ActiveX Control and IE7 Security Analysis

Http://www.solnet.cn/showart.asp? Id = 6
Http://support.microsoft.com/kb/161873/en-us
Http://www.microsoft.com/china/MSDN/library/NetComm/ActiveX+Security.mspx? MFR = true

ActiveX is dangerous. Why are XMLHttpRequest and mediaplayer created in ActiveX mode? Originally, this was because all these ActiveX components declared themselves as script-safe,
The intermediate security settings of ie allow creation of scripts-safe ActiveX without warning.

How does ie know that a plug-in is script safe? It uses the following two methods.
First, check whether the ActiveX component implements the IObjectSafety interface and returns the Script Security;
The second is to check whether the ActiveX component has implemented catid_safeforinitializing and catid_safeforscripting in the component category manager of the Registry.

For details, see the msdn article:

About iobject safety extensions for Internet Explorer (http://msdn2.microsoft.com/EN-US/library/aa768181.aspx)

Safe initialization and scripting for ActiveX Controls (http://msdn2.microsoft.com/EN-US/library/aa751977.aspx)

An ActiveX component cannot be declared as script-safe at will. What should I do if I am used? This ActiveX component can be used by any website as long as it is registered in the system, which may be used to harm the interests of users. Therefore, as a responsible developer, you must think twice before declaring your ActiveX components as Script Security. Is it possible for others to use them maliciously? Especially for components that have access to local resources, be careful not to destroy user data or steal information.

So, you must take a look at this msdn article: Designing Secure ActiveX Controls (http://msdn2.microsoft.com/EN-US/library/aa752035.aspx)

Although Microsoft has taken the above measures, there are security risks. For example, to check whether the ActiveX component supports the IObjectSafety interface, you must first create the ActiveX component.
Before you find that it does not support IObjectSafety, the related dll will be loaded and the initialization code has been executed. Tian knows whether the ActiveX components will have any security risks after they are created, even if they do not,
It is also a waste of system resources.

In the following article, IObjectSafety and Internet Explorer (http://www.securityfocus.com/archive/1/391803) puts forward some suggestions for improvement, and thinks that the value in component category manager should be checked first,
Because static retrieval does not need to load ActiveX components. If the registry indicates that it is safe, load and check the IObjectSafety interface.
Is this step redundant? Are you afraid someone has tampered with the registry? It is also possible. Because ActiveX components are digitally signed, the IObjectSafety interface cannot be added.
Therefore, dual protection is required.

Therefore, ActiveX still carries many security risks. Therefore, do not browse unreliable web pages to avoid troubles.
IE7 specification (http://blogs.msdn.com/ie/archive/2006/02/14/532211.aspx)
IE7 releasenote (http://msdn.microsoft.com/en-us/ie/aa740486.aspx

Http://www.microsoft.com/china/MSDN/library/NetComm/ActiveX+Security.mspx? MFR = true)

Protect Mode
Http://msdn.microsoft.com/en-us/library/bb250462.aspx#wpm_sftup

Http://msdn.microsoft.com/en-us/library/bb250462.aspx#upm

Http://support.microsoft.com/kb/240797

Http://msdn.microsoft.com/en-us/library/bb250471.aspx
Http://msdn.microsoft.com/en-us/library/bb250493.aspx
Http://blogs.msdn.com/ie/archive/2006/02/14/532211.aspx
Http://www.microsoft.com/china/MSDN/library/NetComm/ActiveX+Security.mspx? MFR = true

Control Digital Signature
Http://www.wotrust.com/support/signcode_guide.htm

Http://www.eyuansoft.com/blog/user1/1/archives/2008/2460.htm