Microsoft Download Is Designed to Safeguard ActiveX Controls in IE

Microsoft has made available for download a free template designed to safeguard ActiveX controls in Internet Explorer. SiteLock Template for ActiveX Controls will enable developers to make sure that the content built for legitimate websites cannot be repurposed by third-parties and leveraged in malicious actions. Internet Explorer comes complete with a default security model for ActiveX controls. For websites running inside Microsoft's proprietary browsers, controls are labeled either as "safe" or "unsafe". It is clear that any webpage will be able to access a "safe" control, while Internet Explorer will automatically block "unsafe" ActiveX items.

"The SiteLock Active Template Library (ATL) template enables ActiveX control developers to restrict the use of an ActiveX control to a predetermined list of domain names or security zones. This limits the ability of other Web pages to reuse the control. For example, you can use the SiteLock template to ensure that an ActiveX control developed for use within your Local Intranet cannot be used by pages in the Internet zone. This helps to reduce the attack surface presented by your control-- even if it contains a security flaw, that flaw cannot be exploited by pages on the Internet because your control will refuse to run outside of your Local Intranet," revealed Eric Law, IE Program Manager.

Essentially, the SiteLock Template will verify the connection between the ActiveX control, the website hosting it and the browser's security zones. The ActiveX control will only be allowed to run if the domain and security zone of the hosting online location are "safe". Otherwise, Internet Explorer will simply unload the control. SiteLock also provides website developers with a mechanism set to permit the integration of a limited lifespan in an ActiveX control.

"The SiteLock Template replaces the standard ATL template with its own implementation of IObjectSafety, called IObjectSafetySiteLockImpl. It automatically queries the host for the URL of the Web page that is hosting the ActiveX control, extracts the protocol scheme and fully qualified domain name from that URL, and compares it to a list created by the developer at build time to see if the hosting site should be trusted", Law added.