Slashdot Mirror
Safari "Carpet Bomb" Attack Still a Risk
SecureThroughObscure writes "Just a short time after Apple's recent acknowledgment of and patch for the Safari Carpet Bomb 'blended' IE flaw, Microsoft researcher Billy Rios shows that Safari is still useful in a blended attack, this time with Firefox 2/3. (ZDNet's Nate McFeters also spread the word.) Rios claimed that he is able to use Carpet Bomb, despite the recent patch, to steal arbitrary files from victims who also have Firefox 2/3 installed. Both Rios and McFeters pointed out that Apple, which took some heat for not originally patching, actually did a good job of addressing the issue, as the code execution angle was not originally understood (the details came out later). Rios is withholding details of the new attack vector until Apple has had time to patch or respond to this issue."
Windows is still a complete security failure. It is not possible to secure with any kind of reasonable precautions. Nor can it be secured through strenuous efforts. It is not free, so you can't fix what you think is broken.
Friends don't help friends install M$ junk.
Having been accused of being a sock puppet and being blown out with malicious moderation, I think I'll act like one. Good on you, Twitter!
MS/IE must have done something to cause this problem in firefox 2 and 3 (?!) so nothing to see here. Move along.
I was probably like any other fifteen year old when I was growing up, seemingly aways having to fight off a hard-on. Maybe it was hormones, maybe it was because I was still a virgin, but my almost daily jack-off sessions didn't seem to help much. I still wanted to experience the feeling of my dick actually plunging into some beautiful young girl's tight, wet cunt. Hell, she didn't even have to be all that beautiful!
This feeling was driving me crazy. I HAD to have me a piece of ass soon, or I was simply gonna explode! I just couldn't keep out the thoughts of some young girl's pointed, jiggling tits slipping between my lips while my dick plowed between her moist slit.
My imagination, summer bikinis, and dad's PENTHOUSEs helped me to fill out my favorite fantasies of what the girls in my classes looked like naked. Those vivid images of beautiful, naked young girls coming into my room looking at my dick with lust, or my plopping them down on a desk right there in school and fucking our brains out seemed to dominate my every waking moment. Hell, even my nights were filled with wet dreams of these nubile young girls offering their naked bodies to me on sight!
The truth was I had never even seen a live naked girl since I was about seven-years-old playing doctor with a neigbor girl. Even then I didn't know what it was all about, just that my little dick got hard when I touched her bare pussy and that it felt REAL GOOD when she touched my hard dick. 'If only I new then what I know now,' I thought. Furthermore, I was much too shy to even approach a girl my age to ask for a date, much less to ask for a piece of ass or a blowjob.
I was sitting under a tree fretting about all of this one summer day, when I was startled by the voice of a young neighbor girl who had walked up behind me.
"What are you doing out here all by yourself?"
Pauline was a typical eleven-year-old, her body just beginning to show the first signs of maturing into an hourglass shape, but she still was flat-chested. Her personality had definitely not matured, and I even cosidered her to be quite a brat.
"Nothing much, just moping around," I told her.
"What's wrong?" she asked in a soft tone, touching my knee as she sat down beside me on the ground, her small skirt riding up her smooth legs.
I had never looked at her in a sexual way before, but the combination of my frustration and her uncharacteristic soft-spoken manner caused me to take a second look at her. She was actually a very pretty young girl, with long dark brown hair that flowed down onto her flat, preteen chest. Her innocent dark brown eyes looked deeply into mine as she pondered my troubles, and I began to get an idea on how I might exploit this budding motherly instinct of hers.
"Well......, it's just that a lot of the other guys my age have dated girls already," I began, "some of them have even had sex."
I paused to check her reaction. She was still sitting there looking at me intently, her knees pulled up near her chest and her arms draped around them casually leaving her skirt to gape open under her legs. I was sure that anyone passing by would be able to see her panties, but she didn't seem to be aware of her immodest pose.
"I'm just too shy to ask anyone out, though. I guess I'll never have the guts to either."
She sat there silently, bending her head down and resting her chin on her knees. She seemed to be in thought as she began to stare blankly at the ground in front of her, possibly wondering about her own lack of boyfriends and whether she too would ever have the experience of having sex one day.
"Have you ever wondered what it's like to have sex?" I asked her, hoping to guide the situation into a possible encounter. v She looked at me momentarily to see if I was sincere, or just trying to poke fun at her before answering.
