How to Cope with Internet Scripting Annoyances

Author All Replies

ninersfan

join:2001-02-09
Hayward, CA

How to Cope with Internet Scripting Annoyances

Got this in my searchwin2000.com email newsletter today and thought it might be of interest to Security Forum readers:
---
COPE WITH INTERNET SCRIPTING ANNOYANCES
by Tom Lancaster

»searchwin2000.techtarget.com/tip···2F283640

One of the most annoying things Web surfers encounter are Web sites that open new windows by themselves, or maximize the existing window to display ads or otherwise monopolize your attention. The method usually used to accomplish this is JavaScript or ActiveX, with the former being much more common in my experience. JavaScript and ActiveX, if left unchecked can do some pretty nasty things to your
computer, particularly since there are so many exploits around. So you want to protect yourself from these potential security hazards.
However, there are so many good sites now that use JavaScript for something useful, that turning it off disables half of why you use the Internet in the first place.

Perhaps the best way to deal with this solution is the zone feature built into Microsoft's Internet Explorer, which hardly anyone ever uses. Zones are simple to understand: the "Internet" is all sites that aren't in one of the other three zones. "Local intranet" is for stuff inside your firewall or company. "Trusted sites" and "Restricted sites" are buckets for you to configure.

This is easy to do because, if you're like most surfers, you've got around 10 or 20 sites that you read every day, which are usually book-marked, then you follow links from these sites to hundreds of other sites. If this sounds like you, then click Tools -> Options and then the "Security" tab in Internet Explorer. Next, click "Trusted sites" and then the "Sites" button. Add the URLs from your bookmark page to this zone.

This allows you to set different security attributes for each of the four zones. For trusted sites, you can leave it default, or modify it if some of the sites require something special. Do this by pressing the "Custom Level..." button at the bottom of the Options dialog box.

Now, you can adjust the Internet zone's settings to disable or prompt you before any JavaScript is executed, by clicking the "Internet" icon and then pressing the "Custom Level..." button. These settings won't bother your regular sites, since they're not in this zone anymore, but it will keep some new site from opening five new windows and maximizing them, or hiding your menu and tool bars, etc.
____________________________________________________

I'm already using various tools to make it easier to accomplish the objectives of the above article and thought by sharing those here this would be more helpful to others that share my concerns.

IE Spyad - Advertising and Site Blocking through IE Zones
»www.staff.uiuc.edu/~ehowes/resou···#IESPYAD

IE-SPYAD is a Registry file (IE-ADS.REG) that adds a long list of known advertisers, marketers, and spyware pushers to the Restricted sites zone of Internet Explorer. Once IE-ADS.REG is "merged" into your Registry, most direct marketers and spyware pushers will not be able to resort to their usual "tricks" (e.g., cookies, scripts, popups, et al) in order to monitor and track your behavior while you surf the Net.

Please note that by adding domains and servers to Restricted sites zone of Internet Explorer, IE-ADS.REG cannot cause Internet Explorer to start blocking ads. You will still see the ads. The Restricted sites zone merely imposes limits on the types of things that those domains and servers can do with your web browser. For example, IE-SPYAD will:

* REDUCE THE NUMBER OF OBNOXIOUS SCRIPT-BASED POPUPS that clutter your screen and force unwanted advertising on you;
* BLOCK THE COOKIES TYPICALLY ATTACHED TO BANNER ADS and which are used to monitor and track your travels around the Internet;
* PREVENT THE USE OF ACTIVEX, JAVA, AND SCRIPTING -- active content technologies that can be used to compromise your privacy and security;

* PROTECT YOU AGAINST AUTO-INSTALLING CRAPWARE from spyware pushers (e.g., BonziBuddy, Gator, Lop.com, et al) that can invade your system, monitor your computer and Internet use, and trash your PC.
---
Enough is Enough!
»www.staff.uiuc.edu/~ehowes/resource6.htm

Enough is Enough! is a lockdown utility for Internet Explorer 5 and 6. When you install Enough is Enough!, it will:

* Lock down your Internet and Restricted sites zones with restrictive settings for dangerous options like ActiveX, Java, scripting, and a few others.
* Severely restrict the use of cookies (but not completely disable them for trusted web sites or for single session use).

* Disable several Advanced settings, including Install on Demand and Third-party Browser Extensions (Optional--Don't use this feature if using a pop-up stopper utility).

* Install Microsoft's IE PowerTweaks WebZone Accessory, putting two new options on your IE Tools menu, with corresponding buttons on your Toolbar: "Add to Trusted Zone" and "Add to Restricted Zone."
---
IE Zone Editor
»www.geocities.com/_SemperFi_/ieze/

What is Internet Explorer Zone Editor?
Internet Explorer Zone Editor is a program that will allow you to edit and modify Internet Explorer Security Zones.
What can IE Zone Editor do?
Add new security zones with icon, name, description of your choice. Edit default security zones (My Computer, Internet, Intranet, Trusted, Restricted).
Add an unlimited? custom security zones.

Note, per the author of this add-on: IE Zone Editor does not work with Internet Explorer Version 6.0.2600.0000
---
SpywareBlaster
»www.wilderssecurity.com/spywareblaster.html

SpywareBlaster doesn't scan and clean for spyware - it prevents it from ever being installed.

How? By setting a "kill bit" for the CLSIDs of spyware ActiveX controls, it prevents the installation of any of them from a webpage. You can run Internet Explorer with Active-X enabled, but you will never even get a "Yes/No" box popped up, asking you to install a spyware Active-X control (Internet Explorer will never download or run it!). All other Active-X controls or plug-ins will work fine.
---
How to disable or remove the Windows Scripting Host
»securityresponse.symantec.com/av···ing.html
How to disable (or re-enable) the Windows Scripting Host: The program Noscript.exe will disable the Windows Scripting Host. this will prevent viruses from executing automated scripts. Please note that disabling the WSH will prevent all scripts from running on the system.

WSH Anti-Polymorphism Patch
»www.diamondcs.com.au/web/patches···atch=wsh
What is the general purpose of this patch?
To prevent Windows Scripts (such as VBScript and Javascript) from being able to read/write themselves, making Windows Script polymorphism nearly impossible through conventional means.
[text was edited by author 2002-11-12 14:44:33]


Wednesday, 25-Nov 17:15:39	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com. page compression OFF