Return to Article List » Security Risks

Are ActiveX controls a security risk?

In general, ActiveX controls are not a security risk. However, like almost anything online, there are some things you need to be aware of and precautions you should take.

ActiveX controls are either signed or unsigned.
Signed ActiveX controls feature a digital signature, which indicates the company that made it and shows that it has not been tampered with since publication. Services such as VeriSign check the authenticity of these signatures.

Unsigned ActiveX controls do not have the same information. You can check if an ActiveX control is signed by clicking "Tools" and then "Manage Add-ons".

ActiveX controls can add great multi-media effects and interaction to websites. As well, they can be programmed in various languages and easily downloaded to Internet Explorer.

This kind of flexibility is one of ActiveX's strongest attributes. Unfortunately, it can also be an ActiveX flaw.

Cyber criminals have in the past taken advantage of ActiveX. Instead of adding functionality to a website, their malicious programs have collected people's personal information, kept track of their browsing habits, bombarded them with pop-up ads and other dirty deeds. Unlike signed ActiveX controls, these programs also can interfere with web browser and PC performance.

While many ActiveX controls are safe, you do need to protect yourself and your PC.

When working with ActiveX controls please consider:

• Ensuring it is a signed ActiveX control and, if you are familiar with these sorts of things, that the publisher is one you trust.
• If the website you are installing it from is one that you feel is likely safe.
• Having anti-virus or anti-spyware software installed. This is important not just for ActiveX controls.
• Checking that your security settings are at the default. If they are higher it can sometimes block legitimate ActiveX controls. Using the default settings can help protect you. To do so, go to "Tools" in your Internet Browser and select "Internet Options". Click on the "Security" tab. If Internet is not selected, click on the icon. Click "Default Level" and "Apply".

Internet Explorer will display an Information bar near the top of the webpage. It presents information about blocked pop-ups, downloads, security and other browser activities. Sometimes the Internet Explorer Information bar will flag ActiveX controls and ask if you want to run them. If the ActiveX control is signed and you trust the site, click to run the control.

Use our Wizard to see if Internet Explorer is configured to run signed ActiveX controls.Back