"Well...., yeah...., sometimes...., but nobody really likes me much around here. All of the boys in my class just want to play by th
Assuming for a second you are not, it's very telling that your reply is exactly 2 minutes after twitter's post. More importantly, what exactly is the point of your reply? "Good on you"? More likely you are simply replying to your own post to see if you can bring attention to it, which is a game you've been playing for a while now.
being blown out with malicious moderation
I don't see anything malicious about this, you are being moderated negatively because you deserve it. It makes no difference how much you claim you are being "unfairly" targeted by misrepresenting and exaggerating what other people say about you.
The twitter monologues. Click on my homepage and be amazed.
You have to wonder if the people modding you down have a botnet of Windows computers and get to sneer twice about it. It is unlikely someone would use their own computers for this kind of thing.
It implies that Safari still has major problems, while the summary clearly states that this issue (that was discovered in Safari), is now found to affect FireFox 2/3. Further, it implies a situation completely opposite of what is stated lower in the summary, that Apple did a good first pass at squashing the attack, and that it is now better understood.
I think a more accurate headline would have stated that FireFox was found to be not immune to a security problem found in IE and Safari. Unfortunately, this would imply that there is a problem with an OSS piece of software (which will quickly be fixed).
-- Len
why do you insist on treating us as a group of idiots? how long do you figure you can keep this up? or are you just going to create more accounts to compliment the 12 or however many you have now?
Wow, an account that exemplifies moderation gaming. Tell me, do you do all of your work from a single computer at your house or do you have more professional tools?
Go on and tell me that Safari on Windows is somehow a bigger dissaster than Windows on it's own. If Windows allows remote code execution, anything can be used to load and run remote code, including the built in ftp client. Do you think of the Windows ftp client as a "Carpet Bomb" risk or is this pure marketing bullshit?
You are an idiot, John Marriot, but that has nothing to do with Slashdot now does it?
as long as you avoid Windows. Don't blame me, that's just the way things work.
I am twitter!
I've seen several people telling you idiots to can it already. Why is it that you insist on chasing and inadvertently glorifying Twitter? Every normal person is tired of this conversation and it's counterproductive even by your own twisted worldview. As one a target of your vindictive little Jihad, I've got more than my fair share of annoyance.
What are you trying to suppress anyway? Twitter said that Windows security sucks and this whole issue is some kind of Steve Ballmer fantasy. So what? it's obvious. Go ahead and use your little botnet to bury this comment too. It only serves to prove the point. Without a network full of Windows computers to exploit, you people would have nothing.
lol anti-slash? is that even active anymore?
You have assumed it was ever activly used by more than one person. Last I read, it's owner was bartending at the local country club. Trolling Slashdot might help the poor tech washout pay his bills.
Because these attacks don't happen on Mac or GNU/Linux, we can be sure they are only useful because of Windows flaws. The marketing people at Microsoft must have lost their minds to push this story, it only proves their OS is still not ready for networking.
No, *I* am twitter!
Actually, it's a botnet of Linux boxes. One or two Windows, I guess, and maybe a Mac, but for reliable mass moderation, free software's the way to go!
You're right, everyone is tired of this conversation. So why don't you JUST FUCKING STOP.
Seriously, it's old now. If you want to avoid being modded down for shilling yourself, why don't you stop fucking shilling yourself. Pick an account, any account. Maybe Odder, seeing as it seems to have the most karma right now. After that, stop lying and talking bollocks and you may find people start respecting you again. Until then, cut the shit and stop whining, just because people have figured out this pathetic little game of yours.
It would be nice to read through the comments on an article on Slashdot without having to read 5, 6, 7 posts of yours in a row talking to each other as if they were adding value to whatever point you're making.
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
It wouldn't be the first time I got the wrong end of the stick, but Rios blog seems to suggest that he has discovered a way to use the original "Carpet Bomb" issue with Firefox to steal user data.
He states that Apple have fixed their part, but seems to be saying that he won't reveal the Firefox issue because...
Mozilla is working on the issue and they've got a responsive team, so I'm sure we'll see a fix soon.
So what are Apple supposed to be patching or responding to?
Anyone else read the article (that way)?
I know you're joking... but IRL, swarms of Windows zombies are often managed by a rooted Linux box.
I am twitter AND Spartacus. Beat that.
We know about your sockpuppets and your shilling and everything else. You can stop now.
I'm absolutely not Twitter, but he is amazing don't you think?
I'm Just Another Twitter Sockpuppet, and I approve this message.
Twitter, I have a reasonable request for you: please stop the sockpuppetry and, more importantly, please stop the trolling.
