Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apple To Patch Dashboard Vulnerability

Posted by Zonk on from the spackle-makes-a-world-of-difference dept.

bonch writes "Apple has quickly patched a previously reported security hole that allows websites to auto-install potentially malicious widgets without prompting the user. The fix is one of over three dozen miscellanous fixes to be included in OS X 10.4.1, code-named 'Atlanta', and may appear by the end of the week. Users will now be prompted before a widget downloads to their hard drive."

6 of 99 comments (clear)

  1. Re:They should post an advisory by allgood2 · · Score: 4, Informative

    Apple's already warned users about the "run safe files" function before. The warning indicated that average users should turn the function off, unless you ONLY downloaded files from known, "safe" sites. I had thought that they had released an update that had switch the default in Safari to remove the check from the "open safe files" box, but either Tiger changed that, or I was wrong.

  2. don't dismiss this one so fast by Heisenbug · · Score: 3, Informative

    The Dashboard behavior they're changing is the rough equivalent in Windows of visiting a web site and having an application (with disk access disabled) appear in your All Programs start menu without warning. If that happened, you can bet that we'd all be bitching about it, and it would be catching an awful lot of users off guard. By now it would be on all the juarez sites as a DDOS client, and probably doing some significant harm to sections of the internet ...

    I do think Apple handles security better than Microsoft, but in this case they simply were lucky that no one bothered to exploit their hole.

    1. Re:don't dismiss this one so fast by argent · · Score: 3, Informative
      Can you give me an example of a possible exploit?

      According to this page:

      Dashboard does not present a prompt before running a privileged widget that is one of the Library/Widgets folders, including our auto-installed widgets.

      If a widget contains a native Mach-O executable, Safari will present a warning before downloading the widget. However, because widgets in ~/Library/Widgets can run shell commands with the widget.system() call, this protection is easily defeated.

      And then, even if they fix this, are users going to refuse to allow what appears to be a system-provided widget to run?

      When Dashboard encounters two or more widgets with the same bundle identifier, it only displays the last one loaded. And -- you guessed it -- widgets in ~/Library/Widgets are loaded after the system-supplied widgets in /Library/Widgets.

      And finally, a sandboxed environment is one in which dangerous things are not possible. Not one in which dangerous things are only possible if a user approves them. And Dashboard's "sandbox" is the latter kind of environment, not the former.
  3. Re:If we were a Mac house... by remahl · · Score: 4, Informative
    when run in Dashboard they have all the same capabilities as local apps and need to be treated like any other applications.

    They don't actually. They only get complete system access after the user has acknowledged that the widget is being run for the first time.

  4. Re:A suggestion for improvement by geoffspear · · Score: 3, Informative

    It absolutely, positively, does NOT run them. It installs them in a directory, which is read when you click the big plus sign at the bottom of the Dashboard screen. They're only run if you click on them there.

    --
    Don't blame me; I'm never given mod points.
  5. Well, that's the new one. by argent · · Score: 3, Informative

    [The only mistake Apple made is] Automagically moving the downloaded widged directly into the dashboard widgets folder.

    That's the NEW mistake they made.

    The other mistake is the one they made in Safari 0.9 that they haven't yet fixed, and that is to let Safari "open safe files" automatically.

    What more do you want apple to do besides prompt the user and ask if they would like to install a downloaded widget?

    I want them to do less than that, actually. I want them to just download the widget and wait until the user chooses to install it, or not, and in the meantime leave it sitting in their Downloads folder not bothering anyone.

    Because dialog boxes asking users to confirm actions just annoy the user and train them to automatically answer "yes" when a dialog comes up. I see it happen all the time on Windows, some of my users have been infected after reflexively answering "yes" multiple times. NOBODY, though, has ever been infected after manually opening a downloaded virus more than once... because it's more of a deliberate conscious act than clicking on a "yes" button in a dialog you just want to get out of the way.