Slashdot Mirror
Brian Hook on the ActiveX Experience
Obiwan Kenobi writes "Brian Hook of id software fame got around to developing on ActiveX and found some minor grievances, particularly in the security department. To quote: "I've been doing some ActiveX coding on the side for a couple days, stuff I'm not familiar with, and I'm just flat out _appalled_ at how bad that entire API and design is. I can make an OCX that basically formats your hard drive, stick it on a Web page with a tag, and if your security settings are set low enough, you'll start formatting your hard drive the minute you visit my Web page.""
Does he mean the settings low enough to actually use it on the internet?
Why not just create a "zone" hopper, then he doesn't have to worry about your settings. Better yet, just use one of the existing ones.
A computer once beat me at chess, but it was no match for me at kick boxing. Emo Philips
TO elaborate, this has been an issue ever since the very first active X control was invented. No default installation of Intercrappy explorer has every allowed unsigned active x controls to auto-install for this very reason. The issue pre-dates IE 4 (3 as well afaik.)
Loading...
I think he's more famous for creating glide when he was at 3DFX
Active X was never meant to be completely secure. It was designed to be faster and more powerful then Java. And it is that, faster because all the code runs natively with no virtual machine, and more powerful because all those annoying security designed are non existent. That is why it is so widely used. And that is why IE systems are full of spyware, that are spamming everyone! But during this time in the late 90s. IT wasn't thinking of security. And why should they. Hacker only came in on non firewalled systems. Downloading an untrusted active X control is just like downloading any other program be it a trogon or a virus, these usually worst case just messed up your files or in nasty cases put bad sectors on your disk (But I think that is an urban myth, I haven't studied virus that much to know for sure). So that was a user error. And with Windows 95 and 98 as a primary OS they already had access for mess up the drive from the system anyways. So while a lot of people were going THINK OF SECURITY MAN! They just go well it is faster then java plus I easily save files to the disk. I am using this.
The move to a strong security model just started to really happen by the year 2000 when common people started getting high-speed internet access at less cost then the companies are paying for their T1 lines. Then they started clamoring to make everything secure but because they laid off the bulk of their IT employees they became under manned to fight security. So it is now a long slow process of building up IT security.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
...I can tell you you can create some pretty cool stuff in a short time.
Like a webpage that formats your hard drive!
A signed control can come from anywhere, too. A lot of spyware is signed.
He's added a disclaimer at the top of his post since the slashdotting:
[[EDIT:
Since I've been slash-dotted on this -- good lord, it's a forum post to an obscure Web site -- I wanted to address some "issues" that people have brought up:
1. I don't know ActiveX programming very well at all. I'm no expert. I'm just pointing out the flaws. It's a useful and interesting technology, it's just dangerous as fuck as well. That's all I'm saying. No, this isn't news, but I didn't intend this forum post to become news to the Web. It's one step removed from a blog.
2. I wasn't trying to write some expose for slashdot or the community at large, I was mostly writing it down for the regular readers of my site who are, by and large, more like friends than they are "readers" or "community members". It wasn't intended to be some revelatory "OMG!!!" moment directed at the world.
3. I highly doubt what I've "revealed" here is news to virus and spyware authors, since they've been writing spyware like this for years now.
4. I use FireFox (and before that, Mozilla, and before that, IE with hardcore security settings), which is why I never realized the extent of ActiveX's stupidity.
5. I haven't worked at id in five years. If that's the only reason to print my comments...don't.
END OF EDIT]]]
Not to put too fine a point on it, IE defaults to _not_ running ActiveX controls without your permission. It clearly says that an ActiveX control can destroy your machine if it wants.
You seem to be missing the fact that ActiveX is designed to allow you complete access to a machine. Whilst a better access rights model should be in there, it does mean things like Windows Update work with little user intervention. There's certainly no lack of useful sites that use ActiveX - for example, Trend Micro Housecall. They need unrestricted access to do their job.
I know this is Slashdot and its our job to bash Microsoft, but please put the technology into context. ActiveX having unrestricted access became a problem because of Internet Explorer, not because the technology itself is fundamentally flawed.
Not to sound trollish but the same applies with Unix.
Ask any VMS or MVS administrator?
The problem deals with C and C++ where length is not always checked or enforced which creates buffer overflows.
MacOS (not MacOSX) was used by the military as a secure platform because Pascal does bound checking before any data even goes into a buffer.
VMS is written in Modula so its not vulnerable either.
http://saveie6.com/
The default button (which I think is "Ok") will let the thing run.
The default button is and always has been "NO".
When ActiveX was first announced in the 90's people complained about it's lack of security model. ActiveX was MS's answer to Java applets. Problem was that Java was built from the ground up with security in mind. The security model runs applets in a constrained (sandbox) environment to eliminate the threat of malware. ActiveX initially had no security model. Early on, when complaints were voiced MS added code-signing putting the onus on users to distinguish between legitimate code and malware.
Over the years, the view of the critics have proved accurate. Java applets have had a few security problems - usually related to buffer overflows in the VM. ActiveX has been and continues to be a security disaster.
[Insert pithy quote here]
My wife isn't terribly computer savvy (at least, she wouldn't be if she weren't married to a CompSci person), but she's perfectly content with Mac OS X asking for her password before updating system software. It's an immediate red flag that something important is about to happen, and I think she'd be extremely hesitant to type it in response to clicking on a link to a web page.
Dewey, what part of this looks like authorities should be involved?
The original poster wrote: if it's security infrastructure is sufficiently loose. I say we ask Taco to unban him in light of this new evidence.
Vino, gyno, and techno -Bruce Sterling