Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Malicious Web Pages Can Install Dashboard Widgets

Posted by timothy on Sun May 08, 2005 04:49 PM
from the not-good dept.
Security Businesses OS X Operating Systems Apple
bonch writes "If you're running Safari on OS X Tiger and go to this website, a 'slightly evil' Dashboard widget will be automatically downloaded and installed and can't be removed without manually removing the file from the Library folder and rebooting the computer. The widget is called Zaptastic and is a demonstration by the author of how easy it is to exploit Dashboard for nefarious purposes. The essay, released under the Creative Commons License, goes on to describe the many ways users can be taken advantage of--imagine porn sites auto-installing adware widgets without your knowledge." So if you're on a Mac, it would be smart to view that page with something other than Safari.
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Malicious Web Pages Can Install Dashboard Widgets 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • yes but... (Score:5, Funny)

    by Anonymous Coward on Sunday May 08 2005, @04:51PM (#12470934)
    magine porn sites auto-installing adware widgets without your knowledge.

    Yes, but do they install porn?
    -SJ53

  • Serves you right (Score:3, Funny)

    by th1ckasabr1ck (752151) on Sunday May 08 2005, @04:51PM (#12470936)
    If people would just run a secure OS like Linux or Windows, they wouldn't be hit with attacks like this. When will people learn?

    • Re:Serves you right (Score:5, Insightful)

      by Janitha (817744) on Sunday May 08 2005, @04:56PM (#12470980) Homepage
      There is no such thing is a secure OS, all Operating systems have flaws.

      • Re:Serves you right (Score:4, Insightful)

        by EtherAlchemist (789180) on Sunday May 08 2005, @05:17PM (#12471135)

        That's quite apt. And I imagine you will be modded down due to the OS in question here.

        When a Windows OS exploit is discovered there are thousands of zealots who scream "USE LINUX, STUPID" and "I use a Mac, there are not exploits for my OS" but whenever either of those OSes is found to have a flaw, those zealots are awfully quiet.

        The best thing for me reading the comments so far has been the Mac users who point out that settings can be changed to allow or deny this action. They treat that like it's a magic feature only Mac has, when the truth of the matter is shit like that can be turned off in Windows also.

        All of the common OSes can be locked down tight, IF THE USER CHOOSES TO. Every OS ships with the potential to be exploited, and even if it comes out the box secure, the user can always undo that.

        I guess the difference when it's a Mac OS, it's a big deal because someone actually bothered to write something malicious for a small segment of the computer population.

        This is actually a good thing though. It's lets all of you Mac users know that the security you've been takeing for granted is only as good as long as their is no attention to you.

        Looks like this is changing.

        • Re:Serves you right (Score:5, Insightful)

          by diamondsw (685967) on Sunday May 08 2005, @05:57PM (#12471460)
          No, because as you said, out of the box security is important. Mac OS X has no services running out of the box; Windows had several exploitable ones prior to XP SP2 (which I give them credit for doing a good job with).

          As for this vulnerability, it is Safari categorizing a Dashboard widget as "safe" when it clearly isn't. Yes, it's a vulnerability, one with an exploit already shown, and it needs to be fixed NOW. No one is saying Apple is perfect or OS X is immune, but so far there has been very little to point to in Apple's track record.

          What's really important is Apple's response. Anyone post this in RADAR yet? "As Seen On TV", any thoughts from your unique position?

          • Re:Serves you right (Score:4, Informative)

            by teh kurisu (701097) on Monday May 09 2005, @05:49AM (#12475557) Homepage

            No, it's Safari categorising a ZIP archive as safe. To quote Safari:

            "Safe" files include movies, pictures, sounds, PDF and text documents, and disk images and other archives.

            The ZIP archive extracts automatically, and just happens to place the file in ~/Library/Widgets/. Dashboard runs the Widget from there.

            You're right, it's not safe. I think the solution to this should be to first of all disable the whole opening safe files functionality by default. The second should be to declassify archive files as 'safe' (with the exception of disk images), because it makes it easy to write files in this way.

            Personally I've set administrator priveledges on my ~/Library/Widgets/ folder so that I now need to enter a password to write to it.


          • Good thing it hasn't happened then.

            Sure it has. Still does [secunia.com], past [utah.edu] and present [geek.com] examples.