You seem to take every chance you get to hijack a thread and turn it into Microsoft or Windows bashing, even when it's not the issue at hand. This doesn't help anybody. It especially doesn't help your cause of advocating Linux, and I don't know why you think it does. As a Linux user and advocate (Debian, lenny, if you must know), I wish you would stop. There are far more useful and intelligent ways to spread Linux.
You also use your sockpuppets to try to lend legitimacy to your posts. This definitely doesn't help your cause at all. This pretty much only serves to disrupt slashdot and cause people to turn against you. Everything all of your sockpuppets say could just as easily be said by a single person. The more legitimate posts could definitely be said by a single person, and you might actually get modded up once in a while.
Your habit of accusing everyone who disagrees with you an idiot or a paid troll doesn't help either. The former makes you appear to be an arrogant asshole, as it implies that your opinion is correct, period, and no other opinion is at all legitimate. The latter makes you appear paranoid. This definitely doesn't help you.
So, I have one reasonable solution for you, and I highly suggest you take it: make one more new account. Stop using the twitter account and all of the sock puppets. Never mention twitter or the sock puppets with the new account. Pretty much, ignore your entire slashdot history. Stop hijacking threads into Microsoft bashing. Stop calling Microsoft "M$". I can't really instruct you to change your writing style, so it's entirely likely that people will catch on that it's you again.
As long as you follow my advice in whole, they most likely won't call you on it. Most people here are reasonable, and they'll be happy to live and let live. Hell, if you follow my advice in full and people insist on stalking you, I will personally do my best to stop them. If that includes ruining their karma, so be it (I get 15 mod points at a rate of about once per week, so it wouldn't be particularly hard), but I'd rather not go that route.
Please, just take this advice, and we can make Slashdot a better place for everybody.
Remember, open source is free as in speech, not free as in bear.
The "carpet bombing" attack as i've heard it described is not a software flaw at all.
so they build a site that initiates a large quantity of downloads to your computer.. so what.
it's nothing more than being an a-hole web designer.
the fact it ends up on your desktop is because the user didn't change the windows default settings, and anything that happens from that point on regarding "accidental execution" of one of these littered files is the user's fault.
Why do we need a software nanny state. It's really disgusting that because of stupid people I have to go through 3 separate nags in osX in order to perform mundane tasks.
I'm sorry but user stupidity is not a valid excuse to make every app behave like clippy! "are you sure you want to do this?" "really?" "are you absolutely sure?"
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
He says that the attack he has found can be made without the carpet bomb...
Just as the attack on IE can.
Apple fixing the download-without-prompt attack won't do anything to fix the underlying problem, that just having a file sitting around in the default download directory on Windows can lead to code execution.
I suspect that the Firefox problem is similar.
No, therefore I aren't.
A horse can't be sick, you know, even if he wants to.
According to the blog post at http://xs-sniper.com/blog/2008/06/20/bk-on-safari-hunting-firefox/
"Mozilla is working on the issue and theyâ(TM)ve got a responsive team, so Iâ(TM)m sure weâ(TM)ll see a fix soon. "
This would imply that the remaining bug is a Firefox bug.
...err, what is Microsoft doing to fix their end of the problem? I mean, this (IIRC) only works if the victim has Microsoft Windows as their OS.
I mean, this isn't specifically to slam MSFT, but the guy who discovered this works... for Microsoft. The attack vector stops cold if the user is on OSX and/or Linux, but does work in Windows.
So, umm... what's Microsoft doing about this (assuming they can), Mr. Rios?
Quo usque tandem abutere, Nimbus, patientia nostra?
right, who comes up with these names for bugs. It's like any new way a bug or know issue happens it has to have some really STUPID war type name. This is clearly a flaw in the browser cacheing area. It would be a cacheing issue or a Content type cache bug.
The Days of IRC Nukes, Script kiddie FLOODS and all the rest of the wannabe lingo needs to halt so the more technical identifications can be warrented. //excuse the grammar/spelling, I'm almost asleep.
> Last I read, it's owner
Classic twitter.
When is MSFT going to implement cross-browser flagging of downloaded executables? When is MSFT going to patch IE to stop it from loading arbitrary DLLs from the desktop?
Jesus was a compassionate social conservative who called individuals to sin no more.
Except that NOTHING is clear:
http://xs-sniper.com/blog/
He is saying that the "Carpet Bomb" issue IS fixed, but that he is aware of three other methods to exploit interaction between Safari and Firefox.
He is giving out no details, no work-arounds and no advice on how to protect yourself. It's all a little bit vague.
I'm starting to suspect Shenanigans.
