Malicious Web Pages Can Install Dashboard Widgets

bonch writes "If you're running Safari on OS X Tiger and go to this website, a 'slightly evil' Dashboard widget will be automatically downloaded and installed and can't be removed without manually removing the file from the Library folder and rebooting the computer. The widget is called Zaptastic and is a demonstration by the author of how easy it is to exploit Dashboard for nefarious purposes. The essay, released under the Creative Commons License, goes on to describe the many ways users can be taken advantage of--imagine porn sites auto-installing adware widgets without your knowledge." So if you're on a Mac, it would be smart to view that page with something other than Safari.

Comments

yes but...

[Anonymous Coward]

magine porn sites auto-installing adware widgets without your knowledge.

Yes, but do they install porn?
-SJ53

Re:yes but...

[mike518]

"magine porn sites auto-installing adware widgets without your knowledge."

i dont need to imagine, im running windows xp.

Serves you right

[th1ckasabr1ck]

If people would just run a secure OS like Linux or Windows, they wouldn't be hit with attacks like this. When will people learn?

Re:Serves you right

[Janitha]

There is no such thing is a secure OS, all Operating systems have flaws.

Re:Serves you right

[EtherAlchemist]

That's quite apt. And I imagine you will be modded down due to the OS in question here.

When a Windows OS exploit is discovered there are thousands of zealots who scream "USE LINUX, STUPID" and "I use a Mac, there are not exploits for my OS" but whenever either of those OSes is found to have a flaw, those zealots are awfully quiet.

The best thing for me reading the comments so far has been the Mac users who point out that settings can be changed to allow or deny this action. They treat that like it's a magic feature only Mac has, when the truth of the matter is shit like that can be turned off in Windows also.

All of the common OSes can be locked down tight, IF THE USER CHOOSES TO. Every OS ships with the potential to be exploited, and even if it comes out the box secure, the user can always undo that.

I guess the difference when it's a Mac OS, it's a big deal because someone actually bothered to write something malicious for a small segment of the computer population.

This is actually a good thing though. It's lets all of you Mac users know that the security you've been takeing for granted is only as good as long as their is no attention to you.

Looks like this is changing.

Re:Serves you right

[Mitleid]

God damn I wish I had some mod points. Very well said, my friend.

Re:Serves you right

[diamondsw]

No, because as you said, out of the box security is important. Mac OS X has no services running out of the box; Windows had several exploitable ones prior to XP SP2 (which I give them credit for doing a good job with).

As for this vulnerability, it is Safari categorizing a Dashboard widget as "safe" when it clearly isn't. Yes, it's a vulnerability, one with an exploit already shown, and it needs to be fixed NOW. No one is saying Apple is perfect or OS X is immune, but so far there has been very little to point to in Apple's track record.

What's really important is Apple's response. Anyone post this in RADAR yet? "As Seen On TV", any thoughts from your unique position?

Re:Serves you right

[Anonymous Coward]

I use a Mac, there are not exploits for my OS

whenever [OS X] is found to have a flaw, those zealots are awfully quiet.

Good thing it hasn't happened then.

Re:Serves you right

[Scudsucker]

Very well said, my friend.

No, its not. His exact same sentiments have been expressed in a hundered other Apple stories. Yawn.

Re:Serves you right

[Scudsucker]

The mere repetition of speech or ideas does not increase or decrease their correctness, or the aesthetics of their form.

Not when they aren't remotely correct in the first place. Apple is the only company where you can count on these arguments being made. And most of the time these people don't even bother to read the comments before posting the "but if this were Microsoft" drivel. This was demonstrated perfectly in the book banning story - someone complained that "if this were Microsoft you guys would be outraged" - completly ignoring the many "Steve Jobs is a consumate asshole" posts modded up to +5 Informative.

You, sir, are a troll.

Wrong. I'm pointing out that these people are hypocrites - the critisize the supposed "group think" of Slashdot, nevermind that they are parroting the "if this were Microsoft" line that was old before Hot Grits went out of style. These comments are just as much trolls as the guy claiming that BSD is dying and the guy wondering why it's taking him 20 minutes to copy a 17 meg file onto a Mac from across a network.

Re:Serves you right

[GotenXiao]

Technically, this isn't a MacOS exploit - it's a Safari exploit. Unless of course, we're including browser exploits, in which case your point about locking stuff down becomes invalid because Internet Swiss Cheese *can't* be locked down that far. Sure, you can switch off ActiveX. And JavaScript. And just about everything else. Good luck browsing the web.

And to be fair, it wasn't a malicious exploit.
"I went to the trouble of making it ostensibly useful: it is a countdown timer for the launch of alleged PayPal competitor GreenZap. GreenZap is probably a Ponzi scheme, but do remember that PayPal gave away money when they were new, and it really would be a good idea on general principle if they had competition."
As he mentions on his site, it could easily have been a lot more evil and/or damaging. Then again, he *does* link to the more evil version... But it should bring it home quite well for the Mac users.

Re:Serves you right

[teh kurisu]

No, it's Safari categorising a ZIP archive as safe. To quote Safari:

"Safe" files include movies, pictures, sounds, PDF and text documents, and disk images and other archives.

The ZIP archive extracts automatically, and just happens to place the file in ~/Library/Widgets/. Dashboard runs the Widget from there.

You're right, it's not safe. I think the solution to this should be to first of all disable the whole opening safe files functionality by default. The second should be to declassify archive files as 'safe' (with the exception of disk images), because it makes it easy to write files in this way.

Personally I've set administrator priveledges on my ~/Library/Widgets/ folder so that I now need to enter a password to write to it.

