2 cissp ® Official Study Guide Eighth Edition

ActiveX Controls ActiveX
controls were Microsoft’s answer to Sun’s Java applets. They 
operate in a similar fashion, but they are implemented using a variety of languages, includ-
ing Visual Basic, C, C++, and Java. There are two key distinctions between Java applets 
and ActiveX controls. First, ActiveX controls use proprietary Microsoft technology and, 
therefore, can execute only on systems running Microsoft browsers. Second, ActiveX 
controls are not subject to the sandbox restrictions placed on Java applets. They have full 
access to the Windows operating environment and can perform a number of privileged 
actions. Therefore, you must take special precautions when deciding which ActiveX con-
trols to download and execute. Some security administrators have taken the somewhat 
harsh position of prohibiting the download of any ActiveX content from all but a select 
handful of trusted sites.
ActiveX is still supported by Internet Explorer 11, but Microsoft’s latest browser, Edge, 
released with Windows 10, does not include support for ActiveX. This signals that 
Microsoft is phasing out ActiveX.
Local Caches
A 
local cache
is anything that is temporarily stored on the client for future reuse. There are 
many local caches on a typical client, including Address Resolution Protocol (ARP) cache, 
Domain Name System (DNS) cache, and internet files cache. 
ARP cache poisoning
is caused 
by an attack responding to ARP broadcast queries in order to send back falsified replies. If the 
false reply is received by the client before the valid reply, then the false reply is used to populate 
the ARP cache and the valid reply is discarded as being outside an open query. The dynamic 
content of 
ARP cache
, whether poisoned or legitimate, will remain in cache until a timeout 
occurs (which is usually under 10 minutes). ARP is used to resolve an Internet Protocol (IP) 
address into the appropriate MAC address in order to craft the Ethernet header for data 
transmission. Once an IP-to-MAC mapping falls out of cache, then the attacker gains another 
opportunity to poison the ARP cache when the client re-performs the ARP broadcast query.
A second form of ARP cache poisoning is to create static ARP entries. This is done via 
the ARP command and must be done locally. But this is easily accomplished through a 
script that gets executed on the client through either a Trojan horse, buffer overflow, or 
social engineering attack. Static ARP entries are permanent, even across system reboots. 
Once ARP poisoning has occurred, whether against a permanent entry or a dynamic one, 
the traffic transmitted from the client will be sent to a different system than intended. This 
is due to having the wrong or a different hardware address (that is, the MAC address) asso-
ciated with an IP address. ARP cache poisoning or just ARP poisoning is one means of set-
ting up a man-in-the-middle attack.
Another popular means of performing a man-in-the-middle attack is through 
DNS 
cache poisoning
. Similar to ARP cache, once a client receives a response from DNS, that 
response will be cached for future use. If false information can be fed into the 
DNS cache
, 

---

Client-Based Systems 
345
then misdirecting communications is trivially easy. There are many means of performing 
DNS cache poisoning, including HOSTS poisoning, authorized DNS server attacks, caching 
DNS server attacks, DNS lookup address changing, and DNS query spoofing.
The 
HOSTS file
is the static file found on Transmission Control Protocol/Internet Protocol 
(TCP/IP) supporting system that contains hard-coded references for domain names and their 
associated IP addresses. The HOSTS file was used prior to the dynamic query–based DNS sys-
tem of today, but it serves as a fallback measure or a means to force resolution. Administrators 
or hackers can add content to the HOSTS file that sets up a relationship between a