most Internet web browsing).

One reason this doesn’t help security much is that there are plenty of things an ActiveX control can do to compromise the security of a client machine (like read data off the user’s system and send it up to a web server), that users typically cannot even detect – what good is accountability, if users never suspect there’s a problem? The other reason is that while digital signing guarantees that someone proved their identity to the some certifying organization, there’s no guaranteeing that the certifying organization was someone other than a random geek in a basement with a signature-generating program on his PC, or that the user will even bother to check to see that the source of the digital signature was a respected site.

Because ActiveX controls are distributed to client machines as compiled code which is effectively unreadable by curious users (as opposed to Java Script’s text or Java’s somewhat-reversible “byte code”), they provide an additional level of intellectual property security – it’s more difficult for someone to steal your fancy new button lighting effect and adapt it for their own purposes, if they can’t see the code.

Update --- Bagle Worm Variant released in March, 2004 is in email that is not an attachment.²¹⁷

2.3.4.1  Java Script 1 2 2.3.4.3  Buffer Overflows