re: Is this really a vulnerability or just hype? Results of my tests, check the facts.
Tuesday, June 9, 2009 at 10:28 am
Windows Vista Annoyances Discussion Forum
Posted by lbecque
(8 messages posted)
It is true that MS has implemented a number of security procedures around ClickOnce,
which is maybe why we haven't heard about a rash of malware based on ClickOnce....yet.
ClickOnce technology appears to be very similar to executing code within a Java
VM which is a fairly secure environment.
But I think you are wrong on one point, ClickOnce applications can indeed startup
automatically with no warning to the user. I tested this myself with the links I
mentioned provided by the previous FF extension developer. Furthermore, MS security
is based on the IE security zones. The test I mentioned is in the Internet security
zone which is set to 'prompt before downloading potentially unsafe content'. Yet
when I click it just runs with no prompt or warning. It doesn't seem that MS has
delivered what they said. It would only take the slightest amount of social engineering
to get naive users to click on a link. Something like 'Click this for FREE [music,
money, sex, drugs, etc.]'
Since there are no reports of massive malware attacks using ClickOnce technology
and no warnings on the Secunia database I'm still not convinced that this is a big
threat. However, it is not a bad idea to turn on the 'prompt before running ClickOnce
applications' option in the FireFox extension. Can anyone figure out how to do the
same for IE?
|
All messages in this thread [show all]
 | |  | re: Is this really a vulnerability or just hype? Results of my tests, check the facts. (lbecque: Tue, Jun 9, 2009, 10:28 am) |
| |
| |
| |
Return to the Windows Vista Discussion Forum
|
|