Re:Serves you right

[whitepony02027]

but what makes it better is that we have the problems here and now while Windows users have to wait a year and a half for them.

Firefox asks what to do

[HermanAB]

with somethingorother.zip. Interesting, but not dangerous.

Re:Firefox asks what to do

[Bungopolis]

This warning applies specifically to Safari. It's obviously not going to affect Firefox, because Firefox does not have the widget auto-installation feature that Safari does. Most users of Tiger, however, are probably using Safari, so this most certainly is dangerous.

Re:Firefox asks what to do

[linguae]

Same thing on my computer. I'm running Firefox 1.0.1 on FreeBSD, and the exact same thing happened. At least Firefox asked what to do with the file before downloading it, but still it is a bit weird.

I guess that you can run away from Windows and all of its problems with ActiveX and Internet Explorer, but you can't hide from all of the problems of Internet security. All this takes is for some clueless Mac users to just say "Yes" when Safari asks does the program want to be downloaded/run, and voila, they get the Macintosh equivalent of spyware. Just as easy as it is in Windows.

This problem needs to be fixed quickly, before spyware widgets start becoming more common on the Mac platform. And users need to be more educated about such dangers such as software automatically downloading themselves. They need to know how to withstand social engineering abuses, and they also need to get into their heads quickly that just because they're away from Windows and Internet Explorer doesn't mean that they're away from crackers and exploiters.

Re:Firefox asks what to do

[cvas]

I'm not saying OS X is or isn't more secure than Windows, Linux, etc., but this vulnerability doesn't negate the argument you brought up at all. If Mac users had said OS X was completely, 100%, beyond a shadow of a doubt secure and had no vulnerabilities, then you would have a point. As it stands, you can still be the most secure if you have less vulnerabilities than the others.

Re:Firefox asks what to do

[hey!]

It certainly makes you wonder -- what was apple thinking? How many years have there been security issues with ActiveX? How could anybody with an IQ above tepid water possibly think an autoinstallation feature is a good idea in a web browser at this late date?

Re:Firefox asks what to do

[Lussarn]

It still fills up your harddrive with possibly malicious crap. If thats ok for you Apple didn't do anything wrong even this time.

widgets limited

[RobertTaylor]

this page at Apple's Developer Connection says that a 'widget' cannot ask for any resources or do anything to the filesystem outside of the widgets bundle.

Re:widgets limited

[ender81b]

True, true. But hasn't apple learned anything from MS? Automatically running/installing *anything* from the internet is a bad, bad idea. And a widget could, in theory, do things like make widget pop up ads, revolving goatse/tubgirl widget, etc.

Basically, bad apple bad. Fix.

Re:widgets limited

[Anonymous Coward]

They can take up RAM.

And in fact they often take up lots and lots of RAM.

A widget forkbomb wouldn't be so hard I don't think.

Widgets shouldn't be able to install this way.

Re:widgets limited

[antibryce]

True, but widgets can run external programs if certain permissions are set. The most insane part is that the widget itself sets the permissions it's allowed to have. Putting a key in the Info.plist file with "AllowFullAccess" set to "Yes" will allow the widget to run anything, access the network, etc. Basically at that point it's a full featured app. How hard would it be to make a widget that's invisible but periodically queries Safari's browser history, or songs played in itunes, or do a spotlight search for "password" and email the results to some guy in Russia? The widget could even be invisible to the user, with a 1x1 transparent gif as it's screen.

It seems really really dumb in this light to have Safari not only automatically download zip files, but uncompress them and if it finds a Widget bundle inside to install it. All without user intervention.

Re:widgets limited

[taybin]

How would you suggest they "fix" widgets to keep them from pulling offensive images? I can't think of a reasonable way (and I don't consider a blacklist reasonable) that wouldn't cripple the functionality.

Re:widgets limited

[ender81b]

I meant they should fix it in not allowing an untrusted remote application to be downloaded on a local computer with no interaction from the user.

Re:widgets limited

[Ilgaz]

The software which they didn't steal :) is a very advanced application in fact. I tried it myself just recently and for windows people out there, Konfubulator XP has shipped, give it a try until it gets this time into longhorn *g*

Asked myself why such advanced coders give plain sit,sitx,zip files for installing manually to widgets directory (or anywhere) and require user to double click it to launch.

Now I had my answer ;)

Re:widgets limited

[rapidweather]

Until they fix it, take a look at this Mac LiveCD linux.

That ought to be a lot of fun, in addition to providing a way to run another OS on your Mac.

Re:widgets limited

[Ilgaz]

A lot of companies/coders fixed it but just years ago, a malicious jpeg or gif header (can't remember) could rape your application and machine just by stating its a 20.000*10.000 resolution.

No elite asm code, nothing at all. Just a header.

Re:widgets limited

[Arrgh]

It's not a bad idea per se to automatically download and run stuff from the Internet, but any software designed to do so had better be designed and implemented properly. The dozens (hundreds?) of "cross-site scripting" bugs that have surfaced in popular browsers in the past few years are evidence that this is rarely done well. Java's 10 year old sandbox design has been quite successful, and Flash has followed a substantially similar design.

Unfortunately, code signing, as currently implemented and (mis)understood by users, is an all-or-nothing proposition. There are certainly legitimate uses for privileged mobile code, but most users don't really read or understand security warning dialogs, they just think "I just clicked the Start Game button, and now it's asking me if I really want to Start the Game. How stupid."