            Joke or not, your comment is indicative of the denial most Mac users seem to live in- "If it's not Windows, it's secure" and "If I don't hear about it, I must be OK" but the fact is that Mac OS X uses BSD, BSD has holes == Mac OS X has holes. Mac OS X is written by people who want users to have the easiest possible experience using their Mac. As a result, some of the things in place to make usability easier open up holes. This is the same for any OS. Anytime you cater to the user first and security second (or later) you will always ALWAYS provide someone else a way in.

            I have no problem with using one OS or another, I use whatever the hell I need to get the job done- to me it's a tool, not a lifestyle. As such, I make sure my tools are safe and pay attention when someone says my OS has a hole or exploit or vulnerability, rather than just refusing to believe it's true.

            • Re:Oh but it has, and you've proved part of my poi (Score:4, Informative)

              by BasilBrush (643681) on Monday May 09 2005, @01:43AM (#12474305)
              The grandparent was right. There haven't been any exploits. Both you and the link you give confuses the concepts of exploit and vulnerability. Exploit != vulnerability. A vulnerability is only the potential or an exploit, and it often blocked by other security measures in a properly layered security system.

  • Firefox asks what to do (Score:3, Informative)

    by HermanAB (661181) on Sunday May 08 2005, @04:52PM (#12470941)
    with somethingorother.zip. Interesting, but not dangerous.

    • Re:Firefox asks what to do (Score:5, Informative)

      by Bungopolis (763083) on Sunday May 08 2005, @04:57PM (#12470985)
      This warning applies specifically to Safari. It's obviously not going to affect Firefox, because Firefox does not have the widget auto-installation feature that Safari does. Most users of Tiger, however, are probably using Safari, so this most certainly is dangerous.

  • widgets limited (Score:5, Informative)

    by RobertTaylor (444958) <roberttaylor1234&gmail,com> on Sunday May 08 2005, @04:53PM (#12470954) Homepage Journal
    this page [apple.com] at Apple's Developer Connection says that a 'widget' cannot ask for any resources or do anything to the filesystem outside of the widgets bundle.
    • True, true. But hasn't apple learned anything from MS? Automatically running/installing *anything* from the internet is a bad, bad idea. And a widget could, in theory, do things like make widget pop up ads, revolving goatse/tubgirl widget, etc.

      Basically, bad apple bad. Fix.
        • I meant they should fix it in not allowing an untrusted remote application to be downloaded on a local computer with no interaction from the user.

          • So turn it off (Score:4, Informative)

            by Sentar (188247) on Monday May 09 2005, @08:59AM (#12476791) Homepage
            I meant they should fix it in not allowing an untrusted remote application to be downloaded on a local computer with no interaction from the user.

            So turn off the ability. In Safari, open Preferences, and on the first tab, de-select 'automatically run "safe" files upon download.' Then, it'll download it, and you can manually install the widget by copying it to /Library/Widgets. No need to restart OS X or Dashboard, it just shows up.

            This was one of the first things I tweaked after switching to a Mac. I noticed it'd automatically mount disk image files, and I could see the potential security implication, so I found the checkbox and tunred it off.

            It's not rocket science, just basic research.

        • Re:widgets limited (Score:5, Interesting)

          by Arrgh (9406) on Sunday May 08 2005, @06:52PM (#12471959) Homepage Journal
          It's not a bad idea per se to automatically download and run stuff from the Internet, but any software designed to do so had better be designed and implemented properly. The dozens (hundreds?) of "cross-site scripting" bugs that have surfaced in popular browsers in the past few years are evidence that this is rarely done well. Java's [sun.com] 10 year old sandbox design has been quite successful, and Flash [macromedia.com] has followed a substantially similar design.

          Unfortunately, code signing, as currently implemented and (mis)understood by users, is an all-or-nothing proposition. There are certainly legitimate uses for privileged mobile code, but most users don't really read or understand security warning dialogs, they just think "I just clicked the Start Game button, and now it's asking me if I really want to Start the Game. How stupid."

          Marimba actually came up with a good partial solution ages ago. When their framework loaded and executed a Java app, the framework would closely manage exactly what resources could be exploited by the app. Each application's ability to read and write files was restricted by default to its own tiny corner of the filesystem, and the amount of space it could occupy with its files was constrained as well.

          Note that Java's security manager infrastructure has allowed these sorts of fine-grained controls since 1.2 (circa 1998), but no one to my knowledge has yet found a way to effectively communicate to a user:

          • what resources a given piece of mobile code will want to exploit;
          • what the risks of running it might be;
          • some assurance that the code is published by someone they trust;
          ...While maintaining some degree of user-friendliness. It's a tough problem.

