Malicious Add-Ons

Malicious Add-Ons: There are any numbers of add-ons that have the potential to harm a system. Some do so unintentionally through poor programming, and some are truly malicious add-ons; the difference between them is intent.

Consider a Java applet, for example. This is a small, self-contained Java Script that is downloaded from a server to a client and then run from the browser.

The client browser must have the ability to run Java applets in a virtual machine on the client. Java applets are used expensively in web servers today, and they are becoming one of the most popular tools used for website development.

Java-enabled applications can accept programmed instructions (Java Scripts) from a server and control certain aspects of the client environment.

Java requires you to download a virtual machine in order to run the Java applications or applets. Java scripts run on the clients.

The applets run in a restricted area of memory called the sandbox. The sandbox limits the applet’s access to user areas and system resources. An applet that runs in the sandbox is considered safe, meaning that it won’t attempt to gain access to sensitive system areas.

Errors in the Java virtual machine that runs in the applications may allow some applets to run outside the sandbox.

When this occurs, the applet is unsafe and may perform malicious operations. Attackers on clients systems have exploited this weakness.

From the user’s standpoint, the best defense is to make certain that you run only applets from reputable sites with which you are familiar.

From an administrator’s standpoint, you should make certain that programmers adhere to programming guidelines when creating such applets.

Similarly, ActiveX is a technology that was implemented by Microsoft to customize controls, icons, and other features, which increases the usability of web-enabled systems. ActiveX runs on the client. It uses a method called Authenticode of security.

Authenticode is a type of certificate technology that allows ActiveX components to be validated by a server.

ActiveX components are downloaded to the client hard disk, potentially allowing additional security breaches.

Web browsers can be configured so that they require confirmation to accept an ActiveX control.

However, many users don’t understand these confirmation messages when they appear, and they automatically accept the components.

Automatically accepting an ActiveX component or control creates the opportunity for security breaches on a client system when the control is used because an ActiveX control contains programming instructions that can contain malicious code or create vulnerabilities in a system.

NOTE: We highly recommend that you configure browsers so that they do not allow ActiveX to run without prompting the user because of the potential security hole that could be opened.