Marimba actually came up with a good partial solution ages ago. When their framework loaded and executed a Java app, the framework would closely manage exactly what resources could be exploited by the app. Each application's ability to read and write files was restricted by default to its own tiny corner of the filesystem, and the amount of space it could occupy with its files was constrained as well.

Note that Java's security manager infrastructure has allowed these sorts of fine-grained controls since 1.2 (circa 1998), but no one to my knowledge has yet found a way to effectively communicate to a user:

• what resources a given piece of mobile code will want to exploit;
• what the risks of running it might be;
• some assurance that the code is published by someone they trust;

...While maintaining some degree of user-friendliness. It's a tough problem.

MSIE's concept of local policies set according to centrally defined security zones was a step in the right direction; it's too bad its development stalled when the Browser War was "won."

Re:widgets limited

[Cecil]

> > And then, of course, come the inevitable vulgar ACs, f**ktard.

> Like yourself and your hypocritical vulgar potty mouth?

Of course, we can't forget the "joke went *whooooosh* RIGHT over my head" crowd! Thanks for reminding us!

Re:widgets limited

[Jeffrey Baker]

The bit about widgets stopping is completely false. You can connect to native code (or Java code) from your widget, and the native/Java code can do all types of things, even when the widget is off-screen.

Re:widgets limited

[EddWo]

It says the widget gets its permissions from it .plist file. That file is inside the widget bundle so it can be modified by the widget without asking for elevated permissions.

If the widget is added without requiring permissions, but as it's first it act modifies its own plist file, the next time dashboard is run it is given permissions without asking the user since it is already added to the dashboard.

Thats the way it seems to work anyway.

Re:widgets limited

[Elliot Anderson]

As for hiding the widget using a 1x1 transparent GIF, it would be instantly noticible when you clicked the Widget Management button (the little circle with an x in it in the lower left corner). When it is activated and the widget drawer is open, all of the widgets have their own "Close Widget" button that hovers a few pixels away. So it is pretty much impossible to hide a widget without it becoming somewhat noticible.

Re:widgets limited

[Exodious]

I'm running Safari on 10.4 as well, and I tried this.

If I have "Open 'safe' files after downloading" checked, Safari downloads, extracts, and installs the widget without asking.

If I have "Open 'safe' files after downloading" unchecked, Safari just downloads it.

Nowhere am I asked during this process if I want to install it. I'm curious as to what's different on your machine that it asked you.

Re:widgets limited

[BasilBrush]

It's not an application, it's a widget. On your preferred browser, are you asked everytime before a flash plugin is downloaded and executed? No, not unless you disable flash. It's similar with these widgets, except they are not executed automatically, only downloaded.

Too integrated

[m50d]

This is what happens when you tie together parts of the OS that shouldn't be put together. In particular, has apple not realised that having the browser tied to anything that expects local rather than remote content is fundamentally an incredibly stupid idea?

In soviet russia

[zkn]

Apple copies Microsoft.....

HAH!

[JoeCommodore]

I'm running Jaguar!

I can't afford to buy all the Apple "upgrades of the month."

1st real ad-ware?

[EggyToast]

Definitely easier to remove than most Windows Ad/spyware, but still a pain in the butt. Just goes to show that making something painless for the user can often lead to the technology being abused by more nefarious individuals.

I know that Windows usually posts security fixes and doesn't address spyware exploits specifically in many cases -- it'll be interesting to see if Apple addresses this in 10.4.1 or if we see a patch sooner (or later!)

Re:1st real ad-ware?

[Aphrika]

"Just goes to show that making something painless for the user can often lead to the technology being abused by more nefarious individuals"

Yup, it's a bit like scripting in Outlook and ActiveX in IE; incredibly useful in a fully controlled environment, but incredibly vulnerable in the wild and hugely open to exploitation. I would have assumed Apple would've seen the fun and games that MS has had with scripting, embedding and browser/OS interaction over the years to not let something like this happen.

Microsoft seemed to end up in knots trying to sort out the ActiveX and scripting debacles, the result being lots of dialog boxes and the IE info bar (easily faked in a web page too!), so it will be interesting to see how Apple go about fixing it, which I'd assume would be a simple block on automatic installs.

Yeah...

[Nanoda]

imagine porn sites auto-installing adware widgets without your knowledge.

Yeah... I'm imagining those porn sites.........

Not much of a problem...

[InternationalCow]

If you do not tick the "open safe files" check box in the prefs. Which you should left unchecked if you're not entirely stupid, as there is no way to tell whether any file is actually "safe". Good Internet Practice, as I like to call it.

Re:Not much of a problem...

[mattgreen]

If this were a Microsoft product, the consensus would not be nearly so optimistic. Between this and the 19 holes recently fixed, looks like Apple doesn't exactly have a sparkling record when it comes to security anymore. Much better than Windows, but then again pretty much everything is.

Re:Not much of a problem...

[Anonymous Coward]

No, it should be pretty easy to tell what is a "safe" file. PDF, for example, is a safe file, as is HTML, as is a GIF. A dashboard widget is NOT.

Apple really screwed up with allowing dashboard widgets to be listed as a "safe" file and they need to patch this as soon as possible. This is one of the big problems with IE, that they went from "autoopen anything, even unsafe stuff" to "warn you about viruses when you try to download ANYTHING, including a PDF". Clearly identifying what is safe is as important as identifying what is unsafe, otherwise people just double-click everything they download not realizing it's a .app.

Re:Not much of a problem...

[Temporal]

as there is no way to tell whether any file is actually "safe".

Wrong. Text files are "safe". JPEG files are "safe". Java applets are "safe". Flash is "safe". Any software written in a verifiable-bytecode-based, pointer-safe language with capability-based security should be "safe".