          MSIE's concept of local policies set according to centrally defined security zones was a step in the right direction; it's too bad its development stalled when the Browser War was "won."

    • Re:widgets limited (Score:5, Interesting)

      by antibryce (124264) on Sunday May 08 2005, @05:02PM (#12471025)

      True, but widgets can run external programs if certain permissions are set. The most insane part is that the widget itself sets the permissions it's allowed to have. Putting a key in the Info.plist file with "AllowFullAccess" set to "Yes" will allow the widget to run anything, access the network, etc. Basically at that point it's a full featured app. How hard would it be to make a widget that's invisible but periodically queries Safari's browser history, or songs played in itunes, or do a spotlight search for "password" and email the results to some guy in Russia? The widget could even be invisible to the user, with a 1x1 transparent gif as it's screen.

      It seems really really dumb in this light to have Safari not only automatically download zip files, but uncompress them and if it finds a Widget bundle inside to install it. All without user intervention.

  • Too integrated (Score:5, Insightful)

    by m50d (797211) on Sunday May 08 2005, @04:53PM (#12470957) Homepage Journal
    This is what happens when you tie together parts of the OS that shouldn't be put together. In particular, has apple not realised that having the browser tied to anything that expects local rather than remote content is fundamentally an incredibly stupid idea?

  • In soviet russia (Score:4, Funny)

    by zkn (704992) on Sunday May 08 2005, @04:54PM (#12470958)
    Apple copies Microsoft.....

  • HAH! (Score:3, Funny)

    by JoeCommodore (567479) <larry@portcommodore.com> on Sunday May 08 2005, @04:54PM (#12470960) Homepage
    I'm running Jaguar!

    I can't afford to buy all the Apple "upgrades of the month."
  • If you do not tick the "open safe files" check box in the prefs. Which you should left unchecked if you're not entirely stupid, as there is no way to tell whether any file is actually "safe". Good Internet Practice, as I like to call it.

  • The solution (Score:5, Informative)

    by Little Grey (571460) on Sunday May 08 2005, @04:56PM (#12470979)
    Is to turn off "Open 'Safe' downloads" in Safari's Options.

    It's just common sense anyways

  • Awww...How cute! (Score:4, Funny)

    by justforaday (560408) on Sunday May 08 2005, @05:02PM (#12471022)
    Looks like he was nice and made us a goatse.cx widget [stephan.com]. Too bad I don't have Tiger yet... :'(

  • Several levels of control (Score:4, Insightful)

    by pelorus (463100) on Sunday May 08 2005, @05:07PM (#12471063)
    First, when a widget starts to download, Tiger prompts me and says "This download contains an application, do you want to continue?" That should be the first dead-giveaweay.

    Secondly, while the OS DOES copy downloaded widgets to the Widgets folder in the Users directory, the widgets do not become active until you actually activate them. (of course there's nothing stopping you from usign the same name and icon as ...say Calculator).

    Getting widgets to do complex system-level stuff you WANT them to do is tough enough.

  • O Great Oracle of Slashdot (Score:5, Funny)

    by Dachannien (617929) on Sunday May 08 2005, @05:13PM (#12471104)
    If there's anything that Slashdot has taught us, it's that it's never safe to use your computer.

  • Imagine it? (Score:4, Funny)

    by Anonymous Coward on Sunday May 08 2005, @05:20PM (#12471152)


    imagine porn sites auto-installing adware widgets without your knowledge

    Imagine it? I'm a Windows/IE user...I live it!

  • Thank God for Firefox and Windows (Score:4, Funny)

    by Pedrito (94783) on Sunday May 08 2005, @05:24PM (#12471186) Homepage
    I'm just glad I'm running Firefox [slashdot.org] under Windows. No need for me to worry about nefarious web sites.

  • This can't possibly be true (Score:4, Funny)

    by rudy_wayne (414635) on Sunday May 08 2005, @05:34PM (#12471258)
    This can't possibly be true.

    Everyone knows that Linux and OS X are perfect and only Windows has security exploits.

    Let's get it right people! You're slipping!

  • Didn't work on my system (Score:5, Interesting)

    by 1nhuman (597328) on Sunday May 08 2005, @06:15PM (#12471612)
    I do use Tiger and Safari, but it didn't work on my system. Primarily because in Safari > System Preferences > General, I Unchecked the check box that automatically open's up Safe files, which includes archives (which I do not consider safe).

