Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Urges Windows Users To Shun Safari

Posted by CowboyNeal on from the big-surprise-there dept.

benjymouse writes "The Register has picked up on a recent Microsoft security bulletin which urges Windows users to 'restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.' This controversy comes after Apple has officially refused to promise to do anything about the carpet bombing vulnerability in the Safari browser. Essentially, Apple does not see unsolicited downloads of hundreds or even thousands of executable files to users' desktops as being a security problem." Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you.

36 of 502 comments (clear)

  1. Accidentents. by Vectronic · · Score: 4, Insightful

    "Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you."

    With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]

    1. Re:Accidentents. by Anonymous Coward · · Score: 4, Interesting

      It doesn't take hundreds of files. It takes one file.

      According to Nate McFeters, Microsoft has a working "one click and the bad guy gets code running on your machine" exploit.

    2. Re:Accidentents. by dfm3 · · Score: 5, Insightful

      With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason] Or, even worse, on purpose.

      First, imagine how many people would just blindly click on a new desktop icon just to "see what it does".

      Second scenario, most Windows users I know keep file extensions off by default, and keep dozens of shortcuts to executables on their desktop among various folders, downloaded files, and other clutter. Now what if the downloaded file were named "safari.cgi" or "iTunes.cgi", but all the user sees is Safari with a generic file icon. I know many people who would think, "hmm, the icon to my internets is messed up" and click it anyway.
    3. Re:Accidentents. by Znork · · Score: 4, Interesting

      Why even bother with executing them? I can imagine a whole host of marketing people thinking this is a great way to obtain prime advertisement real-estate.

      Getting an icon on a users desktop is something some companies pay a lot of money for. In fact, the ability to spam any download folder is probably something they regard as worthwhile.

    4. Re:Accidentents. by kitgerrits · · Score: 4, Insightful

      As a Linux user, I have to point out one thing in Microsoft's defense:
      Lately, it seems to tag executables that have been downloaded and warns you about it when you try to run them.
      Apparently, Safari does not have this mechanism, so users might assume it's a valid local icon.

      I still run Firefox, though.

      --
      "I was in love with a beautiful blonde once, dear. She drove me to drink. It's the one thing I am indebted to her for."
    5. Re:Accidentents. by Hal_Porter · · Score: 5, Funny

      This won't give admin rights to the app. UAC to the rescue. If the Aliens in Independence Day had used Vista instead of OS X then UAC would have stopped the human virus running and they would have been able to complete their conquest of Earth.
      --
      echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
    6. Re:Accidentents. by Anonymous Coward · · Score: 4, Insightful

      Wrong. Anytime a browser can be made to download a file without the user agreeing to it it's a problem with the browser. Nice try though.

    7. Re:Accidentents. by thegnu · · Score: 4, Funny

      First, imagine how many people would just blindly click on a new desktop icon just to "see what it does". Well, if the icon is boobies, then about 49% of the population. If the icon is bunnies, however, I think it's much closer to 51%.
      --
      Please stop stalking me, bro.
    8. Re:Accidentents. by x_MeRLiN_x · · Score: 4, Informative

      When he says "recently", he means 6th August 2004; the release of Windows XP SP2.

    9. Re:Accidentents. by Firehed · · Score: 5, Funny

      What about bunnies with boobies?

      --
      How are sites slashdotted when nobody reads TFAs?
    10. Re:Accidentents. by billcopc · · Score: 5, Funny

      The world ends.

      --
      -Billco, Fnarg.com
    11. Re:Accidentents. by recoiledsnake · · Score: 4, Informative

      Wrong, Apple has been installing Safari on Windows users machine disguised as an update to iTunes/Quicktime. And iTunes has hundreds of millions of users. Even if 5% of them use Safari, it's a pretty big demographic.

      --
      This space for rent.
    12. Re:Accidentents. by MobyDisk · · Score: 5, Informative

      It's funny that you say that, because on my MacBook Pro it is the exact opposite. Safari does this and Internet Explorer does not.

      Under OS X, when you click an installer image downloaded by Safari it says something like "The application 'Whatever' was downloaded from the Internet on {date}. Are you sure this is safe to open?'

      I sometimes use IE on Windows (for testing sites I develop) and I've never seen a comparable message from Internet Explorer.

      Maybe you are talking about IE on Vista and Safari on Windows?

