Slashdot Log In
Apple Fixes Safari "Carpet Bomb" Windows Vulnerability
Posted by
kdawson
on Fri Jun 20, 2008 08:15 AM
from the no-more-carpet-tax dept.
from the no-more-carpet-tax dept.
Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."
Related Stories
[+]
Apple: Microsoft Urges Windows Users To Shun Safari 502 comments
benjymouse writes "The Register has picked up on a recent Microsoft security bulletin which urges Windows users to 'restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.' This controversy comes after Apple has officially refused to promise to do anything about the carpet bombing vulnerability in the Safari browser. Essentially, Apple does not see unsolicited downloads of hundreds or even thousands of executable files to users' desktops as being a security problem." Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you.
[+]
Apple: Safari "Carpet Bomb" Attack Code Released 118 comments
snydeq writes "A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers. The source code can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks, security experts say. The public example of the attack code allows attackers to litter a victim's desktop with executable files, an attack known as 'carpet bombing.' In combination with bugs in Windows and Internet Explorer, attackers can run unauthorized software on a victim's computer."
[+]
Safari "Carpet Bomb" Attack Still a Risk 117 comments
SecureThroughObscure writes "Just a short time after Apple's recent acknowledgment of and patch for the Safari Carpet Bomb 'blended' IE flaw, Microsoft researcher Billy Rios shows that Safari is still useful in a blended attack, this time with Firefox 2/3. (ZDNet's Nate McFeters also spread the word.) Rios claimed that he is able to use Carpet Bomb, despite the recent patch, to steal arbitrary files from victims who also have Firefox 2/3 installed. Both Rios and McFeters pointed out that Apple, which took some heat for not originally patching, actually did a good job of addressing the issue, as the code execution angle was not originally understood (the details came out later). Rios is withholding details of the new attack vector until Apple has had time to patch or respond to this issue."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
You mean? (Score:5, Funny)
You think the carpet bombers did this?
Face it man, that rug really tied the room together...
I installed the update... (Score:4, Funny)
And my computer rebooted into OS X. Not that I mind, really.
But did they fix the real bug? (Score:5, Insightful)
Re:But did they fix the real bug? (Score:5, Informative)
Parent
Re:But did they fix the real bug? (Score:4, Informative)
np: Seabear - Sailors Blue (The Ghost That Carried Us Away)
Parent
Re:But did they fix the real bug? (Score:5, Insightful)
Why would they need to "fix" it. It is operating as they prefer it, the same as all the software MS includes in Windows that most of us would prefer we did not have to install. Is it so difficult for you to uncheck that box if you're performing an update?
Parent
Re:But did they fix the real bug? (Score:5, Insightful)
Yes.
Recently, the Java update software has begun asking for the Open Office installer to be installed on the system during an update for Java. Several users at my company have clicked straight through and added more crap to their desktop/registry/uninstall information.
Can we blame the users for not reading every detail and not unchecking a checkbox? Yes.
Can we also blame software vendors who are relying on the aforementioned user behavior to add their software to your computer on the sly? Yes.
Its a bad practice and it needs to stop.
If something is required for the operation of a software package, default to selected.
If something is optional or not required for the operation of a software package, default to unselected.
Why are we allowing marketing to override good engineering?
Parent
Re: (Score:2)
Re: (Score:2)
Actually, I'm not. They don't want to hit me with that checkbox because I do pay attention to what comes up on my screen. So instead of getting an extra incidental hit for whatever they're pushing, they now have an annoyed customer. The people they're targeting with this is the people who won't notice that they're installing extra software.
So far Apple, Sun, and Daemon-Tools have all edged me away from their products because of this choice. Though I suppose you really can't be concerned with the dolphins ge
Re:But did they fix the real bug? (Score:5, Insightful)
The real question is why are you defending Apple's unethical bundling - when the same is performed by Microsoft we criticize it. Call a spade a spade or you look foolish. Face it, this kind of practice is unacceptable, whether or not it comes from your favorite company.
Parent
Re: (Score:2, Insightful)
I guess it's about as unethical as Microsoft forcing IE7 on all users who use automatic updates. If fact, Microsoft forces new stuff all the time this way.
Not defending it - just saying that Apple, Microsft and Sun all do this, so don't single out Apple as being unethical in this manner.