Obviously a dashboard widget should not be considered safe, but that doesn't prove that it's impossible to tell if a file is safe. It only proves that the Safari developers made a mistake when deciding what should be considered safe.

Re:Not much of a problem...

[Mike McTernan]

Which you should left unchecked if you're not entirely stupid

I always thought that one of Apple's selling points was that they are made for non-experts. So giving users an option to potentially shoot their foot off seems to be a little unfortunate. Almost by definition, few people are experts.

Re:Not much of a problem...

[Anonymous Coward]

JPEG files are "safe"

hello.jpg, tubgirl, need I go on?

Re:Not much of a problem...

[kitzilla]

Yup. Safari just tossed the widget on my desktop for consideration. Still ...

Re:Not much of a problem...

[Lars T.]

JPEG files are "safe"

http://www.kb.cert.org/vuls/id/297462, http://www.linuxsecurity.com/content/view/102413/1 10/

Re:Not much of a problem...

[mooniejohnson]

... 19 holes recently fixed ...

Better to have the holes exist and be patched than to have them exist and not patched, or denied that they exist (also know as "just plain ignored"). Software will always have holes. The security record should be measured on how quickly they get patched AND how many exist.

The solution

[Little Grey]

Is to turn off "Open 'Safe' downloads" in Safari's Options.

It's just common sense anyways

Re:The solution

[ender81b]

The solution to spyware on windows is to turn off activex in internet explorer and set it to run as guest...

It's just common sense.

Seriously though this is a very bad idea and apple needs to fix this ASAP.

Re:The solution

[Professor_UNIX]

The solution to spyware on windows is to turn off activex in internet explorer and set it to run as guest...

But without ActiveX you lose the functionality that is the only reason most people still use IE at all. By shutting off "open safe files" you don't lose functionality other than convenience of not having to manually open downloaded files.

uh...

[pkboy]

"imagine porn sites auto-installing adware widgets without your knowledge." I guess Mac users can now blame their browsers for the pr0n popping up on their computers as well.

Re:Thanks Slashdot!

[jericho4.0]

Oh. My. God. There's a zip file on your desktop. Holy Shit. A zip file, for Christ's sake! What will your fate be? Long and painful, or medium and painful? How will your family go on?

Awww...How cute!

[justforaday]

Looks like he was nice and made us a goatse.cx widget. Too bad I don't have Tiger yet... :'(

Re:Awww...How cute!

[flowerp]

Holy Shit! I have OS X Tiger, and behold. Klicking on that link installed Goatse right into my Widget collection with NO CONFIRMATION DIALOG WHATSOEVER.

So whenever someone clicks on the "Add Widget" symbol (the circled plus sign) he gets to see a barenaked goatse in full glory.

Bad design, for sure, however.

[mindstrm]

it's not totally evil.

It installs the widget, but does not activate it.. it just makes it available.

Further, widgets do run in a sandbox, and require user approval to execute if they want to do certain things (like erase your HD).

Honestly, apple should have said "would you like to install this widget?".. that would be sensible and courteous.

Several levels of control

[pelorus]

First, when a widget starts to download, Tiger prompts me and says "This download contains an application, do you want to continue?" That should be the first dead-giveaweay.

Secondly, while the OS DOES copy downloaded widgets to the Widgets folder in the Users directory, the widgets do not become active until you actually activate them. (of course there's nothing stopping you from usign the same name and icon as ...say Calculator).

Getting widgets to do complex system-level stuff you WANT them to do is tough enough.

Re:Several levels of control

[SirTalon42]

You could put a space in front of the name, and you wouldn't be able to tell. And if it installed several that all used the same icons and names (but with the space in front), how will you tell which is real? Especially if the real ones are pushed off the screen.

Theres a link to an example on another part.

Re:Thanks Slashdot!

[YrWrstNtmr]

FF can be set to d/l automatically. "Do this automatically for files like this from now on." If you've clicked that box in the past, zip files will be automagically downloaded. This will work for any filetype. Automatically play a .wav/mp3 file, or open a .doc, or d/l whatever.

Dumb to do, but it can be set like that.

Re:Ouch!

[justMichael]

That seems liek quite a security flaw... Any timeline on it being patched?

Preferences -> General -> Open "safe" files after downloading (uncheck)

Problem solved. Having that pref checked is asking for trouble. You can drop whatever you want in my downloads, I'll open it myself when I'm ready.

Disclaimer: I am not running Tiger, so this may not be 100% correct.

O Great Oracle of Slashdot

[Dachannien]

If there's anything that Slashdot has taught us, it's that it's never safe to use your computer.

The really funny part is

[mcc]

Safari is uber paranoid about other filetypes now-- if you download a tar or a dmg it says "warning, this file may contain an application, are you sure you want to uncompress this?" It didn't do this before Tiger.

The unzip/install widgets thing wasn't a conscious decision. This is clearly a bug.

Re:The really funny part is

[FidelCatsro]

The first thing i did when i opened up safari in tiger was to uncheck the "Open Safe files after downloading" option , visted the site in safari and it just automaticaly downloaded the file and did nothing more .So theres a quick workaround till a patch is out

I have no idea how this potential exploit slipped past , bad show indeed and rather disapointing.
But clearly it is a bug not poor judgment.

More 'Windows like'

[SmoothTom]

With this new addition to Safari under Tiger, Apple has made a large step in catching up with Microsoft Windows...

Now the script kiddies won't feel as limited in their options in annoying Mac users just like they do MS Windows users.