    13. Re:Accidentents. by recoiledsnake · · Score: 4, Insightful

      On OS X Leopard, any executable .app that is downloaded from the Internet requires your explicit permission in order to execute. So it does in Windows(even if downloaded through Firefox). It's just that Safari doesn't mark executables as 'Downloaded from the internet'. This has nothing to do with one OS vs. the other. It's just that Apple is not following proper Windows guidelines while Mozilla etc. do.
      --
      This space for rent.
    14. Re:Accidentents. by stewbacca · · Score: 4, Informative

      I think what he is saying is that OSX has a built in download manager, regardless of browser, so the user indeed DOES have to authorize downloads. If an OSX user gets carpet bombed, it's because they said "ok" at some point. You haven't been dumbed. You should try to be less snarky if you want people to take you more seriously. And try some capital letters while you are at it ;-)

    15. Re:Accidentents. by 93+Escort+Wagon · · Score: 4, Insightful

      So it does in Windows(even if downloaded through Firefox). It's just that Safari doesn't mark executables as 'Downloaded from the internet'. This has nothing to do with one OS vs. the other. It's just that Apple is not following proper Windows guidelines while Mozilla etc. do. As a Mac user, I get fed up whenever a company (usually Adobe) doesn't follow "proper procedure" - such as using their own proprietary installer that won't work correctly out of a non-admin account, or software that won't work at all unless you're an admin. It's not just annoying; it's a strike against security.

      So if this is realy true - if Microsoft has indicated files should be flagged thus, and provides an API that allows software to do that - then shame on Apple. They want their guidelines followed on their OS; so they should do the same for their Windows software.

      Basically it's the Golden Rule.
      --
      #DeleteChrome
  2. Re:Accidentents. --lol by Vectronic · · Score: 4, Funny

    Time for bed.

  3. Oh Microsoft... by Raian++3 · · Score: 4, Funny

    Talk about the stove calling the kettle black.

  4. Re:Wow. Just wow. by NewbieProgrammerMan · · Score: 5, Insightful

    Apple just needs to turn the tables and tell people to shun IE and use Firefox/Opera/what have you, is all. Or, maybe, you know, fix their security holes.
    --
    [b.belong('us') for b in bases if b.owner() == 'you']
  5. MS says shun Safari? by DrHackenbush · · Score: 5, Funny

    Finally, something I we can agree on.

  6. 1, 2, 3 ... SHUN! by Anonymous Coward · · Score: 5, Insightful

    Wow. Have to admit I'm on Microsoft's side here. Let's see:

    1. automatically download browser as an update whether user likes it or not;
    2. have the audacity to set the browser as default, again whether the user likes it or not;
    3. introduce vulnerability;
    4. ...
    5. errr, no.

    It's not just the vulnerability that hurts, but the compund bullshit caused by Apple's -- rather arrogant -- actions. This reads like something Microsoft would do!

    Also, vulnerabilities in Apple software (and this bug affects both Windows and Mac), make all *nix stuff look bad: watch MS shills roll out the 'Microsoft software is only vulnerable because hackers target it' FUD in short order.

    Posting as AC due to Apple fanboy-mods. Modding this down doesn't stop it being the truth.

    1. Re:1, 2, 3 ... SHUN! by Spy+der+Mann · · Score: 4, Interesting

      This reads like something Microsoft would do!


      And that's no wonder. Steve Jobs and Bill Gates were cut with the same scissors. Back in the 80's, while Billy kept stealing whatever idea he stumbled upon, Steve Jobs only thought of becoming more powerful and promote a competitive environment inside Apple, even if that destroyed the moral of his employees.

      Please do yourselves a favor and watch Pirates of Silicon Valley. It's an enlightening movie. And yes, Steve did even worse things, but they're too shocking to be mentioned in public.
  7. Such as...? by Animaether · · Score: 5, Informative

    A list of actual drive-by vulnerabilities in current Internet Explorer (name-calling went out of vogue when you reached the age of 15, man. You are at least 15, right?) that allow for code execution on the client to substantiate your claim, please.*

    Now if you want to point fingers, visit that Dhanjani link and read about the vulnerability he's not disclosing, as a courtesy to Apple; "The third issue I reported to Apple is a high risk vulnerability in Safari that can be used to remotely steal local files from the user's file system [...] it is a high risk issue affecting Safari on OSX and Windows". There hasn't been an update to that in the past 2 weeks, implying that it has not yet been fixed.

    The Slashdot headline is pure flamebait and you took it.

  8. Re:Wow. Just wow. by erikina · · Score: 5, Insightful

    Because they don't give you permission to? And even they did, no one would bother without the source.
    I think that anyone who gives a shit, has moved away from proprietary web browsers. (And yes, I'm aware their rendering engine is under GPL as it's based on KHTML or w/e)

  9. Re:Quality of links by esme · · Score: 4, Insightful

    some guy's blog

    That guy appears to be the one who discovered the vulnerabilities and reported them to Apple.

    Do you really think Slashdot shouldn't link to primary sources?