Re:But did they fix the real bug? (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Nevertheless, IE7 broke a bunch of stuff at my company. The IT folks spent a considerable amount of time and and energy getting everything on the intranet working with it.
I would strongly argue that IE7 was a new product with a similar name, and not an upgrade.
Re: (Score:2)
I installed Safari for Windows about a week after it came out. That was several months ago.
It was very clearly marked as "new software". It was not marked as an update to anything. I just checked on a different system, and Safari is still marked as "new software".
Re: (Score:2)
Did they fix the bug where Safari installs as an iTunes update? I'd say that that is a fairly severe bug right there.
More importantly, did they fix the ipod software itself? Every update cripples me even further without fixing what the previous broke (80GB gen 5).
I'm afraid of the next update, where I can only have 1 song total on it.
Believe me, the support is sub-par to say the least. The online help is very confusing: sc [imageshack.us]
Re: (Score:2)
Well, Safari isn't exactly embedded, but it's handy if you want to download Firefox or Opera and then make one of those your default browser...
What a stupid vulnerability (Score:3, Insightful)
It's pretty common that some badly configured web server will send content to me that firefox will then ask if I want to download.
Just letting it download and then moving on to the next file is...well such an obviously stupid behaviour.
Also, please don't let carpet bombing become the next security buzzword along with bricking and zero-day.
Re: (Score:2, Informative)
Just letting it download and then moving on to the next file is...well such an obviously stupid behaviour[sic].
I disagree. If I click a link to download something, well obviously I want to download it. Clicking a second time to confirm is an annoyance. Apple's solution is to let things download, but put them in the downloads folder and flag them as untrusted content from the internet (well not flag them as trusted, since the default is untrusted). That is to say, that is their solution on OS X. On Windows, there is no download folder and for some reason they screwed up and did not flag it as untrusted in Vista (XP
Re:What a stupid vulnerability (Score:4, Informative)
Actually, Windows has this as well.
If you download a file using Internet Explorer, an NTFS file attribute is set that marks it as "downloaded - untrusted". Double click the file and you get a popup asking "DO you want to run this executable?" with a popup and showing the executable properties (signed by, etc). Problem is, it requires that you run NTFS, and if you copy the file to a network server, that network server to support extended attributes. Use Firefox or other browser, and the attribute isn't set, or copy to a fileserver that doesn't support extended attributes, and it's lost.
(Most frustrating when you have to apply 12+ patches to a program that Microsoft Update doesn't have support for. I wrote a little bash script that shells out cmd.exe (was an MSI file) to do this, but you're still left with these popups).
As for OS X, I believe these notifications started in Leopard. They too are extended attributes, I believe. Though I think OS X copies attributes to filesystems/servers that don't support them by using dotfiles, so copying the file around doesn't get rid of it. (It goes away after you've approved it, though. No reason why Apple couldn't figure out what flag IE sets and have Safari do same on Windows, either.
Parent
Windows untrusted attribute in Firefox 3 (Score:2)
Re: (Score:2)
True, but that's not the only way to get it to download. As the proof of concept code [liudieyu.com] showed, all you have to do is put it inside a hidden iframe. If I go directly to a url ending in .dll, this might be excusable, but definitely not with an iframe.
Re: (Score:3, Informative)
Actually, Vista -does- have a specific Download folder now, for the record.
Did Microsoft fix the vulnerability in IE? (Score:2, Insightful)
Did Microsoft fix the vulnerability caused by Internet Explorer running with its current directory set to the Desktop and its library search path going through the Desktop? Because until they do that, the actual vulnerability in Windows that Safari made slightly easier to exploit still exists.
Re: (Score:3, Insightful)
The actual vulnerability is that Safari downloaded files without the user's permission. Trying to make this a Windows issue smacks of fanboyism.
You are both right. (Score:3, Informative)
It isn't a mutually exclusive situation. There are two disparate vulnerabilities here. By themselves they aren't that big of a threat , but when used in concert the threat is greater than the sum of it's parts. You need the IE issue to load the compromised dll and you need Safari in order to "secretly" download the compromised dll in the first place.
The IE flaw is a threat even without Safari. (Score:3, Interesting)
By themselves they aren't that big of a threat
Um, yes, the IE flaw *is* that big of a threat. There is no circumstance where it should EVER be acceptable for a downloaded file, whether with permissions or not (who other than a geek is going to worry about downloading a file called "somethingobscure.dll"?), to be AUTOMATICALLY executed just because of the name it's given.