Who modded this guy insightful?
Who is this guy to think that the market should be catering to him instead of the millions of other people who aren't as wise with computers?
I think you are confusing stupidity with ignorance which is a big mistake. Just because someone isn't wise to all of the risks and no-nos in computers doesn't mean they are stupid. How much do you know about quantum physics or hispano-arabic literature? Because you lack knowledge in a field doesn't make you stupid.
The future of computers isn't every user learning so much more about computers but computers being more and more idiotproof. And these ignorant computer users are the majority of the market so guess where things are heading.
http://greenobyl.com/ please.... think of the children!!
No web browser should be able to download files to your computer without your approval.
NONE.
There is no excuse for this retarded behavior of Safari. No web browser except Safari ever allowed this.
I am the real twitter, and I've come to rule your world.
I have a better solution.
How about people stop replying going "This is a Twitter sockpuppet!" because
a) Nobody fucking cares
b) if all of these names are supposedly sockpuppets, replying and pointing it out FEEDS THE TROLL.
Of course, expecting this to happen is futile, so all I've done is write a special greasemonkey script. Anyone that replies and points out supposed Twitter sockpuppets have their posts disappear from my view permanently, because not even adding foes is enough to block the idiocy.
"We need to get over this notion, that, for Apple to win... Microsoft must lose." - Steve Jobs, 1997
Did someone strike a nerve, loser? You should ask for a raise to put up with that kind of abuse. Too bad you won't get it because you work for the biggest pricks on Earth.
http://slashdot.org/comments.pl?sid=216934&cid=17629948
Ah, but the twitter bashing for a certain species of slashdotter is a great way to karma-whore AND feed their moronic paranoid fantasies about the ideological bent of /., and what they have to do as a Keyboard Commando to combat it. I can only imagine the sense of delirious satisfaction they get by modding down every twitter post, and spying a potential twitter sockpuppet behind every ID that disagrees with them and their ilk. It's amazing to me that these clowns, having never have achieved a single worthwhile thing in any aspect of their sad, pathetic lives, choose to devote their energy trying to thwart a single slashdot poster.
This should be easy to patch: STOP USING WINDOWS!!
This whole thing was created by Microsoft. It does not exist on any other platform. They have created this issue because they can't stand another browser or any other perceived loss of control on their little platform.
The people from M$ don't like what Twitter has to say and they have censored him. He refuses to let that happen. It was not good enough for them to answer him in an open way and have done things to disrupt your ability to both hear him or foe him. They deserve ridicule and contempt. You may foe any account that displeases you but you will never know if it's him or someone else. His views are popular here and in the real world because M$'s business practices and poor quality software have soured everyone who uses Windows. This is not something PR firms can make dissapear.
No, I'm not Twitter, like you PR Idiots think everyone is. I'm simply sick of your bullshit and nerve. People are not going to do as you say, get used to it.
Intellectual property was the desert property of the twenth century.
I've gotten tired of the entire twitter thing, too. You'll note that I'm not just calling out sockpuppets like everyone else. I'm proposing the easiest and most reasonable way to end this thing. It's far easier to convince a single person to stop than to convince the however many that are following twitter, plain and simple.
Remember, open source is free as in speech, not free as in bear.
I'm finding this new messaging system well-nigh impossible to use.
For example you could use OSX as your desktop operating system.
When I click on a hyperlink, I want what its linked to to come down..
what do you want me to do, plead with curse to give me my addons?!
The problem is not apple's problem, hell it's not even microsoft's.
the problem is these people are misrepresenting a hyperlink as a web page when it's really a direct download link.
This does not mean I should be nagged because people are too dumb to say "I didn't request this file so i wont open it"
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
Everyone who wasn't an idiot learned not to do this when they were a toddler and reached out to touch the stove coils because they were pretty and glowing.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
No web browser should be able to download files to your computer without your approval.
NONE.
There is no excuse for this retarded behavior of Safari. No web browser except Safari ever allowed this.
Except Internet Explorer, but it's not so kind as to leave evidence of its downloading on your desktop.The AC I was answering was stating that not using Windows will mean "all productivity will shut down" and quote:
"Year of the Linux Desktop" my ass. And I was answering to that.Besides, I use Opera on Windows, Linux and Mac OSX.
There is no clicking involved here - it is a web page that can just spontaneously execute Javascript to initiate a file download, which just spontaneously appears on your desktop, with no user interaction AT ALL.
It is an obvious opera flaw.
Safari has a lot of things wrong with it. Firefox is a much better system. -Alan B Fabian