Slashdot Mirror
Malicious Web Pages Can Install Dashboard Widgets
bonch writes "If you're running Safari on OS X Tiger and go to this website, a 'slightly evil' Dashboard widget will be automatically downloaded and installed and can't be removed without manually removing the file from the Library folder and rebooting the computer. The widget is called Zaptastic and is a demonstration by the author of how easy it is to exploit Dashboard for nefarious purposes. The essay, released under the Creative Commons License, goes on to describe the many ways users can be taken advantage of--imagine porn sites auto-installing adware widgets without your knowledge." So if you're on a Mac, it would be smart to view that page with something other than Safari.
with somethingorother.zip. Interesting, but not dangerous.
Oh well, what the hell...
this page at Apple's Developer Connection says that a 'widget' cannot ask for any resources or do anything to the filesystem outside of the widgets bundle.
If you do not tick the "open safe files" check box in the prefs. Which you should left unchecked if you're not entirely stupid, as there is no way to tell whether any file is actually "safe". Good Internet Practice, as I like to call it.
----- One learns to itch where one can scratch.
Is to turn off "Open 'Safe' downloads" in Safari's Options.
It's just common sense anyways
it's not totally evil.
It installs the widget, but does not activate it.. it just makes it available.
Further, widgets do run in a sandbox, and require user approval to execute if they want to do certain things (like erase your HD).
Honestly, apple should have said "would you like to install this widget?".. that would be sensible and courteous.
Dumb to do, but it can be set like that.
Problem solved. Having that pref checked is asking for trouble. You can drop whatever you want in my downloads, I'll open it myself when I'm ready.
Disclaimer: I am not running Tiger, so this may not be 100% correct.
The Mozilla Update team has taken steps to mitigate the problem - the default Firefox configuration is no longer exploitable, as far as I know.
My server
Just setting the permissions to the ~/Library/Widget folder to "Read Only" will do the trick.
Of course, that doesn't mean that it should install widgets for you in the first place...
Dashboard will ask you the first time a third-party widget is run and give you the option of not running it.
What more should Apple do save crippling the functionality of Dashboard for all users?
Jesus was a compassionate social conservative who called individuals to sin no more.
Well, it turns out I spoke too soon.
I said that Dashboard would prompt you when the widget was run for the first time. It turns out that for auto-installed Safari widgets, it does NOT prompt you the first time the widget is run.
Interesting.
This is indeed a security issue, and it should be made to at least prompt the user.
Considering that ALL other new widgets always prompt when first run, this appears to be a bug, and not the intended behavior.
The temporary fix (and what I always recommend anyway) is to disable "Open 'safe' files after downloading" in Safari.
4:47 It's even BETTER than I remember the first time. What a classic.
Holy Shit! I have OS X Tiger, and behold. Klicking on that link installed Goatse right into my Widget collection with NO CONFIRMATION DIALOG WHATSOEVER.
So whenever someone clicks on the "Add Widget" symbol (the circled plus sign) he gets to see a barenaked goatse in full glory.
--- Eat my sig.
I think you already corrected yourself above, but for others reading this, no, it doesn't prompt the user before running an auto-installed widget, which is such a fantastically bad idea I can't believe it didn't occur to anyone what a security flaw that is.
four nine eighteen twenty-7 thirty-nine forty-7 fiftyeight sixty-nine seventy-9 eighty-8 one-hundred-and-nine one-twenty
Yes, if goatse.cx is porn...
But either way, if you installed Paranoid Android (direct link) it will ask you to approve the url. And it is opensourced too.
If you hate the Dashboard and want to get rid of it, just throw Dashboard.app into the Trash and it will never launch again.
http://www.nonmundane.org/~dspisak/media/slashdot/ howtoprotect.png
Yeah this exploit is sorta lame, but its also trivial to plug in the meantime.
Fascinating article. I installed zaptastic_evil and was amused by it. Very annoying indeed. Widgets simply should not do this.
Just a few points of interest.
