Slashdot Mirror
Safari "Carpet Bomb" Attack Code Released
snydeq writes "A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers. The source code can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks, security experts say. The public example of the attack code allows attackers to litter a victim's desktop with executable files, an attack known as 'carpet bombing.' In combination with bugs in Windows and Internet Explorer, attackers can run unauthorized software on a victim's computer."
RTFA. Actually, it looks like this is a windows problem. Safari automatically downloads a file to the desktop. Then when you start Internet Explorer it runs the file on your desktop and there is the problem.
So the real issue is that Safari can be told to automatically download a file while internet explorer will automatically run a malicious dll from the desktop. actual post and proof-of-concept code here.
seems like a misleading summary to me.
This is a _Windows_ Safari problem, not an _OS X_ Safari problem. And yes I RTFBlogPost.
Here are two very quick temp' workarounds for the issue.
1) Launch IE from a location other than your desktop (e.g. Start Menu, Quick Launch Tray).
2) Go to Program Files\Internet Explorer, Create Shortcut, and then place that shortcut on your desktop. Make sure the "Start In" setting is set to any location other than your Desktop.
So the real issue is that Safari can be told to automatically download a file while internet explorer will automatically run a malicious dll from the desktop. actual post and proof-of-concept code here.
seems like a misleading summary to me. IE won't run anything "automatically." It sounds like the problem is that Safari both autodownloads to the desktop and then tells IE to open that file on its next load.
"I zero-index my hamsters" - Willtor (147206)
Best workaround is to use Firefox.
The price is always right if someone else is paying.
IE will load its DLLs automatically. If the current PATH contains the DLL, IE will use that version instead of the system version.
Yep, I never spell check.
More incorrect spellings can be found he
The problem originated from an error that Windows Internet Explorer will load some program library files(DLL) from user's Desktop instead of its own library file folder(usually C:\WINDOWS\SYSTEM32). Apple's Safari for Windows downloads and saves requested file to user's Desktop by default - this default behavior itself does not constitute a mistake.
The 'workarounds' suggested by MS include "Change the download location of content in Safari to a newly created directory". I don't actually know what's going on with this, but it seems like it's IE opening an improperly-named (or maybe there's some bad meta-data that comes along with it?) file from the desktop, no matter how it got there.
Clearly the quickest way we can get Apple to fix this is to host this attack on all of our own websites, with the .exe in question being the uninstall program for Safari.
As soon as the attack centers on an Apple product, they'll start moving their ass. Until then, it's "not [their] problem".
Read Slashdot: Microsoft Urges Windows Users To Shun Safari - it explains what happens in more detail.
Basically, on Windows Safari automatically downloads files, in imitation of its behavior on OSX, but whereas on OSX it downloads them to a nice ~/Downloads directory on Windows it downloads them to the desktop. Also, on OSX Safari tags the downloaded file as 'unsafe', but it fails to use the Windows functionality to do the same on Windows. This leaves a whole load of files that you never asked for or wanted lying around on your computer in a state that is one step away from being executed.
This 'attack' allows a malicious person to force Safari to dump thousands of files on your desktop, which in and of itself is not a nice thing, but when coupled with other exploits it can lead to code execution of these files you never wanted in the first place - whether those exploits are patched by the vendor (Microsoft) or not, we both know that a significant portion of desktops are not kept fully up-to-date with security releases.
very informative.
If Windows has an "unsafe" flag for files, it should be used by Safari. Also, I find using desktop as default download space incredibly annoying (yes, i'm looking at you firefox).
That said, IE should also know better than to execute random files from the desktop, which seems like the nastier issue here.
I'd say it is a security flaw in Safari, but for different reasons. As the same blog explains, you could have Safari download an executable to the desktop that pretends to be e.g. Internet Explorer. If they normally launch IE from the desktop, they could click the fake IE next time, running arbitrary code.
Just FYI, it's not the browser-desktop integration causing the problem with IE, it's how the win32 dynamic linking mechanism works
Yes, the "Downloads" folder was introduced in 10.5.
Magic doesn't work in my presence. My power of disbelief is too strong.
First, read the article.
;)
;)
Second, this is about a Windows flaw that Safari has not addressed (rather Apple) in its current iteration. Apple's browser can be considered a "patsy" in this... and MS is trying to pass the buck (so to speak.)
Third, the "open safe files after downloading" is old news. Get a new schtick.
