kayodeok's Weblog

Sunday 01 February 2004

Hacking Internet Explorer's "My Computer" Zone

Courtesy of the folks over at news://news.grc.com:

One way round the Windows XP Malicious Folder bug is to tighten the "hidden" Internet Explorer "My Computer" Zone. This is because the "Proof of Concept" on that page relies on the ActiveX Controls on the "My Computer" zone being enabled before it can work; disabling all ActiveX controls in the Internet Zone has no effect on Windows XP boxes and you will still be vulnerable to the bug.

If you have taken a peek at the "Security" Tab of Internet Explorer's Options, you know that there are 4 zones listed: The Internet Zone, The Local Intranet Zone, The Trusted Zone and the Restricted Zone. What you may not know is that there is also a "My Computer" zone which is hidden by default and in order to lock it down, you need to know how to unhide it first:

• Open up the Registry Editor
• Navigate to either HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 (if you wish to unhide the zone for just one account) or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 (if you wish to unhide the zone for all accounts)
• Change the value for Flags to 1, then reboot (if you modified the HKEY_LOCAL_MACHINE branch)
• Start up Internet Explorer and navigate to Tools >> Internet Options
• Click the "Security" tab, find the new Computer Zone and tighten down by setting all ActiveX Controls to disable and disabling all Active Scripting
• Please note that you may break existing functionality such as Windows XP Help and Support.
• For extra paranoid settings, you could also follow the suggestions in Hacking IE Security Zones
• Microsoft also has a knowledge base article titled Description of Internet Explorer Security Zones Registry Entries which explains how to hack the other security zones via the registry.

But why is there a need to have a "My Computer" zone in Internet Explorer? Apparently, it has something to do with the decision to integrate Internet Explorer with the Operating System, the idea was to have a sandbox between the Internet Zone and the Computer Zone but this has not worked out in practice and will hopefully be rectified in Windows XP Service Pack 2

This article assumes that you are using Internet Explorer as your main browser but even if you aren't, providing you are using Windows, I think it is a good idea to lock down the Computer zone now if you do not wish to wait till Windows XP service Pack 2 which may or may not lock it down.

Related Reading: Internet Explorer Security Zones

• Internet Explorer Security Zones
• Setting Up Security Zones
• Security Zones
• Description of Internet Explorer Security Zones Registry Entries
• Internet Explorer Privacy & Security Settings

Related Reading: The Registry

• Description of the Microsoft Windows Registry
• How to Back Up, Edit, and Restore the Registry in Windows XP and Windows Server 2003
• How to Add, Modify, or Delete Registry Subkeys and Values by Using a Registration Entries (.reg) File
• Description of HKEY_CURRENT_USER Registry Subkeys
• Mystery Behind Windows Registry: Conquering the Mystery
• Windows Registry Guide