Slashdot Mirror
Safari Privacy Bug May Be Leaking Your Data
richi writes "If you use Safari, your browser may be leaking your private information to any website you visit. Jeremiah Grossman, the CTO of WhiteHat Security, has discovered some Very Bad News. I have some analysis and other reactions over at my Computerworld blog. The potential for spam and phishing is huge. A determined attacker might even be able to steal previously-entered customer data." In short, autofill for Web forms is enabled by default in Safari 4 / 5 (and remotely exploitable), and the data that this feature has access to includes the user's local address book — even if the information has never been entered into a Web form.
It seems that the bug is due to Safari allowing keyboard events to be generated from Javascript, so a malicious script can pretend to interact as if it were the user, whereas Firefox doesn't get fooled.
--
The Founder Conference is coming August 17
If that old canard is so true, than I have to wonder why it is that their are so many security-related issues with F/OSS browsers that go unchecked for so long? While IE was justifibly a laughing stock nowadays webkit and firefox are barely much better -despite the 'many eyes' theory.
Could it be that the job is simply to complex for most non-professionals and that the open source model has reached the end of it's useful life?
This reminds me of Windows. It's impossible to override certain key combinations like CTRL+ALT+DELETE.
It's kind of obvious: you don't let a program ever, imitate the user in the same context. Web browsers should never have been able to create windows 'outside' of the rendering area to boot (unless full screen)... browsers should never have been able to 'see' what the user sees in regard to links...Internet explorer showing contents of C:\...and so on...
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Safari leaks ON you !
Yours In Cupertino,
Kilgore Trout
Who fills out all their personal information into OS X's address/contact listing? I certainly don't
Would that have been before or after Eric Schmidt resigned Apple's board and they became sworn enemies? He didn't get mad because Steve started stalking him, did he?
Oh well, I'll hit submit in Safari now...
"If you use Safari,..."
Phew. That takes care of everyone.
Do detect this and charge them extra for your products accordingly?
But seriously, what are you doing after?
Read the EFF's Fair Use FAQ
This reminds me of Windows. It's impossible to override certain key combinations like CTRL+ALT+DELETE.
Is this true?
Odd coincidence, but last nioght I got a Windows
So basically, make a website with properly-named (and hidden) form elements, and have a form.submit on something that will likely be clicked? Or even a javascript on.change on the fields themselves?
Just don't hold it like that.
and the data that this feature has access to includes the user's local address book
The only card that can be read is the "Me" card, not the whole address book.
...unless, of course, they give me a free bumper for my MacBook.
The CB App. What's your 20?
It is just amazing that Jeremiah Grossman and his friends always come up with little shitty bugs and get hyped by media.
OMG... Safari has a P*R*I*V*A*C*Y bug.
Seriously guys. With every new Safari patch-day there are tons of REMOTE CODE EXECUTION holes fixed that not only endager your privacy but all of your data. I never see media praising the finders of these vulnerabilities. Or maybe they are just not advertise themself enough like Grossman and Friends.
... you are holding your Safari browsers the wrong way.
Gentoo Linux - another day, another USE flag.
The problem is that the people who use firefox are not cut from the same cloth as the people who develop it.
GCC is a robust and powerful compiler because the people who use it can fix it when it is broken and improve it.
The vast majority of those who use firefox and other such products are utterly incapable of fixing problems, or even of identifying when there is a problem.
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
The standard event model allows javascript to trigger events such as keystrokes.
Its easy to see why a browser obsessed with speed would just forward the API call to the internal event model. I can totally see the appeal and instinctive reaction to a situation like this; its clean, fast and simple coding - security is not often a big goal when you are initially just trying to get something working; even so, this could get missed by multiple eyes... Plus this is not part of webkit - its bridging the engine to the GUI; which is an unusual situation compared to the bulk of code - all the hard work is in the engine this just ties that to a GUI, quite likely there is a separation between working groups - obviously there is one since the engine is open source and the GUI is not. Their job is to bridge and probably do not get the level of attention as other aspects of the program.
