Wikipedia

Browser Helper Object: Difference between revisions

Browse history interactively
← Previous edit
Content deleted Content added
VisualWikitext
Weanlitar (talk | contribs)
203 edits
Importing Wikidata short description: "DLL module designed as a plugin for Microsoft's Internet Explorer web browser to provide added functionality" (Shortdesc helper)
-
 
(25 intermediate revisions by 16 users not shown)
Line 1:
{{Short description|DLLPlug-in module designed as a plugin for Microsoft's Internet Explorer web browser to provide added functionality}}
[[ImageFile:Am addon manager.png|right|thumb|Add-on Manager from [[Windows XP]] SP2 Internet Explorer]]
A '''Browser Helper Object''' ('''BHO''') is a [[Library (computer science)|DLL]] [[Module (programming)|module]] designed as a [[Plug-in (computing)|plugin]] for the [[Microsoft]]'s [[Internet Explorer]] [[web browser]] to provide added functionality. BHOs were introduced in October 1997 with the release of [[Internet Explorer 4|version 4]] of Internet Explorer. Most BHOs are loaded once by each new instance of Internet Explorer. However, in the case of [[Windows Explorer]], a new instance is launched for each window.
 
BHOs are still supported as of Windows 10, through [[Internet Explorer 11]], while BHOs are not supported in the default web browser [[Microsoft Edge]].
 
== Implementation ==
Line 16:
 
== Concerns ==
The BHO [[application programming interface|API]] exposes [[hooking|hook]]s that allow the BHO to access the [[Document Object Model]] (DOM) of the current page and to control navigation. Because BHOs have unrestricted access to the Internet Explorer event model, some forms of [[malware]] (such as adware and spyware) have also been created as BHOs.<ref>{{Cite Oneweb|title=Browser typeHijack ofObjects Malware that targets the page is [[C2(BHOs)|url=https://blog.LOP]] For example, the [[Downloadmalwarebytes.ject]]com/threats/browser-hijack-objects-bhos/|access-date=2021-12-05|website=Malwarebytes malwareLabs|language=en-US}}</ref><ref>{{Cite installsjournal a|last=Park BHO|first=Beomsoo that|last2=Hong would|first2=Sungjin activate|last3=Oh upon|first3=Jaewook detecting|last4=Lee a|first4=Heejo secure|date=2005 [[HTTP]]|editor-last=Kantor connection|editor-first=Paul to|editor2-last=Muresan a|editor2-first=Gheorghe financial|editor3-last=Roberts institution,|editor3-first=Fred [[keystroke|editor4-last=Zeng logging|recordeditor4-first=Daniel theD. user's|editor5-last=Wang keystrokes]]|editor5-first=Fei-Yue (intending|editor6-last=Chen to|editor6-first=Hsinchun capture|editor7-last=Merkle passwords)|editor7-first=Ralph andC. transmit|title=Defending thea informationWeb toBrowser aAgainst websiteSpying usedwith byBrowser RussianHelper [[computerObjects crime|computer criminals]]url=https://link.springer.com/chapter/10.1007/11427995_85 |journal=Intelligence Otherand BHOsSecurity suchInformatics as|series=Lecture theNotes [[MyWayin Searchbar]]Computer trackScience users'|language=en browsing|location=Berlin, patternsHeidelberg and|publisher=Springer pass the|pages=638–639 information they record to third parties|doi=10.1007/11427995_85 |isbn=978-3-540-32063-0}}</ref>
 
For example, the [[Download.ject]] malware is a BHO that is activated when a secure [[HTTP]] connection is made to a financial institution, then begins to [[keystroke logging|record keystrokes]] for the purpose of capturing user passwords. The [[MyWay Searchbar]] tracks users' browsing patterns and passes the information it records to third parties. The [[C2.LOP]] malware adds links and popups of its own to web pages in order to drive users to [[pay-per-click]] websites.{{cn|date=May 2021}}
Many BHOs introduce visible changes to a browser's interface, such as installing toolbars in Internet Explorer and the like, but others run without any change to the interface. This renders it easy for malicious coders to conceal the actions of their browser add-on, especially since, after being installed, the BHO seldom requires permission before performing further actions. For instance, variants of the ClSpring trojan use BHOs to install scripts to provide a number of instructions to be performed such as adding and deleting registry values and downloading additional executable files, all completely transparently to the user.<ref>Computer Associates malware entry at [http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=42280 ca.com], retrieved 1/16/2009</ref> The [[DyFuCA]] spyware even replaces Internet Explorer's general error page with an ad page.▼
 
▲Many BHOs introduce visible changes to a browser's interface, such as installing toolbars in [[Internet Explorer]] and the like, but others run without any change to the interface. This renders it easy for malicious coders to conceal the actions of their browser add-on, especially since, after being installed, the BHO seldom requires permission before performing further actions. For instance, variants of the ClSpring trojan use BHOs to install scripts to provide a number of instructions to be performed such as adding and deleting registry values and downloading additional executable files, all completely transparently to the user.<ref>Computer Associates malware entry at [http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=42280 ca.com], retrieved 1/16/2009</ref> The [[DyFuCA]] spyware even replaces Internet Explorer's general error page with an ad page.
In response to the problems associated with BHOs and similar extensions to Internet Explorer, Microsoft debuted an ''Add-on Manager'' in [[Internet Explorer 6]] with the release of [[Windows XP#Service Pack 2|Service Pack 2]] for [[Windows XP]] (updating it to IE6 Security Version 1, a.k.a. SP2). This utility displays a list of all installed BHOs, [[browser extension]]s and [[ActiveX control]]s, and allows the user to enable or disable them at will. There are also free tools (such as BHODemon) that list installed BHOs and allow the user to disable malicious extensions. [[Spybot – Search & Destroy|Spybot S&D]] advanced mode has a similar tool built in to allow the user to disable installed BHOs.▼
 
▲In response to the problems associated with BHOs and similar extensions to Internet Explorer, Microsoft debuted an ''Add-on Manager'' in [[Internet Explorer 6]] with the release of [[Windows XP#Service Pack 2|Service Pack 2]] for [[Windows XP]] (updating it to IE6 Security Version 1, a.k.a. SP2). This utility displays a list of all installed BHOs, [[browser extension]]s and [[ActiveX control]]s, and allows the user to enable or disable them at will. There are also free tools (such as BHODemon) that list installed BHOs and allow the user to disable malicious extensions. [[Spybot – Search & Destroy|Spybot S&D]] advanced mode has a similar tool built in to allow the user to disable installed BHOsBHO.
 
== See also ==
Line 33 ⟶ 35:
 
== External links ==
*[https://sites.google.com/site/bhosearch/ Sites.google.com] {{Webarchive|url=https://web.archive.org/web/20141224114851/https://sites.google.com/site/bhosearch/ |date=2014-12-24 }}
 
=== Microsoft sites ===
Line 45 ⟶ 47:
*[http://www.codeproject.com/Articles/19971/How-to-attach-to-Browser-Helper-Object-BHO-with-C C# example code for a BHO]
 
{{Information security}}
{{Microsoft APIs}}
{{Internet Explorer}}
Retrieved from "https://en.wikipedia.org/wiki/Browser_Helper_Object"