And Fourth, grow up. This isn't about Apple's security, it's about Microsoft's... and Apple's inability to prevent "stupid is as stupid does" on a Windows machine. They're good... just not miracle workers.
So yes, IE is in fact autoloading executables from the desktop. It's Safari's vulnerability to carpet bombing that sets the stage, but it's IE and Windows that cause the big boom.
This space intentionally left blank.
Is it this one? "While trying to load some of those files, it does not provide the full path of the DLL file to the function which loads the DLL file to the memory, and therefore Windows will search for this file in the user's machine using the directories provided in the PATH environment variable, and will load the first match it will found."
If so, why is %PROFILE%\Desktop in %PATH%?
Oh, no, it's this one: "While this is true, the behavior of the "DLL Search Order" (when it's disabled) is to look for the DLL in the current directory, right after the Internet Explorer's directory. As most users execute Internet Explorer from the Desktop, the current directory will be of course the user's Desktop (see screenshot below)."
Why is Internet Explorer's current directory the desktop?
It's not because Internet Explorer is in %PROFILE%\Desktop, because it isn't.
It's not because Internet Explorer is a shortcut on the Desktop, because that would run it with the current directory in the destination directory of the shortcut.
Perhaps it's because the Internet Explorer icon on the desktop is a special case, because of the browser-desktop integration?
Nah, that's crazy talk.
In this case Application B and the system are one in the same.
Regardless of what the default is in Safari or even Firefox, a user can still change that default to anything they want including the desktop.
As others have pointed out, the downloads folder is a Leopard specific feature used by Safari when running under Leopard and the executable warning thing is also a Leopard feature.
Jesus was a compassionate social conservative who called individuals to sin no more.
I'd call that a fundamental flaw with the Windows environment itself. It sounds like this "desktop" thing is used as both a temporary scratchpad for miscellaneous data from arbitrary untrusted sources, and as a repository for locally trusted executables. Someone at Microsoft needs to get it straight in their head, and figure out just what this "desktop" thing is for.
When I think of my experience with Unix-type systems, I don't think it has ever occurred to me to put PATH=/tmp in my .bashrc. I think I have done dumb things like PATH=. back in the 1980s when I was young and foolish and didn't know better, though. Personally, I think it's delightful that a bunch of teenage amateurs are trying to create an operating system. So what if they haven't yet learned what everyone else had known for decades? Let's not discourage their creativity with our stodgy pragmatism. Maybe some day it will really pay off. If they really think it all through and work hard, 2009 could be the year of the Windows desktop.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Personally I think the bigger issue is that Safari will auto-download, auto-mark-safe, and auto-run files silently. IE's broken too, but either one of the players involved could render this exploit moot. Let's see who responds first before stoning someone to death.
I still don't see why someone would be browsing around in safari and then open up IE. A regular user's likely to only use his favorite browser and a dev who needs to view the same site in multiple browsers would probably notice that there're a bunch of new .dll files all over the desktop.
This is exactly what is happening.
/Users/user/Downloads. Wouldn't be hard to change WinSafari to do the same, but it would almost be an admission of fault to all the IE fanboys.
And yet this is listed as a Safari flaw?
Come on, how insanely insecure is it to run executable code from the desktop! Hasn't windows had protection on the windows and system32 directories for about 6 billion years now for this very reason? And then they go and make it pull executable code from just about the least secure place on any PC.
From where I'm sitting this is a massively Microsoft problem, but their suggested "fix" is still the easiest solution by far. But its a bandaid to a gaping oversight.
Safari on the mac defaults to
Carpet bombing is still an issue, if for no reason than it is an annoyance.
But it is a Safari flaw. If I wrote a browser and released it for multiple OSs I'd consider it my responsibility to eliminate all possible security breaches individually for each version. Though I am an Apple user and really dislike MS, it seems to me that Apple simply didn't finish the job on their windows version of Safari. True, windows is a real PITA to port software to, with all the poor security choices MS has made -- but a job worth doing is a job worth doing properly. Users of WinSafari have a right to be upset about this, and Apple should fix it straight away. After all, no one's forcing them to code for windows.
Caveat Utilitor
I have no issue with a browser automatically downloading files. There is a reason quarantined dropboxes exist. If you're not smart enough to notice the difference between My Computer.exe and an authentic shortcut then that is entirely your fault.
This issue is about the execution of code WITHOUT user interaction.
You can have an argument about the pros and cons of the Safari Feature somewhere else. This is not the problem here.