I'm not letting them off the hook, this should have be caught within 1 version or during a security audit if there was one... and if there was:
1) was the attention given to the engine only?
2) do these people work on the code so they get tied up fixing bugs instead of just logging all the ones they uncover? (a lack of specialization)
Democracy Now! - uncensored, anti-establishment news
Apologies but could you repeat your message as I missed it the first time?
I was out with friends spending lots of money on a social life & beer since I don't spend it on overpriced designer hardware that makes me feel part of an elitist little club with permission to sneer derisively at anyone outside that club.
Gentoo Linux - another day, another USE flag.
Odd coincidence, but last nioght I got a Windows
Did it hurt?
and they are: Alan Jones, 9112 Tarquin Drive Luton New Hampshire, Bday Nov 3, 1970, SSN# 867-53-0909...
Arthur J. Smith, 30612 Jethro Lane, Biscuitbarrelville Connecticut,
James Walker, 26318 Adrian Telescope Road, Harpenden Maine
"Waste not one watt!" - CZ
Seems to me that autofill creates a database of personal information that is accessible by the Internet and dependent on a browser's security model. Does any kind of software have a worse record for security than Web browsers? (Maybe e-mail clients?)
The first thing I do in any browser is turn off autofill for all fields. Anything I need to type into a form is either already in my head or I can look it up easily (credit card number for instance). Either way, it's personal info that IMO does not need to be attached permanently to the Internet.
Build a man a fire, he's warm for one night. Set him on fire, and he's warm for the rest of his life.
And why should fullscreen get a pass?
Don't thank God, thank a doctor!
The only time the data is given to the browser is when you've already started typing it. Iirc you have to enter one field and then tab to the next. So if you're giving this data anyway it's not really a vulnerability. The only potential victims are people who start entering data and then decide not to. Worth paying attention to, but not exactly a huge problem.
or else!
I use it once in a while to test compatibility with web applications I'm developing, but even then I find it frustrating to use. Perhaps it is just the windows version, but buttons never respond quickly, in general the browser just feels slow and heavy, and the fact that F5 doesn't refresh a page annoys the hell out of me (as I use it constantly in every other browser). On top of that Safari renders everything in tables, and if you save a rendered snapshot of the page you get this one line table vomit which makes it impossible to figure out what exactly is going wrong. Chrome of course gives the same output, but at least the default developer tools in Chromium are decent. My last WTF point about Safari is something that Apple is obviously handling differently for their own products: JavaScript mouse events, including drags - Safari will immediately reclaim the mouse and not let you implement a JavaScript drag easily unless you use their 800 line device detection library script and then set up a CSS3 framework of all sorts of bizzare obviously not standard garbage. This is what you see if you are able to view the HTML5+CSS3 demos on the Apple web page. Sure it looks good and perhaps even makes sense on an Apple device - but the whole thing could be done in JavaScript even without HTML5 (we're doing it!) and 3D stuff should be handled in Canvas; NOT Apple brand "it's a standard because we say it is" CSS3. Just look at the source to those demos, we achieved similar functionality in less than a quarter of the code using only actual standards and it even works on IE7+ (but the drag does not work on Apple devices, and we have no intention of adding hundreds of lines of code to allow it to).
Its not impossible. Its just the default
I make enough money that I can do both because I have a real job because I know how to use a real computer. Now go back to your buddy's mothers basement and keep sucking down that Hamm's 30 pack you bought with tips from delivering pizza.
Only if the user invoked the fullscreenedness should it be permitted. I think in that way it would very difficult for software to 'fake' your desktop.
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Wonder when they will release a video of showing that all other browsers are also vulnerable (although different vulnerabilities).
Like I said - great well-paid job, lots of disposable income with no need to spend any of it on little white boxes with pictures of fruit on them, great long-term relationship & about to spend this coming weekend at a classic rock festival in London seeing some of my all time favourite musicians play.
