Detecting and Preventing ActiveX API-Misuse Vulnerabilities in Internet Explorer
ActiveX is used to build reusable software components in Microsoft Windows. It is widely used by many Windows applications, such as Internet Explorer and Microsoft Office. As general-purpose components, ActiveX controls expose methods to applications, which may be used in ways unexpected by the ActiveX designer, leading to malicious activities. We call such misuse of ActiveX methods - ActiveX API misuse vulnerabilities. In this paper, we present a solution which identifies and prevents API misuse of ActiveX controls in Internet Explorer. We construct models to represent normal functionality of ActiveX methods, and identify ActiveX API misuse by identifying the methods that can reach dangerous (system) APIs. We then develop a technique for Internet Explorer to prevent the use of dangerous ActiveX methods. We evaluated our approach on six real-world ActiveX controls. We are able to identify and prevent ActiveX API misuse in these controls. Our approach is effective in detecting ActiveX API misuse and has negligible overhead for preventing attacks.
Unable to display preview. Download preview PDF.
- 1.Luk, C., Cohn, R., Muth, R., Patil, H., Klauser, A., Lowney, G., Wallace, S., Reddi, V., Hazelwood, K.: Pin: Building Customized Program Analysis Tools with Dynamic Instrumentation. In: ACM SIGPLAN Conf. on Programming Language Design and Implementation, pp. 190–200 (2005)Google Scholar
- 2.Wu, Y., Yap, R., Ramnath, R.: Comprehending Module Dependencies and Sharing. In: ACM/IEEE Intl. Conf. on Software Engineering, pp. 89–98 (2010)Google Scholar
- 3.Dormann, W., Plakosh, D.: Vulnerability Detection in ActiveX Controls through Automated Fuzz Testing (2008), http://www.cert.org/archive/pdf/dranzer.pdf
- 4.Song, C., Zhuge, J., Han, X., Ye, Z.: Preventing Drive-by Download via Inter-Module Communication Monitoring. In: ACM Symp. on Information, Computer and Communications Security, pp. 124–134 (2010)Google Scholar
- 8.Chen, H., Wagner, D.: MOPS: an Infrastructure for Examining Security Properties of Software. In: ACM Conf. on Computer and Communications Security, pp. 235–244 (2002)Google Scholar
- 9.Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.: Automated Generation and Analysis of Attack Graphs. In: IEEE Symp. on Security and Privacy, pp. 273–284 (2002)Google Scholar
- 10.Jha, S., Sheyner, O., Wing, J.: Two Formal Analyses of Attack Graphs. In: IEEE Computer Security Foundations Workshop, pp. 49–63 (2002)Google Scholar