Slashdot Mirror
Apple To Patch Dashboard Vulnerability
bonch writes "Apple has quickly patched a previously reported security hole that allows websites to auto-install potentially malicious widgets without prompting the user. The fix is one of over three dozen miscellanous fixes to be included in OS X 10.4.1, code-named 'Atlanta', and may appear by the end of the week. Users will now be prompted before a widget downloads to their hard drive."
Why Atlanta?
It's pretty stupid that Apple's policy prevents them from discussing the issue before they have a patch for Safari. They really ought to post an advisory urging users of their shiny new operating system to turn off the ``open safe files after downloading" preference in Safari. Considering that it's now established that malicious widgets can replace the Apple-supplied widgets, run with full user privileges once activated, and execute arbitrary binary code, Apple really owes it to its users to warn them.
four nine eighteen twenty-7 thirty-nine forty-7 fiftyeight sixty-nine seventy-9 eighty-8 one-hundred-and-nine one-twenty
I think that when a company releases a patch for this type of thing, they should also make the patch report attempts to abuse the exploit. That would make it possible not only to secure against the exploit, but to catch the black hats who try to use it.
So if a site tries to use the Mozilla/XPI script exploit to install a rogue extension, Mozilla should send a report to mozilla.org. Then they can blacklist the site, or even pursue legal action.
This would be GREAT for anti-spyware programs. When someone tries to auto-install spyware on to IE, Microsoft could get a report and the spyware company would feel the wrath of a monopolistic giant crushing them.
"fixes" means little things mostly.
Apple releases a new OS and the biggest thing people can find to bitch about is that if you have the auto-open option set, it auto-opens.
MS releases a new OS claiming great security and within a couple of months the internet is crippled by Blaster.
compare and contrast.
The Dashboard behavior they're changing is the rough equivalent in Windows of visiting a web site and having an application (with disk access disabled) appear in your All Programs start menu without warning. If that happened, you can bet that we'd all be bitching about it, and it would be catching an awful lot of users off guard. By now it would be on all the juarez sites as a DDOS client, and probably doing some significant harm to sections of the internet ...
I do think Apple handles security better than Microsoft, but in this case they simply were lucky that no one bothered to exploit their hole.
now if they'd quit bugging me every time I download a .dmg we'd be set!
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Microsoft doesn't release patches for 3 dozen problems.
Microsoft releases patches for thousands of problems at once. They are called service packs.
The only updates they release the rest of the time are security updates.
What's the worst that a malicious widget can do? Presumably it has access to the network, so it could be a DDOS client (as someone mentioned above). What can widgets do locally?
Free, legal music for iTunes users.
Someone discovers a nasty possibility, and in two days Apple announces a fix. It will be ready within a few more days and then the problem's gone for good.
I don't think it's hypocrtiical to praise that kind of fast response. If my memory serves, the problems that allowed the Blaster Worm and others to work were publically known for months and MS didn't do anything about them. That's where the condemnation of Microsoft comes from.
D
They don't actually. They only get complete system access after the user has acknowledged that the widget is being run for the first time.
If you were in charge of security of a Mac house, you would know better than to install 10.n.0 of any new OS X release on any of your company's computers. I never install a new version of X until at least 10.n.3.
"Was it a millionaire who said 'Imagine No Posessions?'" -- Elvis Costello
They only get complete system access after the user has acknowledged that the widget is being run for the first time.
1. That's not true. There is an attempt at a sandbox but it doesn't apply to Widgets that were installed through the hole in Safari and even if it did there's a hole in the sandbox you can drive a Perl interpreter through.
2. It wouldn't matter if they did, because confirmation dialogs aren't enough. Opening a document or other object in an unsandboxed environment must require an explicit request by the user. Having it appear in that environment with no indication that it came from an untrusted source is not good enough.
Actually in my mind this Dashboard security hole, while perhaps minor, is one of the most disappointing things Apple has ever done. The line continues to blur between surfing and running code -- or between documents and executables -- and this trend, while important, of course presents serious, inherent security challenges, since it places the user in a passive position with respect to the code being executed on their computer. It's disturbing that Apple apparently didn't think much at all about that very well-known issue, before creating an auto-install, auto-execute system for Javascript apps with file system access.
Isn't this the same major (and irrevocable) mistake that Microsoft made when they let the ActiveX genie out of the bottle? If Apple is going to walk into the same traps that Microsoft walked into years ago, it makes me question the purpose of OS X. Plus as an invention Dashboard isn't even as useful as ActiveX.
One simple solution, is obviously to turn off "Open Safe Files" in Safari, but that does make life a bit more difficult, so, for those who want to have their cake and eat it too (at least on this issue) I found it blindingly easy to add what I think should be closer to the default behavior - and it's not dependent on Safari.
1. Run "Folder Actions Setup" (in the Applications/Applescript folder).
2. (if it's not already on) Turn on "Enable Folder Actions".
3. Click the (+) button below the folder column to add a folder.
4. Select ~/Library/Widgets in the dialog that pops up for folder selection.
5. Then another dialog asks what action to take and presents a list of pre-made scripts.
6. Select the "add - new item alert.scpt". (click OK).
7. Close up the folder actions application - you're done.
After this, whenever anything gets put in that folder, the system will alert you that something has been placed in your widgets directory and ask if you want to see it. If you weren't expecting this, say if you visited some evil site and got "drive-by-downloaded" you'll at least get tipped to the situation and can either examine the contents of the widget (if you're a geek like me) or trash it without having to dig through anything. You could also go another step and have Applescript check the contents for certain keys within the widget (say looking for preferences that allow full system access) but I think this will suffice for most people until Apple addresses the problem head on.
There are already a couple packaged scripts that can set this up for people, but I like having done it myself and knowing what it itself is up to.
MSRP - Tax, Title & Licence Extra Your Milage May Vary
Automagically moving the downloaded widged directly into the dashboard widgets folder. Some of the responses here are suggesting that widgets in general are a securtity risk, well, so is every other application that you've installed on your machine. The assumption is that you won't install a malicitious application, well the same applies. It is up to the user to decide if an app is safe to install. What more do you want apple to do besides prompt the user and ask if they would like to install a downloaded widget? Yes, this is an issue right now, but I don't think this current issue, which will be fixed as mentioned above, makes Safari and Dashboard a security risk.
[The only mistake Apple made is] Automagically moving the downloaded widged directly into the dashboard widgets folder.
That's the NEW mistake they made.
The other mistake is the one they made in Safari 0.9 that they haven't yet fixed, and that is to let Safari "open safe files" automatically.
What more do you want apple to do besides prompt the user and ask if they would like to install a downloaded widget?
I want them to do less than that, actually. I want them to just download the widget and wait until the user chooses to install it, or not, and in the meantime leave it sitting in their Downloads folder not bothering anyone.
Because dialog boxes asking users to confirm actions just annoy the user and train them to automatically answer "yes" when a dialog comes up. I see it happen all the time on Windows, some of my users have been infected after reflexively answering "yes" multiple times. NOBODY, though, has ever been infected after manually opening a downloaded virus more than once... because it's more of a deliberate conscious act than clicking on a "yes" button in a dialog you just want to get out of the way.