Windows Secrets Newsletter • Issue 163 • 2008-08-07 • Circulation: over 400,000

By Scott Dunn Don’t count on Microsoft to shut down ActiveX vulnerabilities when they arise, as Microsoft Access users learned last Patch Tuesday when the company had no fix to offer for a leaky ActiveX plug-in. ActiveX security holes appear all the time, so you need these tips and tools to keep your system safe from flawed or malicious Internet Explorer add-ins.

An explosion in the number of ActiveX exploits

Microsoft designed ActiveX back in 1996 as a way to share data, run applications, and display animations in Internet Explorer. While Windows has some ActiveX components of its own, most ActiveX controls must be downloaded separately to access all of the functions on a Web site that relies on them.

Unfortunately, malware producers make ActiveX controls that spy on you and pull other dirty tricks. Also, otherwise-harmless ActiveX elements are exploited by hackers to attack users’ systems. That’s what happened with the recent vulnerability in the Snapshot Viewer function of Microsoft Access, as reported in Network World.

In recent years, the number of ActiveX vulnerabilities has grown exponentially, according to a study published last year by Symantec.

In 2006 alone, researcher H.D. Moore identified more than 100 vulnerabilities in the ActiveX components built into Windows XP and nearly 100 others in controls that ship with Microsoft Office and other mainstream applications, according to a SecurityFocus report written by Robert Lemos. This was just a few months after Microsoft had released ten patches for IE, including one for ActiveX itself.

Just enter activex on the Windows Secrets search page to find numerous examples of ActiveX problems and patches in the past few years.

Protect yourself against flawed ActiveX controls

With new ActiveX risks popping up several times a year, how can you protect yourself from security problems related to this technology? Here are several steps to consider.

Switch browsers. Since IE is one of the few browsers that rely on ActiveX, you can easily avoid problems related to the controls by using a different browser, such as the free Firefox 3 or Opera 9.5.

These IE alternatives are not free of security issues of their own, of course. But Microsoft’s policy of releasing patches only on one Patch Tuesday each month means that when a problem is discovered, a solution may be weeks away.

Turn off ActiveX. To deactivate ActiveX in IE, choose Tools, Internet Options, Security. Click the Custom level button at the bottom of the dialog and select Disable for every item listed under “ActiveX controls and plug-ins.” Click OK twice and restart IE.

Of course, disabling ActiveX may cause some functions on a Web page not to work properly. Also, some corporate intranets require ActiveX, so you may need to change these settings back to use all the features on those sites.

For additional ways to tweak IE for safety, see Brian Livingston’s tips from the Oct. 26, 2006, issue.

Fine-tune your ActiveX management. Turning off all ActiveX functions in IE is something of a sledgehammer approach. For a more surgical solution, use a product that deactivates only selected ActiveX controls. I took three such utilities for a test drive: Errata Security’s AxBan and two programs from Nir Sofer: ActiveX Compatibility Manager and ActiveXHelper.

All three programs are free, standalone executables, which means there’s no installation required. All three also let you select and disable or enable a given ActiveX component, including the ability to turn off Snapshot Viewer’s ActiveX control, which is the unpatched Access vulnerability I mentioned above.

In addition to checking for the Snapshot Viewer problem, I tested whether the programs let me disable the Flash ActiveX object. AxBan passed this test, as did ActiveXCompatibility Manager. However, I had to manually add the entry to the latter program before I could disable it. ActiveXHelper displayed the Flash object by default but failed to disable it.

#1: ERRATA SECURITY AXBAN

Free version 80 More info

View only the controls you need to worry about

AxBan, which Ryan Russell described in his July 3rd Perimeter Scan column (paid subscription required), lists only ActiveX components that have been known to cause problems or have vulnerabilities in the past. Problematic items that are installed on your system and still active are highlighted in red.

Although AxBan uses a format similar to Windows Explorer’s Details view, you can’t sort its list of controls nor search for specific items. What you see is what you get.

You can disable or enable items by editing the Registry using a technique called a “kill bit,” which is described in Microsoft Knowledge Base article 240797. Unfortunately, AxBan doesn’t give you granular control over these items: Your only option is to disable all red-highlighted items at once by choosing the KillBit All button.


Figure 1. Disable problematic ActiveX controls via AxBan’s KillBit button.

You can re-enable individual items by selecting one and clicking Unkillbit Selected. Unfortunately, multiple selections aren’t allowed, so if you want to disable only some controls, make a note of the ones you want to re-enable later before you click the KillBit All button (which also removes the red highlight).

Despite its clumsy controls and interface, AxBan is the best choice for the average user because it presents a manageable list of known items only rather than overwhelming you with a huge roster of all the ActiveX controls in your Registry.

#2: NIRSOFT ACTIVEX COMPATIBILITY MANAGER

Free version 75 More info

A less-exhaustive list of troublesome controls

ActiveX Compatibility Manager presents a database of ActiveX components that can be disabled or enabled using the same kill-bit technique as AxBan.

As in Windows Explorer, you can sort the list by clicking column heads for File Description, Company, Filename, and other categories. Without this capability, it would be difficult to locate just the controls installed on your system (items that are not installed lack these names and descriptions).

The program’s list of ActiveX components is not exhaustive, however, as shown by the feature that lets you add new entries just by entering class IDs in the Registry. Class IDs are a series of numbers and letters, as distinguished from the more prosaic program IDs (for example, ShockwaveFlash.ShockwaveFlash). It wasn’t clear to me why Flash and other popular items aren’t on the list to start with.

In addition to adding items, you can search, delete, and copy controls to the Windows clipboard. To enable or disable controls, simply select one or more items, click the green (enable) or red (disable) buttons on the toolbar, and restart IE.

#3: NIRSOFT ACTIVEXHELPER

Free version 70 More info

This control killer is undone by media players

ActiveXHelper shares many features with Sofer’s ActiveX Compatibility Manager, including the ability to search, sort, copy, enable, and disable controls. Unlike ActiveX Compatibility Manager, however, ActiveXHelper prompts you for the source of items to list each time. The program can list items found in the Registry’s HKEY_CLASSES_ROOTCLSID key or show a custom list or text file.

In my tests, I was unable to use the product to disable Flash ActiveX controls. Clicking the Disable button neither changed the Enabled status listed in the window nor affected the use of Flash in IE. Consequently, I can’t recommend this utility.

If you can’t bring yourself to give up Internet Explorer or its ActiveX technology, I recommend you (cautiously!) try a tool such as AxBan or ActiveX Compatibility Manager.

But whatever your strategy, always keep your browser and other network-connected software patched with the latest security updates, as recommended here in Windows Secrets. Note, however, that you needn’t be in such a hurry to update Windows itself, as Susan Bradley described in her July 24th Patch Watch column (paid subscription required).

Readers receive a gift certificate for a book, CD, or DVD of their choice for sending tips we print. Send us your tips via the Windows Secrets contact page.

Scott Dunn is associate editor of the Windows Secrets Newsletter. He has been a contributing editor of PC World since 1992 and currently writes for the Here’s How section of that magazine.