<OT> VBscript in html: Security threat?
Joel Hammer
Joel
Mon May 17 11:51:42 PDT 2004
I see that vbscript can be embedded in html.
Javascript was written to make it very hard to attack the client computer,
whereas vbscript doesn't have these safeguards built in, does it? VBscript
can do a lot of stuff, like write to your hard drive and run windows
software. It really is a beaut.
It would seem like child's play to encode malicious things in vbscript
and let the IE users get whacked. If IE somehow was protected against
running this program, it would be easy to make a vbscript a payload
(cool screen saver!) and then have the unlucky user click on it and run it.
What am I missing?
Who in his right mind would use vbscript over javascript in their html,
anyway? Why would you keep out anyone not using IE and a modern version
of windows? (Let me guess. People who use MS development products.)
Thanks,
Joel
More information about the Linux-users
mailing list