Pass your certification exam. Faster. Guaranteed.

Circumventing Access Controls Transcription

Welcome to our circumventing access controls module. In this module, we will discuss software backdoors as well as Microsoft ActiveX controls. A backdoor is also known as a maintenance hook or a trap door. These are access holes that are deliberately planted in a software program or in a system by a developer.

Typically this is done to facilitate easier testing during the production process, or to facilitate access to the system after it's placed into production. The problem with a backdoor is they can also facilitate break ins by a hacker. It's important to make sure that backdoors are always removed before you place software into production.

Malicious software or attackers can also place backdoors in systems to make it easier to access that compromised system at a later time. Microsoft's ActiveX technology was designed to allow Internet users to increase their functionality and Internet experience. It is an extension of Microsoft's object linking and embedding technology.

Security with Microsoft ActiveX controls relies on the user deciding whether or not to trust the control before it runs. The problem here is that users don't often understand the risks, and just click OK. Security also relies on Authenticode, which is a digital signature used to ensure integrity of the software and to determine who developed the software.

And this uses public key infrastructure certificates and trusted certificate authorities. ActiveX technology does not sandbox the code when it is executed, and therefore it provides a large amount of access to the system. This is why it is a popular choice for attackers. This concludes our circumventing access controls module.

Thank you for watching.