I'm in a great mood & immune from the goading of trolls - have a GREAT day yourself!
Gentoo Linux - another day, another USE flag.
Yes, this sequence is trapped by the kernel and never delivered to normal userspace applications. On the original PC, as I recall, it was trapped by the keyboard controller and raised an interrupt, triggering a reboot if the OS didn't handle it. Windows always traps it and delivers it to a special privileged program. This makes it impossible to fake the Windows NT login screen. Faking something like xdm is easy, because it's just another program. The NT login screen requires you to hit control-alt-delete first - if you're already logged in then it will jump to the dialog for launching the task manager and a few other things.
I am TheRaven on Soylent News
I use it once in a while to test compatibility with web applications I'm developing, but even then I find it frustrating to use. Perhaps it is just the windows version, but buttons never respond quickly, in general the browser just feels slow and heavy, and the fact that F5 doesn't refresh a page annoys the hell out of me (as I use it constantly in every other browser)...
It's not just the windows version, on OS X the Safari reload shortcut is [cmd]+R. The reason for this is that on many Apple computers the F keys are accessed via an [fn] modifier button on the keyboard since their default function os for Volume/Media player/Sreen-brightness control etc. You can change them to work as F keys by default in System Preferences. You aren't complaining about Safari being broken you are complaining about it not behaving like a windows App which is not a bug, it's just different. I suppose one could argue that on Windows, Safari should behave like other Windows browsers. But then again I see the fact that it doesn't as a feature rather than a shortcoming. For me the windows Safari version gives me a Mac browser on that OS which does not force me to suffer the same annoyances as you are complaining about (unfamiliar shortcuts) whenever I am forced to abandon OS X for Windows.
...On top of that Safari renders everything in tables, and if you save a rendered snapshot of the page you get this one line table vomit which makes it impossible to figure out what exactly is going wrong. Chrome of course gives the same output, but at least the default developer tools in Chromium are decent. My last WTF point about Safari is something that Apple is obviously handling differently for their own products: JavaScript mouse events, including drags - Safari will immediately reclaim the mouse and not let you implement a JavaScript drag easily unless you use their 800 line device detection library script and then set up a CSS3 framework of all sorts of bizzare obviously not standard garbage. This is what you see if you are able to view the HTML5+CSS3 demos on the Apple web page. Sure it looks good and perhaps even makes sense on an Apple device - but the whole thing could be done in JavaScript even without HTML5 (we're doing it!) and 3D stuff should be handled in Canvas; NOT Apple brand "it's a standard because we say it is" CSS3. Just look at the source to those demos, we achieved similar functionality in less than a quarter of the code using only actual standards and it even works on IE7+ (but the drag does not work on Apple devices, and we have no intention of adding hundreds of lines of code to allow it to).
One could sing a song like that about practically every browser out there. Take for example the entire Microsoft IE series... but never mind that, thanks for reminding me why I hate developing web-applications.
Only to idiots, are orders laws.
-- Henning von Tresckow
I've never understood the Ctrl-Alt-Del thing on the windows login. Yeah if it comes up and asks for you to hit Ctrl-Alt-Del, you can be certain its the real login screen. But really, how many users are going to get a login screen and notice that it didn't ask for Ctrl-Alt-Del and then call up tech support? 99.9% of people will just enter their username and password and not take any notice.
Of course it is a challenge to educate users but at least this gives you the possibility to access a trusted path if you care? I don't use Windows but as I understood it this is one of the features that gnu/linux systems really should support, at least as an option.
"Internet Explorer, Firefox, Chrome, and Safari browsers are susceptible to attacks that allow webmasters to glean highly sensitive information about the people visiting their sites, including their full names, email addresses, location, and even stored passwords, a security researcher says."
although the exploits are different for each browser. Read more here
I thought everyone knew that the Safari is full of bugs?
It certainly is possible to override CTRL-ALT-DELETE.
Even something as basic as an Adobe 'Macromedia' Director projector can trap it using something like Meliorasoft's Keyboard Control Xtra"
But don't take my word for it.