    -Esme

  10. Microsoft by kardelen133 · · Score: 4, Insightful

    Hi all I'm in the uncomfortable position of agreeing with Microsoft on this issue. If a browser (any browser) allows a website to randomly download files without the user's explicit permission, regardless of the location, it is a security issue in my opinion. Having said that, I take issue with Microsoft's security advisory. The only thing they say is: "What causes this threat? A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a userâ(TM)s machine without prompting, allowing them to be executed." OK, but how about telling us the how or why? Since it is a direct contributor which causes the blended threat, I don't think it's asking too much to want to know exactly "how the Windows desktop handles executables" and how that contributes to the threat. http://www.evden-eve-nakliyat.name.tr/

  11. Re:Wow. Just wow. by JanneM · · Score: 5, Insightful

    Or, maybe, you know, fix their security holes. It's Apple. By definition anything they make is perfect in any conceivable way. If Safari allows forced downloads of thousands of executables, then it is because all web clients really should, and Apple is the only company with the vision, the foresight, and the polo sweaters to implement it. Just ask any Apple fanboy in your neighbourhood; he'll tell you.
    --
    Trust the Computer. The Computer is your friend.
  12. Re:Wow. Just wow. by Zontar+The+Mindless · · Score: 4, Funny

    May I be the first to say:

    Whooosh

    --
    Il n'y a pas de Planet B.
  13. Re:doesn't work? by LuxFX · · Score: 4, Insightful

    Not a security bug? The downloaded files go directly to the desktop.

    So, what if a site triggers an automatic download of a file called "My Computer.exe" to an XP computer, using the typical My Computer icon. Will a casual user be able to tell the difference? One click will take them to My Computer, another might install a spam zombie. Now think of a user with 500 extra My Computer icons. Which do they choose?

    --
    Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
  14. Re:doesn't work? by that+this+is+not+und · · Score: 5, Funny

    Since I voted for George Bush (twice) and Bill Clinton (twice!) I classify MYSELF as a terrorist. I've certainly done enough damage to the country to sit the next election cycle or two out. heheh I need to be careful since whichever lame tool I vote for gets elected....

  15. Re:Wow. Just wow. by 99BottlesOfBeerInMyF · · Score: 4, Informative

    Just to clarify the cause effect relationship, that is not clear enough for me in the parent. KHTML, that is Konqueror's core, is open source, free software, and easily reusable. That's why Apple forked the project and uses it as a part of Safari.

    Just to clarify your clarification. Apple forked KHTML, which was developed by the Konquerer team, and named their fork WebKit, which is also free and open source. Since then, the developers of KHTML have decided to abandon KHTML in favor of WebKit themselves and are integrating WebKit into Konquerer. So Safari and Konqueror's rendering engine is named 'WebKit' not 'KHTML'.

  16. Re:Accidentents. --lol by DAldredge · · Score: 4, Informative

    From the linked article "Apple does not feel this is a issue they want to tackle at this time. In my most recent email to Apple, I suggested that they incorporate an option in Safari so the browser can be configured to ask the user before anything is downloaded to the local file system. Apple agreed it was a good suggestion: ...the ability to have a preference to "Ask me before downloading anything" is a good suggestion. We can file that as an enhancement request for the Safari team. Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. We want to set your expectations that this could take quite a while, if it ever gets incorporated. [credit to BK have-it-your-way Rios for suggesting the term "Carpet Bomb" to describe this issue]."

  17. Re:Accidentents. --lol by recoiledsnake · · Score: 4, Funny

    Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. You mean Apple actually has a HIG team for Windows applications like Quicktime, iTunes and Safari?????
    --
    This space for rent.
  18. I found this a bit more interesting by TubeSteak · · Score: 4, Funny

    I'd like to thank the Apple security team for ... and for letting me discuss these issues with the security community. ::raises hand::
    Teacher, may I go to the bathroom?

    What if Apple's security team had said no?
    --
    [Fuck Beta]
    o0t!
  19. Re:first! by tubapro12 · · Score: 5, Insightful
    I've already started exploiting this!!

    <?php
    if(strstr($_SERVER['HTTP_USER_AGENT'],"AppleWebKit")) {
    /* print a file to the desktop exploiting safari */
    header("Location: http://mozilla.mirrors.tds.net/pub/mozilla.org/firefox/releases/2.0.0.14/win32/en-US/Firefox%20Setup%202.0.0.14.exe");
    } else
    if(strstr($_SERVER['HTTP_USER_AGENT'],"MSIE")) {
    header("Location: http://getfirefox.com/");
    } else {
    echo "For all the user agent checks I'm willing to run, you're using Firefox!";
    }
    ?>
  20. Re:Blurry eyes! by Yvan256 · · Score: 4, Interesting

    "Apple generally believes that the goal of the algorithm should be to preserve the design of the typeface as much as possible, even at the cost of a little bit of blurriness.

    Microsoft generally believes that the shape of each letter should be hammered into pixel boundaries to prevent blur and improve readability, even at the cost of not being true to the typeface."

    http://technicalconclusions.wordpress.com/2007/08/23/subpixel-rendering/