Slashdot Mirror
Safari "Carpet Bomb" Attack Code Released
snydeq writes "A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers. The source code can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks, security experts say. The public example of the attack code allows attackers to litter a victim's desktop with executable files, an attack known as 'carpet bombing.' In combination with bugs in Windows and Internet Explorer, attackers can run unauthorized software on a victim's computer."
RTFA. Actually, it looks like this is a windows problem. Safari automatically downloads a file to the desktop. Then when you start Internet Explorer it runs the file on your desktop and there is the problem.
So the real issue is that Safari can be told to automatically download a file while internet explorer will automatically run a malicious dll from the desktop. actual post and proof-of-concept code here.
seems like a misleading summary to me.
This is a _Windows_ Safari problem, not an _OS X_ Safari problem. And yes I RTFBlogPost.
Here are two very quick temp' workarounds for the issue.
1) Launch IE from a location other than your desktop (e.g. Start Menu, Quick Launch Tray).
2) Go to Program Files\Internet Explorer, Create Shortcut, and then place that shortcut on your desktop. Make sure the "Start In" setting is set to any location other than your Desktop.
So the real issue is that Safari can be told to automatically download a file while internet explorer will automatically run a malicious dll from the desktop. actual post and proof-of-concept code here.
seems like a misleading summary to me. IE won't run anything "automatically." It sounds like the problem is that Safari both autodownloads to the desktop and then tells IE to open that file on its next load.
"I zero-index my hamsters" - Willtor (147206)
This is not a security flaw in Safari, it's using what SHOULD be no more than a DOS attack on Safari to make an attack on the longstanding security flaws inherent in the Windows browser-desktop integration. The same flaws can be attacks with minimal social engineering ... convincing a significant number of users to download a file despite any warnings is NOT a hard process... the majority of malware over the past decade that have used related flaws in the Windows security model have managed to propagate using social engineering tricks.
I am still boggled by the fact that Microsoft didn't fix the deep problems here ten years ago.
Best workaround is to use Firefox.
The price is always right if someone else is paying.
IE will load its DLLs automatically. If the current PATH contains the DLL, IE will use that version instead of the system version.
Yep, I never spell check.
More incorrect spellings can be found he
The problem originated from an error that Windows Internet Explorer will load some program library files(DLL) from user's Desktop instead of its own library file folder(usually C:\WINDOWS\SYSTEM32). Apple's Safari for Windows downloads and saves requested file to user's Desktop by default - this default behavior itself does not constitute a mistake.
The 'workarounds' suggested by MS include "Change the download location of content in Safari to a newly created directory". I don't actually know what's going on with this, but it seems like it's IE opening an improperly-named (or maybe there's some bad meta-data that comes along with it?) file from the desktop, no matter how it got there.
Clearly the quickest way we can get Apple to fix this is to host this attack on all of our own websites, with the .exe in question being the uninstall program for Safari.
As soon as the attack centers on an Apple product, they'll start moving their ass. Until then, it's "not [their] problem".
Read Slashdot: Microsoft Urges Windows Users To Shun Safari - it explains what happens in more detail.
Basically, on Windows Safari automatically downloads files, in imitation of its behavior on OSX, but whereas on OSX it downloads them to a nice ~/Downloads directory on Windows it downloads them to the desktop. Also, on OSX Safari tags the downloaded file as 'unsafe', but it fails to use the Windows functionality to do the same on Windows. This leaves a whole load of files that you never asked for or wanted lying around on your computer in a state that is one step away from being executed.
This 'attack' allows a malicious person to force Safari to dump thousands of files on your desktop, which in and of itself is not a nice thing, but when coupled with other exploits it can lead to code execution of these files you never wanted in the first place - whether those exploits are patched by the vendor (Microsoft) or not, we both know that a significant portion of desktops are not kept fully up-to-date with security releases.
very informative.
If Windows has an "unsafe" flag for files, it should be used by Safari. Also, I find using desktop as default download space incredibly annoying (yes, i'm looking at you firefox).
That said, IE should also know better than to execute random files from the desktop, which seems like the nastier issue here.
um safari at least for me downloads directly to the desktop. then again when the download finishes instead of auto opening the file OS X pops up a dialog to manual confirm that I downloaded an application/disk image/zip file. where as jpgs, gifs, pdfs just save automatically.
i thought once I was found, but it was only a dream.
Why oh why, in two-thousand-freaking-whatever, do we still have issues like this? It's bad enough that Apple has "Open 'safe' files after downloading" enabled by default (and yes, they are the ones who put 'safe' into quotes, so it's not like they don't know) and being set to download files without prompting for confirmation is just as bad. We're getting into MS "Hey, let's automatically run attached executables!" territory here. Internet-related things need to be secure by default, period. (Yes, I know 'secure' is not a single magical setting, but if the choice is between "convenient, but obviously a potential attack vector" and "has at least one step between 'click' and 'pwn3d!' " then the default setting should be for the more secure of the two.)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
No it doesn't. It downloads to ~/Desktop by default. You have to change that yourself. (Unless 10.5 has a new folder that 10.4 doesn't)
It doesn't mean much now, it's built for the future.
