Do you know DCOM? The DCOM ( Distributed COM ) is an application-level protocol for controlling remote programs. Almost all Windows have DCOM installed by default. Do you know InternetExplorer is DCOM-enabled program? Not only IE, but also a lot of programs of Microsoft is DCOM-enabled. Can't you control IE remotely? Yes, you can. We will show the security risks of DCOM by demonstrating some tools which exploit DCOM-enabled programs such as IE and MS-Office remotely. Not only will we demonstrate these tools, but we will also talk about the mechanism and the implementation of them. The presentation will consist of the following: DCOM: Facts and Risks IE exploit demonstration IE data stealing & IE hijack Exploit method DCOM authentication & exploit techniques Other exploit demonstration