Solutions in this chapter:

• Understanding Java, JavaScript/VBScript, and ActiveX exploits
• How to protect your applications and operating system

Introduction

Dynamic e-mail, or e-mail that is enhanced by HTML, allows users to create more aesthetically pleasing e-mail, which can make it look better, and in turn make the sender look better but it also introduces some security concerns.

This chapter discusses the various attacks that can come through your e-mail system by mobile code. Types of mobile code that can arrive with e-mail are JavaScript, VBScript, Java applets, and ActiveX components.

We will discuss the security models for each of these programs, including the strengths, weaknesses, and the ways malicious programmers can take advantage of the weaknesses. But this book wouldn t be much good if we didn t also discuss precautions you can take to prevent unwanted attacks.

A lot of these attacks have their basis in social engineering. This is a term used when hackers use their social skills to gain access to a computer resource as opposed to using their computer skills. It is possible to trick a user into giving away information that will allow access to your system.

There are also security holes that sometimes allow mobile code to break into a system as soon as a person opens his or her e-mail. What the mobile code can do once it is executed varies, but in some cases it can be quite destructive.

In one of the most celebrated hacker cases yet to be turned into a...