Web Security and Commerce

Chapter 4. Downloading Machine Code with ActiveX and Plug-Ins

One of the most dangerous things that you can do with a computer that is connected to the Internet is to download a program and run it. That’s because most personal computer operating systems place no limits on what a program can do once it starts running. When you download a program and run it, you are placing yourself entirely in the hands of the program’s author.

Most programs that you download will behave as expected. But they don’t have to. Many programs have bugs in them: running them will cause your computer to crash. But some programs are malicious: they might erase all of the information on your computer’s disk. Or the program might seek out confidential information stored on your computer and transmit it to a secret location on the Internet. The program might even send threats to the president of the United States and the U.S. Congress, possibly granting you a visit from the Secret Service.

When Good Browsers Go Bad

The goal of an attacker is to be able to run a program of his choice on your computer without your knowledge. Once this ability is gained, any other attack is possible.

The easiest way for an attacker to accomplish this goal is to give or download a program to you for your computer to run. One would think that an easy way to defend against this attack would be to inspect all downloaded programs to see if they contain malicious code. Unfortunately, it’s theoretically impossible to determine what a ...