Martin Heller
Contributing Writer

Writing Secure ActiveX Controls

analysis
Feb 6, 20082 mins

This recent news story touches on a long-standing problem: Attackers zero in on Yahoo Jukebox's ActiveX flaw | InfoWorld | News | 2008-02-06 | By Robert McMillan, IDG News Service The fact is, writing secure ActiveX controls is an art, not a science. To succeed, a software developer has to look beyond the intended purposes of the interfaces, to other purposes for which they might be used. Say, for instance, that

This recent news story touches on a long-standing problem:

Attackers zero in on Yahoo Jukebox’s ActiveX flaw | InfoWorld | News | 2008-02-06 | By Robert McMillan, IDG News Service

The fact is, writing secure ActiveX controls is an art, not a science. To succeed, a software developer has to look beyond the intended purposes of the interfaces, to other purposes for which they might be used.

Say, for instance, that I wrote an interface to upload files to a site, intended to be run on a well-known safe site. If I had written it in a broad way so that it could be used to silently upload any file to any site, then a malicious site could detect the control and use it to upload Quicken files to steal peoples’ financial information.

One safeguard is to be noisy about what you’re doing. My ActiveX controls pop up simple OK/Cancel permission dialogs the first time they are invoked in a browser session; the dialogs say what they are going to do and what sites they were intended to work on. That’s simple, and only mildly annoying. Of course, users tend to get jaded and accept such dialogs without thinking, but darkening the screen and sounding the klaxon horn of doom probably won’t help in the long term.

Another safeguard is to actually check the site currently in use. That’s a little harder, but it’s possible. Internet Explorer supports a service called IWebBrowser2, which has an interface called get_LocationURL. This returns the URL of the calling page as a BSTR, and you can then use InternetCrackUrl from the wininet library to extract the domain and see if it’s on your white list of safe or licensed domains.

A third safeguard is to restrict the functionality of the interface. Perhaps I want the control to upload images. If that’s the case, I could restrict the file types it will upload to .GIF, .JPG, .PNG, and .TIFF. The control could also double check that the files were valid before uploading them: there’s a reason that .TIFF files all have the number 42 in a specific place.

And yes, 42 is the answer to “life, the universe, and everything.”

Do you write ActiveX controls? If so, how do you protect them from malicious use?

If you write Flash controls, how do you protect them?

Martin Heller

Martin Heller is a contributing writer at InfoWorld. Formerly a web and Windows programming consultant, he developed databases, software, and websites from his office in Andover, Massachusetts, from 1986 to 2010. From 2010 to August of 2012, Martin was vice president of technology and education at Alpha Software. From March 2013 to January 2014, he was chairman of Tubifi, maker of a cloud-based video editor, having previously served as CEO.

Martin is the author or co-author of nearly a dozen PC software packages and half a dozen Web applications. He is also the author of several books on Windows programming. As a consultant, Martin has worked with companies of all sizes to design, develop, improve, and/or debug Windows, web, and database applications, and has performed strategic business consulting for high-tech corporations ranging from tiny to Fortune 100 and from local to multinational.

Martin’s specialties include programming languages C++, Python, C#, JavaScript, and SQL, and databases PostgreSQL, MySQL, Microsoft SQL Server, Oracle Database, Google Cloud Spanner, CockroachDB, MongoDB, Cassandra, and Couchbase. He writes about software development, data management, analytics, AI, and machine learning, contributing technology analyses, explainers, how-to articles, and hands-on reviews of software development tools, data platforms, AI models, machine learning libraries, and much more.

More from this author