untangling_the_web

DID: 4046925
UNCLASSIFIEDh'f"6R 6f"f"leIAL US! 6NLY
More recently, malicious users have found devilishly clever ways to use ActiveX,
Java, and JavaScript to hijack browsers, or to be more precise, to hijack Internet
Explorer. The least innocuous form of browser hijacking involves changing the
browser's home page and favorites, but most browser hijackers do a lot more, from
creating endless pop-up windows to taking complete control of your browser.
Browser hijacking software also usually includes some form of spyware to monitor
and report your Internet activity. Worse, they are notoriously difficult to remove.
ActiveX has been implicated in the surreptitious installation of software known as
drive-by downloads. Drive-by downloads180 occur when a user simply visits a
website or views an HTML email. These sites exploit a vulnerability in Internet
Explorer's ActiveX to download, install, and run software on an unsuspecting user's
computer without his knowledge or consent. This type of software can also be very
difficult to remove.
Keep in mind that, by default active scripting is enabled by default in Internet
Explorer! The problem with simply disabling these controls is that you will encounter
difficulties viewing some webpages. Experiment with turning them off or, in the case
of MSIE, having your browser "Prompt" you and see what happens.
Here are recommendations for increased security settings in IE's Internet Zone
(remember, you can put sites where you need to use these controls into your
Trusted Sites Zone):
Tools I Internet Options I Security I Internet Zone I Custom Level
• ActiveX Controls and plugins
o
o
o
o
o
Download signed ActiveX controls [Prompt or Disable]
Download unsigned ActiveX controls [Disable]
Initialize and script ActiveX controls not marked as safe [Disable]
Run ActiveX controls and plug-ins [Disable]
Script ActiveX controls marked safe for scripting [Prompt or Disable]
180 "A drive-by download is a program that is automatically downloaded to your computer, often
without your consent or even your knowledge. Unlike a pop-up download, which asks for assent
(albeit in a calculated manner likely to lead to a "yes"), a drive-by download is carried out invisibly to
the user: it can be initiated by simply visiting a Web site or viewing an HTML e-mail message.
Frequently, a drive-by download is installed along with another application. For example, a file
sharing program might include downloads for a spyware program that tracks and reports user
information for targeted marketing purposes, and an adware program that generates pop-up
advertisements using that information. If your computer's security settings are lax, it may be possible
for drive-by downloads to occur without any action on your part." "Drive-by Download,"
SearchSMB.com, (14
November 2006).
530 UNCLASSIFIEDHFOR OFFlGIAb l:JS~ g~JbY