I hope Microsoft fixes it bloody quick.
Re:Did Microsoft fix the vulnerability in IE? (Score:4, Insightful)
How did safari even get on most of those computers. I think people are seriously missing the big issue here.
Imagine if Netscape won the browser wars and you installed Windows Media Player which later on, in the middle of then night, downloaded and installed IE for you. If Office 2008 did this on OSX there would be riots in the street. When Apple does it, its of course Microsoft's fault.
Granted, there's a lot of blame to go around, but claiming this is a MS problem is being pretty unfair and only shows up that Apple can do anything, and few will complain.
Parent
Re: (Score:2)
Imagine if Netscape won the browser wars and you installed Windows Media Player which later on, in the middle of then night, downloaded and installed IE for you.
Except that iTunes didn't "in the middle of the night, download and install Safari".
However Microsoft did force IE into Windows, using techniques that created many inherent security flaws that we are still battling 11 years later, this being one of them.
Apple can do anything, and few will complain.
When Apple fucks up, I'll be the first to complain.
The actual vulnerability is in IE. (Score:4, Interesting)
The actual vulnerability is that Safari downloaded files without the user's permission.
Asking for permission before doing something that may potentially lead to a security exploit is no protection at all. Seriously. In the eight years between the time Microsoft introduced the browser-desktop merge, and the time I quit being a system admin and went back to programming, I had many many cases where some user (and these weren't dumb users, these were engineers and programmers with PhDs and patents to their name) would come to me and say "Peter, I just clicked the wrong button again, and I think I have a virus". That "again" is important. That means that they have the "Windows pops up stupid dialogs all the time so I have to approve this one" reflex burned into their cortex.
A user is not going to realize that a web page asking to download "someobscuregibberish.dll" is attacking them.
Stupid permission dialogs are no protection.
The actual vulnerability is twofold:
1. The path goes through the current directory by default, and it goes through the current directory first.
This is something that UNIX used to do, and it was widely recognized as a BAD idea by 1980. MS-DOS wasn't even out yet, let alone Windows.
2. The default download directory is the default directory of any program, let alone a program that is run virtually every time you log in.
This one is, well, beyond stupid. This is like having the mailslot in your front door connect to your safe deposit box. The directory that is MOST likely to contain malicious code is the one that you're MOST likely to be running code from on any given day.
Trying to make this a Windows issue smacks of fanboyism.
Name one other operating system or application where downloading files to the default download folder would cause them to be run, under any normal circumstances. The whole idea is completely insane.
Parent
Re: (Score:2)
Sure, Microsoft will fix this, in about 2 years.
I guess this proves how important they consider security these days. Does anybody still believe anything that they say? Yes, I really believe they have given up the fight over ODF.
Hmm? (Score:5, Insightful)
Safari downloads files (e.g. dynamic libraries) in user directories where the Internet Explorer could autoload them on start. Isn't the bigger problem within Internet Explorer? Why did Microsoft setup a library path to a user's directory at all?
Yes, the flaw is in IE. (Score:5, Informative)
Microsoft's library path ALWAYS goes through the current directory. For some obscure reason that IE icon on the Desktop, the one that isn't a shortcut but is actually something special Microsoft added back in 1997 to make it harder to remove IE, runs IE on the Desktop instead of in the IE install directory, the way it would if it was a shortcut.
It's all a side effect of Microsoft's shenanigans when they tried to use browser-desktop integration to make an end-run around their agreement with the US DoJ. That they've convinced people that the big news is a bug in Safari that makes it slightly easier to take advantage of this problem is, well, bizarre.
And now you know the rest of the story.
Parent
Re:Yes, the flaw is in IE. (Score:5, Interesting)
You can't get around this by avoiding the "special" IE icon, though. You can make a real shortcut, set the working directory to whatever you want, or even launch IE from its own program directory from a command prompt, and it will still consider the desktop to be the current directory.
As a fun experiment,
- copy cmd.exe to the desktop and rename it to notepad.exe
- launch IE the "safest" way you can think up
- view page source
YRMV, but in my tests with IE 6 and 7 in 2k and XP, it will launch the command prompt instead of notepad, and you can see the current directory and the stuff it prepends to the PATH variable.Until this is fixed in IE, I recommend copying notepad.exe and all your system .DLLs from the system32 directory onto each user's desktop, and use an ACL on each one to make sure your users do not have permission to overwrite them. No, seriously. (Or you could just use another browser.)