A nice, new, open window (no pun intended) for the black hats to use... *sigh*

--
Tomas

Imagine it?

[Anonymous Coward]

imagine porn sites auto-installing adware widgets without your knowledge

Imagine it? I'm a Windows/IE user...I live it!

Dashboard: Slightly OT but worth a look

[uprock_x]

Click OnLine, BBC's tech show:

http://stream.servstream.com/ViewWeb/BBCWorld/File /worl_click_030505_show_hi.rm?Media=60506

Cole asks Apple manager: is Dashboard a big rip off of Konfabulator?

Apple manager's response:um, er...Desk..Accessory...um...things......from before....like

Re:Dashboard: Slightly OT but worth a look

[uprock_x]

4:47 It's even BETTER than I remember the first time. What a classic.

Thank God for Firefox and Windows

[Pedrito]

I'm just glad I'm running Firefox under Windows. No need for me to worry about nefarious web sites.

Re:Thank God for Firefox and Windows

[CTho9305]

The Mozilla Update team has taken steps to mitigate the problem - the default Firefox configuration is no longer exploitable, as far as I know.

Require password to set execute bit!

[rice_burners_suck]

You would think that Apple, being such an innovative company, would learn from Microsoft's mistakes.

Yes, I know that Dashboard programs cannot (supposedly) affect the filesystem outside of their bundle. And I know that if you uncheck the "automatically open downloaded blah blah blah" then Safari won't do that.

But the default is not secure! And that's what will cause the computer to do "weird" stuff like the above; the same type of stuff that annoys Windows users and gets them thinking about buying a Mac next time. (Four people at work have already bought a new Mac specifically because of past problems with malicious code in Windows.)

Since OS X is based on UNIX, providing rock-solid security for non-security-conscious users shouldn't be any trouble at all. The mechanism is all there; all Apple needs to change is the policies of the default install, and nearly all users will be safe from crap like this.

First, downloaded files should, by default, not be opened automatically. If the user wishes to change this setting, it's the user's responsibility. Second, any downloaded files, bundles, scripts, etc., should not have the execute bit set by default. When the user tries to run it for the first time, OS X will ask for the password, like it does when you install X11 or Final Cut or something. Only then will the execute bit be set. This is not a small inconvenience; rather, it is a huge convenience. Sure, you have to type a password to run a downloaded program for the first time, but that's only as annoying as finding out the bank put an extra $10,000 in your account by mistake. And your computer won't suddenly acquire programs/spyware/malware/adware/viruses and other nice stuff that you didn't intend it to acquire. This is extremely convenient. It's an additional level of security for safety-conscious parents who use Tiger's new child-safety features. It's good for owners of computers with multiple users, who don't want people to run arbitrary code that came from God knows where.

Apple could and should take this a step further. At some point, people will find ways to screw up Macs with programs/spyware/malware/adware/viruses, especially if they become pretty popular. Apple could prevent this before it happens. Provide an online database of MD5 sums of binaries for OS X, and provide a mechanism in the OS to report bad software and where it came from. Perhaps people could post a comment with their claim. The system would be moderated by the community, so good software won't end up listed as bad. There are plenty of Mac zealots who would participate. When you try to run any program for the first time, whether it comes from the Internet, a CD, or wherever, OS X might first compute the MD5 sum and compare it to the online database. If the MD5 matches, OS X will warn the user and perhaps allow the user to browse the comments posted about this program. Comments like, "This program sends all keystrokes to the goatse site!" The user can then decide whether to run the program or clean it off the system. Not connected to the Internet? The database shouldn't be that large... When you install OS X, the latest version could be placed on the HDD, and when you connect, it could automatically update it. Bam... Pretty good protection against the spyware problem, BEFORE it comes to the Mac. Proactive... not reactive like the Microsoft crowd.

I use Macs, Linux, and the BSDs.

Re:Ouch!

[mrchaotica]

Yeah, but "unchecked" should be the default.

Re:Like everyone else in the tech industry,

[linguae]

Troll?

What is so great about the integration between Safari and Dashboard and what's so bad about the integration between Internet Explorer and ActiveX? Why should a web browser be allowed to automatically download and install certain types of programs remotely? These programs could access the Internet, too. I can see a lot of problems with this. Imagine widgets displaying pop-up adertisements, hardcore porn widgets, spyware widgets, you name it... I don't think that these widgets have the power to format hard drives, but the integration of the web broswer and external programs is very troublesome to me. Look no further than Internet Explorer and ActiveX if you want an example.

To say a kind of cleaned-up version of what the parent poster said, operating system and desktop designers and programmers should look very carefully about the features that they are adding to the program before they release it to the public. Security should be a major concern, especially if those programs are directly tied to network connections. Programs connected to the Internet should never be integrated with system functions such as installation; that's how you get Internet Explorer and ActiveX. I expected Apple to have a little more sense in feature consideration and design, but I was disappointed. Hopefully they fix this in Tiger 10.4.1 before this becomes more widespread.

This can't possibly be true

[rudy_wayne]

This can't possibly be true.

Everyone knows that Linux and OS X are perfect and only Windows has security exploits.

Let's get it right people! You're slipping!

Re:Install failed on my Mac!!! How to protect your

[Anonymous Coward]

Just setting the permissions to the ~/Library/Widget folder to "Read Only" will do the trick.

Of course, that doesn't mean that it should install widgets for you in the first place...

some guy in Russia

[Eric_Cartman_South_P]

"some guy in Russia"

Just find this guy and kick his ass. Problem fixed, no need to patch shit.

