Passive Information Gathering

In some situations the ActiveX control may not have enough information to create an HTTP tunnel between the target machine and the attacker. An example of information that the control would need but may not have is proxy authorization credentials. In cases such as these it would be possible for the ActiveX control to be enhanced to support keystroke logging and other forms of information gathering that would allow it to collect enough data to be able to build some sort of data channel. The ActiveX control could also be extended to make the data channel more covert by having it vary both in protocol, such as by switching to and from DNS, and in delay, such as by causing HTTP posts to be spread out in time to make them appear less suspicious.