Developed by Microsoft, ActiveX is designed for fluid interactivity and the ease of programming. While these can be great features for any application, they also set up the stage for a number of security issues with ActiveX controls. Microsoft Internet Explorer already has a few security issues. Add to that the security problems of ActiveX, and I see red flags waving everywhere.
In particular, ActiveX controls create an environment that is readily accessible to individuals who are interested in placing an assortment of spyware or malware on the unprotected computers of unsuspecting computer users. It is relatively easy for such individuals to take advantage of ActiveX control technology to do their dirty work. In fact, these controls have often been considered the root of many security issues.
A great deal of adware and spyware can readily be downloaded onto a computer using ActiveX controls. No protective settings are in place with ActiveX controls to prevent this from happening. Unlike Java applets, ActiveX controls rely on digital signatures, which simply state that the software is free of viruses and other forms of malware. The computer user is totally at risk of obtaining spyware, adware, and more on his computer unless he is fully capable of judging whether or not a code is safe.
ActiveX objects are distributed with valid certificates. Yet, even when a certificate is deemed to be valid, the scripts might have been tampered with in a way that places harmful applications on a computer.
Maliciously coded controls can be damaging in obvious ways, creating havoc with the functioning of the computer or they can be damaging in less obvious ways, secretly stealing the data that is entered on a computer and transmitting it to another individual. While this activity does no harm to an individual’s computer, it can create problems due to the theft of sensitive, personal information.
The most obvious example of the latter types of applications is spyware and adware programs. The majority of spyware programs utilize ActiveX objects in order to install themselves onto an individual’s computer system. They have certificates attached to them, giving them a semblance of credibility. Therefore, they are not immediately identifiable as a potential threat to the computer system.
Even if the spyware program prompts a security warning to the computer user, it is often accepted due to the vague nature of the warning. The scripts used in spyware are typically signed and present disclaimers that explain what they do, making them legal in a loose sense of the word. Additionally, should the spyware program sneak past this warning, it can complete an install without ever being noticed.
Nonetheless, spyware is not something that anyone would willingly install onto a computer. I know that personally, I want my personal information kept under wraps without the potential for other individuals to gain access to it. Having spyware on my computer is like posting your personal data on a bulletin board for some unscrupulous character to get a hold of and use against me.

This question came in this morning from a reader who is having trouble with AOL and AOL’s AIM 6.5 updates. I was immediately curious because my own computer has been nagging me to install Quicktime and iTune updates.