    Another thing I did, was to redirect downloads to a special download folder which has a special Folder Action attached that scans new files for viruses and then changes new files permissions to "No Access" (even if there are no viruses). If I want to open/read a downloaded file I have to change it permissions to read/write, for which I made a single-click Apple script that I dragged in the Finders top bar thingie. Ok I'm slightly paranoid, mainly because IT security is my thing (btw the reason why I switched to Mac OS X last year), But it works.

  • Dashboard tips (Score:4, Informative)

    by Absentminded-Artist (560582) on Monday May 09 2005, @01:28AM (#12474219) Homepage
    Fascinating article. I installed zaptastic_evil and was amused by it. Very annoying indeed. Widgets simply should not do this.

    Just a few points of interest.

    1) The widget may automatically download and get copied into the widgets folder, but it is not automatically installed onto the active dashboard. Therefor the user would have to manually click on it. Without knowing the widget is there, the user may not ever notice it. Of course, this is still a security risk, but this isn't the best way to propogate malware.

    2) Widgets can be deleted manually as pointed out in the article by going into ~/Library/Widgets and removing the unwanted widget

    3) The Dashboard can be reinitialized by killing the Dock. Those not familiar with terminal can just fire up Activity Monitor and kill the Dock there. The Dock immediately relaunches, then Dashboard reinitializes when it is launched again and the offending widgets are gone.

    4) Apple should allow us to delete widgets from the dashboard, but the behavior when clicking and dragging a widget off of the Dashboard installs the widget instead of bringing up the delete puff of smoke. This behavior is at odds with every other taskbar/dock/menubar in OS X. I would recommend Apple change this.

    5) We ARE dealing with Dashboard 1.0 so there are bound to be bugs needing to be squashed. Personally, I enjoy Dashboard but find it difficult to manage when there are too many widgets deployed. I find myself wishing for Exposé for Dashboard! LOL I also wish that widgets would reinitialize without force quiting the dock and that the dashboard would be a bit more dynamic. Sometimes deleted widgets take a while to disappear off the dashboard as well as newly installed widgets. I look forward to the upcoming 10.4.1 release.

    • Re:Dashboard tips (Score:5, Insightful)

      by Kyusaku Natsume (1098) on Monday May 09 2005, @03:12AM (#12474655)
      Certainly the cleanup and prevention is easy, but the fact that Safari downloads automatically widgets without user intervention/request is incredibly stupid, even more than the autoinstall -this is already stupid-, the guys who put those "features" on an fairly secure, wonderful and useful system sould be fired; this is seer incompetence, and a disservice for the rest of the fine, great OS X team. What the hell where they thinking? This sould have been scrapped in the design phase of Dashboard.

      I read this 5 hours ago and still I'm amazed. I say this has a -otherwise- happy mac user, and someone that made 6 friends switch to the mac.
  • When I installed Tiger I thought to myself "why hasn't apple provided a mechanism for Widget management?"

    Secondly, I thought to myself "it would be so easy for a widget to do nasty things"

    So, here's what I'm going to do: I'm going to write a preference pane to manage widgets. It'll come in a few phases:

    Phase 1) Preference pane which will allow you to turn on/off particular widgets in your ~/Library/Widgets folder by moving turned-off widgets to, say, ~/Library/Widgets (Disabled). I just did a test and discovered that the parent process of Widgets is the Dock, which means that the Dashboard is just a Dock mechanism. So, killing the dock ( politely, even ) will give Dashboard a chance to reload, since the Dock restarts automatically.

    Phase 2) Write a widget scanner -- something which greps the widget source for keywords like widget.System() and whatever parameters are required for custom binaries which widgets can run. Now, I recognize I can't tell *what* those calls do, but I can at least put up a big red exclamation point next to the widget in the preference pane saying "This widget is potentially dangerous"

    Phase 3) Write a small bundled app to be packaged with the preference pane which associates itself with the .wdgt extension, and (somehow) gets higher association relevance than the Dock for execution. Then, when a widget is double-clicked on it gets copied directly into ~/Library/Widgets ( Disabled ) -- giving you the chance to enable it or not before the Dashboard gets it.

    This sounds like a PITA, but Apple shoulda done this in the first place.

    Apple: You're drunk on the perceived security of your platform. Don't keep making the stupid mistakes.

    A -- potentially better -- option is to have something like an "approved" widget download area. Say, apple's servers, where you know widgets hosted there have been given the thumbs up. Doesn't Firefox do something sort of like this for extensions?

