3

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic impacts could be if we run unsigned software, such as having client-side code being execute on the browser.

My questions are:

  1. Is this acceptable, first of everything, from a security standard (i.e. accepting an unsigned software)?

  2. Does the fact that none of our users have admin privileges on their machines mitigate the risks of running unsigned software?

  3. Is it possible to allow the unsigned ActiveX only for that software, but not for everything else?

  4. Does 'being signed' really mean more secure? I mean, it's signed, so what?

Any pointers to further reading would also be much appreciated.

1

I'll have a shot at addressing this one.

Is this acceptable, first of everything, from a security standard (i.e. accepting an unsigned software)? Accepting unsigned software that is trusted for some other reason in itself isn't an issue. Accepting ActiveX isn't considered acceptable at all. I'd suggest running the browser that uses ActiveX within its own virtual machine with some fairly harsh isolation settings.

Does the fact that none of our users have admin privileges on their machines mitigate the risks of running unsigned software? Not really, anything accessible to the user level will still be fair game. The lack of admin rights just means that a few things will stay out of reach unless an avenue for privesc can be found.

Is it possible to allow the unsigned ActiveX only for that software, but not for everything else? Yes, you can whitelist ActiveX for that one particular domain if you so desire. I would really suggest running it inside the aforementioned virtual environment though. ActiveX is not something you want touching your systems in any way that you can avoid.

Does 'being signed' really mean more secure? I mean, it's signed, so what? Not really. Anyone can buy a code signing certificate with minimal scrutiny. The cheapest I could find is $70 and promises to be issued within 20 minutes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.