10.4.1

[cocoacow]

This is why apple is wating a little bit on releasing the first update to tiger, that way they will be able to nip all thoes nasty bugs and oversites in a nice update. Rest assured mac folks, this will get fixed Apple is really up on the security thing and they will problably set it up so that you are asked before installing any widgets. At least no matter how bad the fllaw is it isn't something that can comprimise the system itself.

Re:Whether it's a security problem or not,

[aristotle-dude]

How is this insightful? Having it on does not create a security hole. Security holes are created by flaws in the design but where is the real flaw here? All I see is FUD.

Re:Whether it's a security problem or not,

[stevejobsjr]

Watch Activity Monitor. It doesn't launch until the first time you call it up. Disable the key commands to bring it up and it'll never start.

Didn't work on my system

[1nhuman]

I do use Tiger and Safari, but it didn't work on my system. Primarily because in Safari > System Preferences > General, I Unchecked the check box that automatically open's up Safe files, which includes archives (which I do not consider safe).

Another thing I did, was to redirect downloads to a special download folder which has a special Folder Action attached that scans new files for viruses and then changes new files permissions to "No Access" (even if there are no viruses). If I want to open/read a downloaded file I have to change it permissions to read/write, for which I made a single-click Apple script that I dragged in the Finders top bar thingie. Ok I'm slightly paranoid, mainly because IT security is my thing (btw the reason why I switched to Mac OS X last year), But it works.

Important correction

[daveschroeder]

Well, it turns out I spoke too soon.

I said that Dashboard would prompt you when the widget was run for the first time. It turns out that for auto-installed Safari widgets, it does NOT prompt you the first time the widget is run.

Interesting.

This is indeed a security issue, and it should be made to at least prompt the user.

Considering that ALL other new widgets always prompt when first run, this appears to be a bug, and not the intended behavior.

The temporary fix (and what I always recommend anyway) is to disable "Open 'safe' files after downloading" in Safari.

Re:Whether it's a security problem or not,

[toddestan]

How is this insightful? Having it on does not create a security hole. Security holes are created by flaws in the design but where is the real flaw here? All I see is FUD.

FUD? What is one of the first things you should do to lock down any box? How about turning off any unnessecery services. Things that you can't turn off is one of things people blast Windows for all the time. Why should any other OS be any different?

And even if the program poses no risk, if I don't use it, why would I want it sitting there chewing up system resources?

Re:Ouch!

[Ender_Wiggin]

"Safe" files are supposed to be non-executable files. Safari preferences state "Safe files include movies, pictures, sounds, PDF and text documents, and disk images and other (ZIP, .Sit, .rar) archives."

Widgets seem to be considered "safe" but this could change in a patch.

Re:Ouch!

[LO0G]

So does IE. ActiveX controls have ALWAYS prompted.

And with XP SP2 (released in AUGUST) unsigned binaries simply can't be installed, and the default is "NO" for signed binaries...

Somebody thought they had a cool feature and didn't think about the consequences.

Re:Ouch!

[soulhuntre]

Um, never? Because it actually prompts you and asks you if you're sure you want to run it?

So the fact that IE does the same thing for, say, ActiveX and has similar options for control is consistently ignored on /. int he name of the great Jihad but a exactly similar (or worse) Apple problem gets apologists running.

So amusing.

Re:Sky not falling, Safari warns user twice.

[mithras the prophet]

Safari will warn you when downloading a widget with cocoa calls in it by saying "widgetname contains an application. Are you sure you want to continue downloading widgetname?". You have the option to abort download and installation.

Yes, but you won't get that prompt for a widget that doesn't have Cocoa code, but does contain widget.System() calls -- which effectively means it's an application. You could put an executable in your widget, not set the executable bit, but then chmod a+x and run it from widget.System() calls.

Dashboard will ask you the first time a third-party widget is run and give you the option of not running it.

It's so bizarre I didn't believe myself at first, but this is not true of widgets that are auto-installed. Try it yourself -- here is my example exploit page with an entire set of widgets that look identical to the Apple widgets. You will be prompted for permission with none of them, including the `Calculator' widget, which makes a widget.System() call and could conceivably have deleted your home directory.

Re:Ouch!

[mithras the prophet]

I think you already corrected yourself above, but for others reading this, no, it doesn't prompt the user before running an auto-installed widget, which is such a fantastically bad idea I can't believe it didn't occur to anyone what a security flaw that is.

Re:Ouch!

[peragrin]

First I have seen windows install software without the user being prompted right at work. They ask me when a pop up ad comes up and looks like a regular dialog box.

Second Active X is a cool feature and nobody thought of the consequences at MSFT. there were reports in the late 90's about active X showing it's potential for harm. It took a few years, but guess what people.

I will give MSFT this much at least a full third of the crap they have to deal with is stupid users. And stupid users can fsck up any OS.

It's just harder to maintain control when windows apps require admin settings.

First Moz, now this...

[MsGeek]

Today has really been a bad day for computer users. All we need next is Yet Another New Windows Exploit/Virus/Trojan/Worm and our day will be complete. :P

Re:Ouch!

[JudgeFurious]

Is it "exactly" or is it "similar"?

Or is it "worse"?

I'm confused here but I'm not running. Of course I'm not an apologist either.

Whether you're talking about IE or Safari the same thing holds true. Saying "yes" when you're prompted despite not knowing what you're installing means you're a fucking moron and you deserve whatever you get.

Re:Nice try

[bnenning]

But a trojan, a social engineering exploit that requires explicit and deliberate user action, is completely uninteresting. That will always be possible on all OSes and all platforms.

