Re: Active X exploit.

[lutz () TARANIS IKS-JENA DE (Lutz Donnerhacke)]

* Paul Leach wrote:
> What ActiveX doesn't have is a sandbox. That's different than saying
> that there's no security.
>
> ActiveX controls are _signed_ DLLs. You run the code if you trust the
> signer. If you do, you know that no one has tampered with the code since
> the signer signed it.
>
> That's more secure than what I buy at the store.

Nope. Trust and Security are very different. Imagine programming errors in
controls from trustworthy programmers. (Shockwave example)

Furthermore:
  - It's easy the get a certificate for $20 per year.
  - Any CA trying to offer authenticode certificates is required to obtain
    a special agreement from Microsoft.
  - If you programm some thing malicious, the CA will revoke the certificate
    due to request from Microsoft (see above)
  - If any control damages your system, you can sue the author as long as
    the certificate is not revoked. So current practice results in helpless
    customers unable to sue anybody for the damage.
  - The current implementation of MSIE offers:
      + low     (accept anything without any question)
      + medium  (ask on uncertified controls, accept any certified)
      + high    (ask on any certified control, deny uncrtified)
    Furthermore every control is accepted withour any question, if:
      + the control was installed from any user on this system before
        (i.e. a malicious control is executed by the administrator,
         if any user accepted it before)
      + it is signed by a author the user trusts completely
      + it is signed by a author offering a certificate the user trusts
        completely (at the moment: if you trust Verisign, you trust everybody)
      + it is signed by a commercial company (denoted by a flag in the
        certificate independend from the certification authority ...)
    You are not able to distrust a company. If you try to do not trust
    Microsoft (i.e.), you will run into the problem to deny authenticode
    requests every two seconds while working at www.microsoft.com. This
    results from the fact, that denied requests are not stored.
    In consequence every user of MSIE has set the security level to low
    or medium or accepted some controls by accident.