Today we're going to wrap up our overview of Browser Helper Objects with a look at BHO's and Security as well as similarities between BHO's and Shell Extensions. If you recall from our first post on BHO's, a BHO is an extension to Internet Explorer that adds customization and functionality. The API's used by Browser Helper objects expose hooks that allow them to access the Document Object Model (DOM) of the current page and to control navigation. This leads to malware applications that have been created as Browser Helper Objects.
For example, the Download.ject exploit installed a BHO that would activate upon detecting a secure HTTP connection to a financial institution, record the user's keystrokes (intending to capture passwords) and transmit the information to a website used by Russian computer criminals. Other BHOs such as the MyWay Searchbar track users' browsing patterns and pass the information they record to third parties. Although many BHO's install toolbars in Internet Explorer, there is no requirement that a BHO have a user interface. Therefore it is possible that a user may not know that they have a malicious BHO installed on an unprotected machine.