    • Re:Thanks Slashdot! (Score:5, Funny)

      by jericho4.0 (565125) on Sunday May 08 2005, @05:01PM (#12471015)
      Oh. My. God. There's a zip file on your desktop. Holy Shit. A zip file, for Christ's sake! What will your fate be? Long and painful, or medium and painful? How will your family go on?

          • Re:Thanks Slashdot! (Score:4, Informative)

            by YrWrstNtmr (564987) on Sunday May 08 2005, @05:12PM (#12471096)
            FF can be set to d/l automatically. "Do this automatically for files like this from now on." If you've clicked that box in the past, zip files will be automagically downloaded. This will work for any filetype. Automatically play a .wav/mp3 file, or open a .doc, or d/l whatever.

            Dumb to do, but it can be set like that.

    • Re:Ouch! (Score:4, Informative)

      by justMichael (606509) on Sunday May 08 2005, @05:12PM (#12471101) Homepage
      That seems liek quite a security flaw... Any timeline on it being patched?
      Preferences -> General -> Open "safe" files after downloading (uncheck)

      Problem solved. Having that pref checked is asking for trouble. You can drop whatever you want in my downloads, I'll open it myself when I'm ready.

      Disclaimer: I am not running Tiger, so this may not be 100% correct.

      • Re:Ouch! (Score:5, Insightful)

        by mrchaotica (681592) on Sunday May 08 2005, @05:28PM (#12471211)
        Yeah, but "unchecked" should be the default.

              • Re:Ouch! (Score:5, Insightful)

                by LO0G (606364) on Sunday May 08 2005, @07:31PM (#12472238)
                So does IE. ActiveX controls have ALWAYS prompted.

                And with XP SP2 (released in AUGUST) unsigned binaries simply can't be installed, and the default is "NO" for signed binaries...

                Somebody thought they had a cool feature and didn't think about the consequences.

      • Re:Ouch! (Score:5, Insightful)

        by soulhuntre (52742) on Sunday May 08 2005, @07:40PM (#12472308) Homepage
        Um, never? Because it actually prompts you and asks you if you're sure you want to run it?

        So the fact that IE does the same thing for, say, ActiveX and has similar options for control is consistently ignored on /. int he name of the great Jihad but a exactly similar (or worse) Apple problem gets apologists running.

        So amusing.

        • Re:Ouch! (Score:4, Insightful)

          by JudgeFurious (455868) on Sunday May 08 2005, @09:17PM (#12472949)
          Is it "exactly" or is it "similar"?

          Or is it "worse"?

          I'm confused here but I'm not running. Of course I'm not an apologist either.

          Whether you're talking about IE or Safari the same thing holds true. Saying "yes" when you're prompted despite not knowing what you're installing means you're a fucking moron and you deserve whatever you get.

      • Re:Ouch! (Score:5, Informative)

        by mithras the prophet (579978) on Sunday May 08 2005, @08:01PM (#12472484) Homepage Journal
        I think you already corrected yourself above, but for others reading this, no, it doesn't prompt the user before running an auto-installed widget, which is such a fantastically bad idea I can't believe it didn't occur to anyone what a security flaw that is.

    • Important correction (Score:5, Informative)

      by daveschroeder (516195) * on Sunday May 08 2005, @06:26PM (#12471693)
      Well, it turns out I spoke too soon.

      I said that Dashboard would prompt you when the widget was run for the first time. It turns out that for auto-installed Safari widgets, it does NOT prompt you the first time the widget is run.

      Interesting.

      This is indeed a security issue, and it should be made to at least prompt the user.

      Considering that ALL other new widgets always prompt when first run, this appears to be a bug, and not the intended behavior.

      The temporary fix (and what I always recommend anyway) is to disable "Open 'safe' files after downloading" in Safari.
    • Safari will warn you when downloading a widget with cocoa calls in it by saying "widgetname contains an application. Are you sure you want to continue downloading widgetname?". You have the option to abort download and installation.

      Yes, but you won't get that prompt for a widget that doesn't have Cocoa code, but does contain widget.System() calls -- which effectively means it's an application. You could put an executable in your widget, not set the executable bit, but then chmod a+x and run it from widget.System() calls.

      Dashboard will ask you the first time a third-party widget is run and give you the option of not running it.

      It's so bizarre I didn't believe myself at first, but this is not true of widgets that are auto-installed. Try it yourself -- here is my example exploit page [columbia.edu] with an entire set of widgets that look identical to the Apple widgets. You will be prompted for permission with none of them, including the `Calculator' widget, which makes a widget.System() call and could conceivably have deleted your home directory.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.