The fullscreen idea is crippled anyway tha Macy way for zoomin as it was in pree MacOSX times i absolutely the best way and period.
Maybe linux has some vierd brance that behaves correctly as MacOSX does int not still better than windows on this issue.
I only boot Windows in a VM to test, I don't use windows regularly. And F5 is universal across a wide variety of interfaces, including nautilus and every other manager I can recall using on Linux, as well as Windows Explorer. The least they could have done was enable BOTH ctrl/cmd + R AND F5. Chrome by the way responds to F5. To me it still feels like Apple did it differently because they refuse to do things like everyone else (irrelevant of the result being good or bad).
As for web development, it's a nightmare. JavaScript sucks on every browser for several reasons:
No standard timeouts or waiting, you have to event chain
No "include" or "require" to allow you to include other scripts (there are hacks, but they all suck)
Loading is always handed to the browser, always asynchronous, and if the browser fails there is no standard event that fires
"document" and "window" are basically the same, but some browsers use one some the other... why not just define both of them to the same obejct!?
But seriously, Safari, NOT WebKit, does things in such a non standard and incompatible way that at this point we basically just test our applications in Safari last and see if we can fix them or at least make them run half-broken.
You're right but I just looked at the manual for that software: you need Administrator privileges to run that director plugin. After which you can run with normal privileges, in which case, if you're admin to begin with, you can do anything anyway, you don't need to use sneaky tactics like peeking at what the user sees or pretending to be the user.
The horse has bolted so to speak.
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Hey Hey Hey! We are not perfect, ALL browsers leak data....Here's a free browser bumper....
Then why mention fullscreenedness at all? That's a red herring. Do this instead:
Web browsers should never have been able to create windows 'outside' of the rendering area to boot (unless user-invoked)
Same applies to popups, no?
Don't thank God, thank a doctor!
By allowing popups to appear outside the page rendering area, i.e, the bit below your tab bar and browser GUI and with small borders, it gives websites free reign and ability to create realistic popup windows that imitate software of your system, so people get suckered into installing legitimate looking spyware.
I am sure there are ways to 'overlay' ontop of a fullscreen application to make it clear that it is in actual fact, a web page. Even a small bar notification saying: 'Activated full screen mode. [Ok] [Exit fullscreen]
There has to be distinctions between local and remote software somehow. Web sites can appear pixel perfect renditions of local software and that is the problem. The only way you can solve that problem is make it more obvious what is on the page and what is not.
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
By allowing popups to appear outside the page rendering area, i.e, the bit below your tab bar and browser GUI and with small borders, it gives websites free reign and ability to create realistic popup windows that imitate software of your system, so people get suckered into installing legitimate looking spyware.
Yes, I understand -- though there are things about those which make it obvious that they're browser-generated. But again, user-initiated is the key here. Current popup blockers do a good job, I think -- Chrome blocks popups, but makes it clear when a website has requested a popup and how to enable it.
A healthy amount of skepticism would also help. For example, if a website looks local, and is asking me for my bank details or twitter account, I'm going to wonder what kind of local spyware I have installed.
I am sure there are ways to 'overlay' ontop of a fullscreen application to make it clear that it is in actual fact, a web page. Even a small bar notification saying: 'Activated full screen mode. [Ok] [Exit fullscreen]
A what notification? Flash has a pretty decent approach, I think -- there's an overlay that appears onscreen which reminds you that you've entered fullscreen, and to press esc to exit.
Don't thank God, thank a doctor!
That's exactly the kind of notification I like. Either that or something similar but hopefully less annoying like the yellow bar in IE or Firefox nowadays.
When popups could set the positioning on your screen, that's a bad thing.
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Andy why do you need admin privileges? To install a kernel-mode driver! Even the admin users cannot directly trap CTRL-ALT-DELETE and the right to install new services/Drivers can be restricted even for administrator accounts (but in practice never is).
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524