Re: [Full-Disclosure] Origin of the term "driveby download"

From: Thor Larholm (lists.netsys.com@jscript.dk)
Date: 01/31/03

  • Next message: Brian McWilliams: "[Full-Disclosure] Re: Origin of the term "driveby download"" 
    From: "Thor Larholm" <lists.netsys.com@jscript.dk>
To: "Richard M. Smith" <rms@computerbytesman.com>, <full-disclosure@lists.netsys.com>
Date: Fri, 31 Jan 2003 16:29:50 +0100

    From: "Richard M. Smith" <rms@computerbytesman.com>
    > Yes, there is ActiveX warning message for a driveby download, but I
    > think it is classic "blaming the victim" to call users who click the yes
    > button as "stupid".

    The term "driveby download" heavily implies an automated install process,
    but we all know that there is no such automation here - the user has to
    explicitly consent.

    Because of this FUD term, articles such as
    http://wired.com/news/infostructure/0,1377,57467,00.html has sentences like
    this:

    "And the toolbar will install itself automatically when Internet Explorer's
    security settings aren't set to the highest level."

    As we all know (if you didn't know, then now you do), signed ActiveX
    components require explicit user consent before installing - on anything
    except the very MINIMUM security settings. The default settings, heck even
    lowered settings above the minimum (there are 4 default levels of settings),
    will ask for explicit consent.

    As such, could we please avoid using that term? It is confusing at best and
    havocing for (otherwise fruitfull) debates at worst.

    Navigating your browser to an arbitrary website can bring up an "Open/Save
    file" dialog for an EXE file, but just because a large percentage of
    clueless users click the Open button does not mean that we label the process
    as a "driveby download", or any such FUD term. Lack of clue in the victim
    does not impose a lack of security in the product.

    And on the topic, both the "No" button (for signed ActiveX) and the "Save"
    button (for file dialogs) are the default active buttons - in case you just
    press Enter/Space.

    > If an ActiveX control auto-installs without a security warning, then
    > most likely security settings must be messed up.

    If an ActiveX control auto-installs without a security warning, then you
    have set your security settings to the lowest possible.

    Regards
    Thor

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    Relevant Pages

    • RE: [Full-Disclosure] Origin of the term "driveby download"
      ... > Yes, there is ActiveX warning message for a driveby download, but I ... explicitly consent. ... As we all know, signed ActiveX ... except the very MINIMUM security settings. ...
      (Full-Disclosure)
    • Re: Unable to download/run ActiveX controls
      ... Your current security settings prohibit running Active X ... Test Your ActiveX Installation ... change the security settings for this zone? ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • RE: Active X error attempting to connect to RDP through RWW
      ... I understand that when you select a computer in RWW ... browser is going to attempt to download a Microsoft Remote Desktop ActiveX ... Remote Web Workplace requires the Microsoft Remote Desktop ActiveX control. ... Your browser's security settings may be preventing you from downloading the ...
      (microsoft.public.windows.server.sbs)
    • Re: Remove security for local hard drive
      ... but it again depends upon the security settings for the Internet ... > Window XP Shell/User ... (Runs a Script, Installs an ActiveX control, ... > "Mark Alsop" wrote in message ...
      (microsoft.public.windows.inetexplorer.ie6.browser)
    • Re: ActiveX Problem
      ... You may have other software installed that is blocking ActiveX content. ... You may have used SpywareBlaster to install kill switches in the registry ... so certain ActiveX controls will not run, and you've hit one of those ... Your current security settings prohibit running Active X ...
      (microsoft.public.windows.inetexplorer.ie6.browser)