Date: Wed, 9 Jun 1999 12:22:00 +0100 >From: "Steve Loughran" Subject: ActiveX Security Revisited The latest Microsoft security bulletin http://www.microsoft.com/security/bulletins/ms99-018.asp ) includes two Internet Explorer patches. The first is a classic stack overrun -a web page can supply an icon for use when adding to the favourite links list, and a malformed icon could overrun the stack and so execute arbitrary code. The second fault is a security hole in ActiveX control, and is a simple instantiation of the problem covered in RISKS-18.85 and RISKS-18.86, namely than code signing is a far less safe method of software distribution than a 'sandbox' for untrusted code. It so happens that one of the ActiveX controls dating from IE3 can be used to test for the presence or absence of files on a hard disk, and while no access to the contents is granted, it can be used to build up a picture of what applications are installed. My demonstration page http://www.iseran.com/ActiveX/filesearch.html ) shows a naive script looking for common windows files in well known places -it could just as easily look for well known applications as a preamble to an application specific attack. The insecure 'Preloader' control has some interesting properties. Firstly, it is signed by Microsoft, showing that even the inventors of ActiveX and the entire Win32 API did not test their controls rigorously enough. Secondly, some distributions of Internet Explorer may have automatically installed the control, in which case the control download or signature verification process is bypassed. It so happens that the default security settings of the Outlook and Outlook Express e-mail messages, which means anyone could send a web page referencing the control to any known recipient and stand a moderate chance of being able to enumerate some disk files, possibly with no visible notification to the recipient. This strikes me as a more serious problem than the risk incurred by looking at random web pages, as it enables attacks targeted at individual recipients. Within four weeks of notifying Microsoft via their security e-mail alias the company announced the problem, and withdrew the control from their own web site, which seems a reasonable response time. Of course, if ActiveX had included a mechanism whereby the signer of a control could retroactively revoke that control then it would have been trivial to disable the control remotely. Instead the company had to patch IE to permanently disable the control. Few other companies would have this luxury. While enabling or disabling ActiveX use for web site access is entirely a matter of preference, I would personally recommend that all users of Microsoft e-mail applications alter their e-mail client security settings so that neither ActiveX or scripting language is supported in incoming messages . This can be done by setting the e-mail security zone to 'restricted'. -Steve ----------------------------------------------------------------------------- The ActiveX Hard Disk Explorer

The ActiveX Hard Disk Explorer

This page uses the ability of the preloader control to report the presence or absence of a file or url to a controlling script. It loops through a number of "Well known" files to determine information about the user's system. This information could be fed back to a web server for marketing reasons, or used to test for the presence of other security weaknesses which could be exploited.

The example script is not very smart and does not use the results of initial tests to determine further directions of investigation. For example, even if the absence of the file c:\boot.ini reliably indicates there is no version of NT installed, the script still looks for the OS in common locations. The results of individual tests are stored, and could be used for better searching, or could be fed back to a server with ease.

Examining the source shows how this is could be accomplished. Oh, and if you mail this to someone who uses Outlook to read their mail, guess what happens when they get it? Recipients will have to be grateful this file search is not done after a page load, and that the results are not sent back to the server.

June 1999: Within a few weeks of notifying Microsoft the errant control has been removed from their site, although there is nothing to stop mischevious web site authors from serving the control locally, as is done here. A patch to IE actually disables the control for good.

The ActiveX Hard Disk Explorer

Run the Test