1) The widget may automatically download and get copied into the widgets folder, but it is not automatically installed onto the active dashboard. Therefor the user would have to manually click on it. Without knowing the widget is there, the user may not ever notice it. Of course, this is still a security risk, but this isn't the best way to propogate malware.
2) Widgets can be deleted manually as pointed out in the article by going into ~/Library/Widgets and removing the unwanted widget
3) The Dashboard can be reinitialized by killing the Dock. Those not familiar with terminal can just fire up Activity Monitor and kill the Dock there. The Dock immediately relaunches, then Dashboard reinitializes when it is launched again and the offending widgets are gone.
4) Apple should allow us to delete widgets from the dashboard, but the behavior when clicking and dragging a widget off of the Dashboard installs the widget instead of bringing up the delete puff of smoke. This behavior is at odds with every other taskbar/dock/menubar in OS X. I would recommend Apple change this.
5) We ARE dealing with Dashboard 1.0 so there are bound to be bugs needing to be squashed. Personally, I enjoy Dashboard but find it difficult to manage when there are too many widgets deployed. I find myself wishing for Exposé for Dashboard! LOL I also wish that widgets would reinitialize without force quiting the dock and that the dashboard would be a bit more dynamic. Sometimes deleted widgets take a while to disappear off the dashboard as well as newly installed widgets. I look forward to the upcoming 10.4.1 release.
The Splintered Mind - Overcoming
The grandparent was right. There haven't been any exploits. Both you and the link you give confuses the concepts of exploit and vulnerability. Exploit != vulnerability. A vulnerability is only the potential or an exploit, and it often blocked by other security measures in a properly layered security system.
The original post is also wrong in claiming that a reboot is necessary to remove it. He must be a Windows user. Clicking close on the widget, then removing it from the user library folder is all that is required. There is no nasty embedding a registry, or auto starting or restarting such as you might expect with spyware on a Windows machine.
The first thing i did when i opened up safari in tiger was to uncheck the "Open Safe files after downloading" option , visted the site in safari and it just automaticaly downloaded the file and did nothing more .So theres a quick workaround till a patch is out
I have no idea how this potential exploit slipped past , bad show indeed and rather disapointing.
But clearly it is a bug not poor judgment.
The only things certain in war are Propaganda and Death. You can never be sure which is which though
No, it's Safari categorising a ZIP archive as safe. To quote Safari:
The ZIP archive extracts automatically, and just happens to place the file in ~/Library/Widgets/. Dashboard runs the Widget from there.
You're right, it's not safe. I think the solution to this should be to first of all disable the whole opening safe files functionality by default. The second should be to declassify archive files as 'safe' (with the exception of disk images), because it makes it easy to write files in this way.
Personally I've set administrator priveledges on my ~/Library/Widgets/ folder so that I now need to enter a password to write to it.
The grandparent was right. There haven't been any exploits. Both you and the link you give confuses the concepts of exploit and vulnerability.
Wow, have you got a lot to learn... Did you not read the article AT ALL? Claiming that the apple system is a "properly layered security system" is an opinion, not a fact. Some might agree it is more proper than windows XP. I'm not here to argue wether that is true or not. I'm here to argue that either 1) a properly layered security system doesn't give you a secure system or 2) the MacOS doesn't have a properly layered security system.
One of the above(or possibly both) is true. It is up to you to decide which and quit sitting up on your high horse thinking you are a god for using MacOS.
Your ignorance is infinitely greater than you realize.
I meant they should fix it in not allowing an untrusted remote application to be downloaded on a local computer with no interaction from the user.
/Library/Widgets. No need to restart OS X or Dashboard, it just shows up.
So turn off the ability. In Safari, open Preferences, and on the first tab, de-select 'automatically run "safe" files upon download.' Then, it'll download it, and you can manually install the widget by copying it to
This was one of the first things I tweaked after switching to a Mac. I noticed it'd automatically mount disk image files, and I could see the potential security implication, so I found the checkbox and tunred it off.
It's not rocket science, just basic research.