Parent
Re: (Score:3, Funny)
You can make a real shortcut, set the working directory to whatever you want, or even launch IE from its own program directory from a command prompt, and it will still consider the desktop to be the current directory.
Whiskey Tango Foxtrot?
Every time I think I'm being to hard on Microsoft, that I'm just being a cynical old fart, I come across something like this.
Holy Mother of Turing, what were they thinking of?
Re: (Score:2)
Microsoft's library path ALWAYS goes through the current directory.
This isn't true. If an application calls SetDllDirectory(), it overrides the search path. The order becomes:
The above function is highly useful to force a single specified path (it takes ONE path, not a list) early into the DLL load search order. It's pretty much necessary to use this to avoid getting screwe
Re: (Score:2)
Apologies for the reply-to-self, but I forgot to mention another important special-case use of SetDllDirectory(): if passed the empty string, it removes the current directory from the DLL search path. So even if your app doesn't require some particular directory to be 'blessed', this call can still mitigate a variety of DLL-related risks.
Re: (Score:2)
Will that also override the application search path going through the current directory?
Re: (Score:3, Interesting)
This issue has been avoided in UNIX systems for decades I believe. I remember when I was first learning about the command-line that I thought it was strange you couldn't just compile a new program and type $ a.out to launch it. That's because the current directory is not in the path. You have to type $ ./a.out to get the executable seen. The reason this is a system default is to prevent someone sneaking in a malicious copy of a system command such as ls into a directory where you'd accidentally use the fake
3 decades, to be precise... (Score:2)
We had regular warnings about not adding "." to $PATH when I was at Berkeley... in 1978.
Damn... (Score:3, Funny)
Re:Damn... (Score:4, Funny)
Parent
Amazed at the hubris in these comments (Score:2, Insightful)
While I am no Microsoft fan, I am amazed at the hubris of comments in this thread.
Surely anyone with half a brain HAS TO ADMIT that the Safari vulnerability is FAR WORSE than IE setting it's current path to the windows desktop.
In fact, the Safari vulnerability can be exploited for root access to the box without IE being in the equation AT ALL. Just pick some program or two that are likely to be installed on any user's computer ( iTunes, Firefox? ), and download .exe files with those names to the desktop. *B
Re:Amazed at the hubris in these comments (Score:4, Interesting)
Certainly not for the average Slashdot user and arguably not for anyone. Safari won't overwrite a user's existing icons, just add new ones. I also opens a download manager so users know something is being added. There are some pretty ignorant users out there, but not many that won't take not that some random Web site is downloading something called "Firefox.exe" to their desktop with an icon that looks just like their Web browser's. Finally, I notice you use the present tense. The ability to do this in Safari has been fixed, whereas the flaw with Windows has not. So, yeah I'd say the flaw in Windows is currently a FAR WORSE vulnerability, as you put it.
The main thing here, is the Safari flaw requires user interaction to work by itself, which means you have to manage a social engineering feat and get people to do something (double click and icon). With the flaw in Windows, any download from any source that they can get on a user's desktop can be automatically run.
Parent
Re: (Score:2, Insightful)
Safari won't overwrite a user's existing icons, just add new ones. I also opens a download manager so users know something is being added. There are some pretty ignorant users out there, but not many that won't take not that some random Web site is downloading something called "Firefox.exe" to their desktop with an icon that looks just like their Web browser's
This is a laugh an a half. I am pretty sure if I took an informal survey of my acquaintances many would not even know what a download manager was if
Re: (Score:2)
No, it's your user directory, one level up from your desktop. Much harder for crap to end up there by accident, though it does happen (fools are ingenious, etc.)
Running from the WIN+R prompt searches the path like it should, and will not run things from the desktop unless it's been added to the path.
Re: (Score:2)
I agree 100%. In fact, I'll go one step further and say that any application
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Almost as bad as having the desktop be a swamp of shortcuts to programs. Start menu anyone? Windows desktops of the average user remind me heavily of MySpace.
Re:"Carpet bomb"? (Score:4, Funny)
So if she's a squirter then you have an IED on your hands?
Parent