Yes, the "Downloads" folder was introduced in 10.5.
Magic doesn't work in my presence. My power of disbelief is too strong.
In Mac OS X 10.5 downloads are placed in ~/Downloads, and a shortcut to the downloads folder is automatically created in the Dock.
You can read about this functionality here.
It's been out since last year, which in Mac OS X release terms is quite a while (10.6 seeds are just being released). It would be wise to upgrade when updates for Mac OS X are available, there is a real point to upgrading, both for developers and end users, particularly because of the number of under the hod improvements each release has seen.
But you *need* IE for the attack to be successful, its as much if not more of a MS/IE problem then an Apple/Safari problem. Granted, Safari is needed for the attack, but it is IE that executes the attack much as if downloading something in Firefox and then having another program execute it, Firefox is needed but it isn't as much of Firefox's problem then the other software.
Taxation is legalized theft, no more, no less.
So yes, IE is in fact autoloading executables from the desktop. It's Safari's vulnerability to carpet bombing that sets the stage, but it's IE and Windows that cause the big boom.
This space intentionally left blank.
Sounds like a scope issue. Microsoft apps are designed to look for resources/references closer first, then further as needed.
For example, if IE needs to use mm.dll it will first look in the working folder, if it doesn't find it there, if will check the system's path variable and see if it can find the library in any of those folders.
In this specific case, if you are running Safari, it can auto download a new file, say, 'mm.dll' to your desktop. Safari doesn't care about it, BUT, the next time you start IE from the desktop (a shortcut on the desk top, not the quick launch or start menu), it treats the desktop folder as the working folder, and seeing that nice and shiny new mm.dll in it's working folder it doesn't bother to check the system's path variable to pull the real mm.dll out of the system32 folder.
At least, that would be my assumption of how this is happening.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
It shouldn't, but absent any idiotic vulnerabilities in other software, it's just an inconvenience to clean up the downloaded files. No damage is done.
In this case Application B and the system are one in the same.
Regardless of what the default is in Safari or even Firefox, a user can still change that default to anything they want including the desktop.
As others have pointed out, the downloads folder is a Leopard specific feature used by Safari when running under Leopard and the executable warning thing is also a Leopard feature.
Jesus was a compassionate social conservative who called individuals to sin no more.
It maybe shouldn't automatically download files by default. But I had better be able to tell it to automatically download files with certain MIME types -- I do not want a dialog box for every file I download.
Personally I think the bigger issue is that Safari will auto-download, auto-mark-safe, and auto-run files silently. IE's broken too, but either one of the players involved could render this exploit moot. Let's see who responds first before stoning someone to death.
I still don't see why someone would be browsing around in safari and then open up IE. A regular user's likely to only use his favorite browser and a dev who needs to view the same site in multiple browsers would probably notice that there're a bunch of new .dll files all over the desktop.
I prefer things downloaded to the desktop, too. However, my issue is that the files are downloaded automatically. Let's ignore the dll security flaw for a second. If Safari gains any significant traction among windows users, I guarantee that websites will use this as a vector for spamming you with ads and spyware. At a bare minimum it will be annoying.
In fact, I'm kindof surprised that the surlier parts of the web (warez sites and such) aren't already using this to dump porn ads on your desktop.
Carpet bombing is still an issue, if for no reason than it is an annoyance.
On Linux, $PATH generally only includes system directories, like /bin, /sbin, etc -- places only root can write to. Occasionally, it will add ~/bin, which the user can write to -- but which no sane browser would download to by default.
In the Windows command prompt -- and I bet this behavior is inherited from DOS -- the current directory is included in the path. I'm pretty sure it's implicitly included -- that is, no way to disable it by editing %PATH%.
My understanding is, the main reason PATH works this way is to make it always safe to be in a working directory. That is, "cd foo; ls" should always be safe. If you have '.' in the PATH, it's not safe to do this in a directory writable by people you don't trust -- they could always create a file named 'ls' which you would then run.
This just seems like a variation of the same -- it might make sense to look for DLLs in the directory containing the EXE, but I don't think it makes sense to look for DLLs in the current working directory.
Don't thank God, thank a doctor!
Safari shouldn't be downloading files without prompting the user. In this case it is a dll... but from what I understand it could just as easily be an trojan named something like "My Computer.exe".
Application A shouldn't download it without asking the user.
Application B is not setting its working directory correctly.
if its working directory was set correctly. Normally it is set to the directory that the application is in and definitely shouldn't be set to the user's desktop directory.
Or even pictures saying "Your computer has been hax0red by the DropJPEG trojan" or something.
We could also do our part, pushing an image that say something alone the lines of "Your Safari browser is not properly configured for download security, please change your default download directory to yadayda..."
Lars T.
To the guy who modded me down from perfect to terrible Karma - Apple haters still suck
That's a really crazy bug. Hey, here's a random dll on the desktop, let's load it in memory! WTF is with that?