That's the thing; a good OS *should* be able to prevent those. The OS should be able to recognize that what claimed to be a screensaver is attempting to access your Quicken files and open a connection to somewhere in Russia, and it would probably be a good idea to deny that and let you know what's going on.

User education is a lost cause. An OS needs to be able to defend against trojans without relying on the user to be particularly intelligent. Unfortunately I have no idea how to actually implement that in a usable manner.

"Solution"

[Rosyna]

Yes, if goatse.cx is porn...

But either way, if you installed Paranoid Android (direct link) it will ask you to approve the url. And it is opensourced too.

Re:"Solution"

[Shisha]

Another temptorary solution is to run:

sudo chmod a-x /System/Library/CoreServices/Dock.app/Contents/Res ources/DashboardClient.app/Contents/MacOS/Dashboar dClient

in the Terminal. Of course this prevents all Widgets from running.

Re:Not an exploit

[drsmithy]

Except for one thing: the user has to EXPLICITLY GRANT it permission to run! Forget about the fact this is a Dashboard widget, or that he can write a goatse widget, or that he can make Dashboard unusable, etc etc etc. I don't CARE what the widget does. It can only do these things AFTER IT HAS BEEN GIVEN EXPLICIT PERMISSION TO RUN BY THE USER CLICKING "YES" IN A DIALOG BOX ASKING HIM/HER IF THEY'RE SURE THEY WANT TO RUN IT!

Millions of email viruses and Windows spyware rely on exactly the same thing. That doesn't appear to have slowed them down any. Hell, there was a not-insignificant outbreak of a particular Windows trojan that required users to extract it from a *password protected zip file* before running it.

Isn't it funny how the only "exploits" people can find for Mac OS X almost always exclusively revolve around social engineering, and never real flaws in the platform itself?

Nearly as funny as the people who hold up the 95%+ of Windows "vulnerabilities" that rely on social engineering as proof of its "insecurity".

Oh but it has, and you've proved part of my point

[EtherAlchemist]

Good thing it hasn't happened then.

Sure it has. Still does, past and present examples.

Joke or not, your comment is indicative of the denial most Mac users seem to live in- "If it's not Windows, it's secure" and "If I don't hear about it, I must be OK" but the fact is that Mac OS X uses BSD, BSD has holes == Mac OS X has holes. Mac OS X is written by people who want users to have the easiest possible experience using their Mac. As a result, some of the things in place to make usability easier open up holes. This is the same for any OS. Anytime you cater to the user first and security second (or later) you will always ALWAYS provide someone else a way in.

I have no problem with using one OS or another, I use whatever the hell I need to get the job done- to me it's a tool, not a lifestyle. As such, I make sure my tools are safe and pay attention when someone says my OS has a hole or exploit or vulnerability, rather than just refusing to believe it's true.

Afraid that won't work cuz...

[NoData]

IN SOVIET RUSSIA...some guy kicks ass of YOU!

(Oh christ, why? The karma, it burns like my shame)

Better yet

[GoddessEvilena]

If you hate the Dashboard and want to get rid of it, just throw Dashboard.app into the Trash and it will never launch again.

Installed?

[Mr Bubble]

Is this "installed" or just put into a certain directory.

If the widget auto-executed, then that would seem like a REALLY bad idea. But, if "installed" just means the widget is placed where Dashboard expects to find widgets, that seems less unsafe.

You would still have to consciously decide to activate the widget in Dashboard, right? At that point you're at the same security level as any widget regardless of where the browser put it on your system.

Still sounds funky, but not like the sky is falling.

Re:Oh but it has, and you've proved part of my poi

[EtherAlchemist]

Whatever. An exploit is an exploit. Patched or not, a hole is a fucking hole.

I use a Mac, I know damn well updates are up to ME to install if I choose so. Any exploit and vulnerability EVER found in a Mac still exists, simply releasing a patch DOES NOT MAKE IT GO AWAY.

Case in point, last week 20 patches for vulnerabilities for 10.3.9 were released. Those are fixed in 10.4. Does that mean the hole is plugged? NO. A patch was released and the new software doesn't have the flaw, but anyone still running 10.3.x without the patches installed is still at risk.

Is it stupid to not install the patch, yes, duh. And yet people on all OSes fail do to just that.

Want me to put up? HERE it's from the holy seat itself.

It's a fact, one you overlook so you can act like an ass instead. Do so if you want, but stop pretending Mac OS is invulnerable.

Why do we still have auto-installers in browsers?

[Animats]

The whole concept of browsers installing executables is just wrong. Microsoft created Active-X as a way to make sites incompatible with non-IE browsers and to fight Java, not because it was a useful idea. So then Mozilla goes and implements their own answer to Active-X for downloading and installing executable add-ons. Then Apple does the same.

Then these downloaded executables then get run with all the user's privileges, not in a jail or sandbox. Java may not be perfect, but at least Sun understood they had to run applets with less privileges than user applications.

How to protect yourself in ONE EASY STEP

[dspisak]

http://www.nonmundane.org/~dspisak/media/slashdot/ howtoprotect.png

Yeah this exploit is sorta lame, but its also trivial to plug in the meantime.

Dashboard tips

[Absentminded-Artist]

Fascinating article. I installed zaptastic_evil and was amused by it. Very annoying indeed. Widgets simply should not do this.

Just a few points of interest.

1) The widget may automatically download and get copied into the widgets folder, but it is not automatically installed onto the active dashboard. Therefor the user would have to manually click on it. Without knowing the widget is there, the user may not ever notice it. Of course, this is still a security risk, but this isn't the best way to propogate malware.

