Sabotage is possible because ActiveX is protected only by a system of encrypted certificates which attach to downloaded software. The certificates are intended to reassure users that the software they download is not malicious. Yet software is not tested before a certificate is issued. Microsoft says users should recognise that certificates only prove that the software's author has been registered, and that the software has not been corrupted since it was written. Microsoft admitted that false registration is not beyond criminals, 'but it is not a trivial task', Willis said.
Registration requires details of company name and credit references.
Causing Chaos On its default security settings, Microsoft's Internet Explorer Web browser automatically downloads certificated ActiveX controls, without informing the user. Uncertificated controls are only downloaded if the user gives on-screen consent. The Chaos club claims that it has written an uncertificated control which will secretly download itself onto a machine, whatever the security setting on Internet Explorer. That's not illegal,' the club said.