2) Widgets can be deleted manually as pointed out in the article by going into ~/Library/Widgets and removing the unwanted widget

3) The Dashboard can be reinitialized by killing the Dock. Those not familiar with terminal can just fire up Activity Monitor and kill the Dock there. The Dock immediately relaunches, then Dashboard reinitializes when it is launched again and the offending widgets are gone.

4) Apple should allow us to delete widgets from the dashboard, but the behavior when clicking and dragging a widget off of the Dashboard installs the widget instead of bringing up the delete puff of smoke. This behavior is at odds with every other taskbar/dock/menubar in OS X. I would recommend Apple change this.

5) We ARE dealing with Dashboard 1.0 so there are bound to be bugs needing to be squashed. Personally, I enjoy Dashboard but find it difficult to manage when there are too many widgets deployed. I find myself wishing for Exposé for Dashboard! LOL I also wish that widgets would reinitialize without force quiting the dock and that the dashboard would be a bit more dynamic. Sometimes deleted widgets take a while to disappear off the dashboard as well as newly installed widgets. I look forward to the upcoming 10.4.1 release.

Re:Dashboard tips

[Kyusaku Natsume]

Certainly the cleanup and prevention is easy, but the fact that Safari downloads automatically widgets without user intervention/request is incredibly stupid, even more than the autoinstall -this is already stupid-, the guys who put those "features" on an fairly secure, wonderful and useful system sould be fired; this is seer incompetence, and a disservice for the rest of the fine, great OS X team. What the hell where they thinking? This sould have been scrapped in the design phase of Dashboard.

I read this 5 hours ago and still I'm amazed. I say this has a -otherwise- happy mac user, and someone that made 6 friends switch to the mac.

Re:Oh but it has, and you've proved part of my poi

[BasilBrush]

The grandparent was right. There haven't been any exploits. Both you and the link you give confuses the concepts of exploit and vulnerability. Exploit != vulnerability. A vulnerability is only the potential or an exploit, and it often blocked by other security measures in a properly layered security system.

Re:Oh but it has, and you've proved part of my poi

[U96]

I use a Mac

We could tell from your beret.

Here's my plan -- I'll do what Apple hasn't done

[TomorrowPlusX]

When I installed Tiger I thought to myself "why hasn't apple provided a mechanism for Widget management?"

Secondly, I thought to myself "it would be so easy for a widget to do nasty things"

So, here's what I'm going to do: I'm going to write a preference pane to manage widgets. It'll come in a few phases:

Phase 1) Preference pane which will allow you to turn on/off particular widgets in your ~/Library/Widgets folder by moving turned-off widgets to, say, ~/Library/Widgets (Disabled). I just did a test and discovered that the parent process of Widgets is the Dock, which means that the Dashboard is just a Dock mechanism. So, killing the dock ( politely, even ) will give Dashboard a chance to reload, since the Dock restarts automatically.

Phase 2) Write a widget scanner -- something which greps the widget source for keywords like widget.System() and whatever parameters are required for custom binaries which widgets can run. Now, I recognize I can't tell *what* those calls do, but I can at least put up a big red exclamation point next to the widget in the preference pane saying "This widget is potentially dangerous"

Phase 3) Write a small bundled app to be packaged with the preference pane which associates itself with the .wdgt extension, and (somehow) gets higher association relevance than the Dock for execution. Then, when a widget is double-clicked on it gets copied directly into ~/Library/Widgets ( Disabled ) -- giving you the chance to enable it or not before the Dashboard gets it.

This sounds like a PITA, but Apple shoulda done this in the first place.

Apple: You're drunk on the perceived security of your platform. Don't keep making the stupid mistakes.

A -- potentially better -- option is to have something like an "approved" widget download area. Say, apple's servers, where you know widgets hosted there have been given the thumbs up. Doesn't Firefox do something sort of like this for extensions?

Re:Oh but it has, and you've proved part of my poi

[Anonymous Coward]

BSD has holes == Mac OS X has hole

Oh? And what part of the BSD subsystem has had holes? OSX uses a different kernel, all tcp/ip exploits are in the hands of OSX developers. All the exploits I've seen for Jaguar involve 3rd party software like sendmail and apache (exempting Apple's own software).

The reality is that while BSD has had some security issues (as does everything), few to none of them have to do with OSX.

Re:Oh but it has, and you've proved part of my poi

[mp3phish]

The grandparent was right. There haven't been any exploits. Both you and the link you give confuses the concepts of exploit and vulnerability.

Wow, have you got a lot to learn... Did you not read the article AT ALL? Claiming that the apple system is a "properly layered security system" is an opinion, not a fact. Some might agree it is more proper than windows XP. I'm not here to argue wether that is true or not. I'm here to argue that either 1) a properly layered security system doesn't give you a secure system or 2) the MacOS doesn't have a properly layered security system.

One of the above(or possibly both) is true. It is up to you to decide which and quit sitting up on your high horse thinking you are a god for using MacOS.

So turn it off

[__aafutm5472]

I meant they should fix it in not allowing an untrusted remote application to be downloaded on a local computer with no interaction from the user.

So turn off the ability. In Safari, open Preferences, and on the first tab, de-select 'automatically run "safe" files upon download.' Then, it'll download it, and you can manually install the widget by copying it to /Library/Widgets. No need to restart OS X or Dashboard, it just shows up.

This was one of the first things I tweaked after switching to a Mac. I noticed it'd automatically mount disk image files, and I could see the potential security implication, so I found the checkbox and tunred it off.

It's not rocket science, just basic research.