Malicious Web Pages Can Install Dashboard Widgets

bonch writes "If you're running Safari on OS X Tiger and go to this website, a 'slightly evil' Dashboard widget will be automatically downloaded and installed and can't be removed without manually removing the file from the Library folder and rebooting the computer. The widget is called Zaptastic and is a demonstration by the author of how easy it is to exploit Dashboard for nefarious purposes. The essay, released under the Creative Commons License, goes on to describe the many ways users can be taken advantage of--imagine porn sites auto-installing adware widgets without your knowledge." So if you're on a Mac, it would be smart to view that page with something other than Safari.

yes but...

[by Anonymous Coward]

magine porn sites auto-installing adware widgets without your knowledge.

Yes, but do they install porn?
-SJ53

Re:yes but...

[mike518 (869465)]

"magine porn sites auto-installing adware widgets without your knowledge."

i dont need to imagine, im running windows xp.

widgets limited

[RobertTaylor (444958)]

this page [apple.com] at Apple's Developer Connection says that a 'widget' cannot ask for any resources or do anything to the filesystem outside of the widgets bundle.

Re:widgets limited

[ender81b (520454)]

True, true. But hasn't apple learned anything from MS? Automatically running/installing *anything* from the internet is a bad, bad idea. And a widget could, in theory, do things like make widget pop up ads, revolving goatse/tubgirl widget, etc.

Basically, bad apple bad. Fix.

Re:widgets limited

[ender81b (520454)]

I meant they should fix it in not allowing an untrusted remote application to be downloaded on a local computer with no interaction from the user.

Re:widgets limited

[Arrgh (9406)]

It's not a bad idea per se to automatically download and run stuff from the Internet, but any software designed to do so had better be designed and implemented properly. The dozens (hundreds?) of "cross-site scripting" bugs that have surfaced in popular browsers in the past few years are evidence that this is rarely done well. Java's [sun.com] 10 year old sandbox design has been quite successful, and Flash [macromedia.com] has followed a substantially similar design.

Unfortunately, code signing, as currently implemented and (mis)understood by users, is an all-or-nothing proposition. There are certainly legitimate uses for privileged mobile code, but most users don't really read or understand security warning dialogs, they just think "I just clicked the Start Game button, and now it's asking me if I really want to Start the Game. How stupid."

Marimba actually came up with a good partial solution ages ago. When their framework loaded and executed a Java app, the framework would closely manage exactly what resources could be exploited by the app. Each application's ability to read and write files was restricted by default to its own tiny corner of the filesystem, and the amount of space it could occupy with its files was constrained as well.

Note that Java's security manager infrastructure has allowed these sorts of fine-grained controls since 1.2 (circa 1998), but no one to my knowledge has yet found a way to effectively communicate to a user:

• what resources a given piece of mobile code will want to exploit;
• what the risks of running it might be;
• some assurance that the code is published by someone they trust;

...While maintaining some degree of user-friendliness. It's a tough problem.

MSIE's concept of local policies set according to centrally defined security zones was a step in the right direction; it's too bad its development stalled when the Browser War was "won."

Re:widgets limited

[antibryce (124264)]

True, but widgets can run external programs if certain permissions are set. The most insane part is that the widget itself sets the permissions it's allowed to have. Putting a key in the Info.plist file with "AllowFullAccess" set to "Yes" will allow the widget to run anything, access the network, etc. Basically at that point it's a full featured app. How hard would it be to make a widget that's invisible but periodically queries Safari's browser history, or songs played in itunes, or do a spotlight search for "password" and email the results to some guy in Russia? The widget could even be invisible to the user, with a 1x1 transparent gif as it's screen.

It seems really really dumb in this light to have Safari not only automatically download zip files, but uncompress them and if it finds a Widget bundle inside to install it. All without user intervention.

Too integrated

[m50d (797211)]

This is what happens when you tie together parts of the OS that shouldn't be put together. In particular, has apple not realised that having the browser tied to anything that expects local rather than remote content is fundamentally an incredibly stupid idea?

Not much of a problem...

[InternationalCow (681980)]

If you do not tick the "open safe files" check box in the prefs. Which you should left unchecked if you're not entirely stupid, as there is no way to tell whether any file is actually "safe". Good Internet Practice, as I like to call it.

Re:Not much of a problem...

[by Anonymous Coward]

No, it should be pretty easy to tell what is a "safe" file. PDF, for example, is a safe file, as is HTML, as is a GIF. A dashboard widget is NOT.

Apple really screwed up with allowing dashboard widgets to be listed as a "safe" file and they need to patch this as soon as possible. This is one of the big problems with IE, that they went from "autoopen anything, even unsafe stuff" to "warn you about viruses when you try to download ANYTHING, including a PDF". Clearly identifying what is safe is as important as identifying what is unsafe, otherwise people just double-click everything they download not realizing it's a .app.

Re:Not much of a problem...

[Mike McTernan (260224)]

Which you should left unchecked if you're not entirely stupid

I always thought that one of Apple's selling points was that they are made for non-experts. So giving users an option to potentially shoot their foot off seems to be a little unfortunate. Almost by definition, few people are experts.

The solution

[Little Grey (571460)]

Is to turn off "Open 'Safe' downloads" in Safari's Options.

It's just common sense anyways

Re:The solution

[ender81b (520454)]

The solution to spyware on windows is to turn off activex in internet explorer and set it to run as guest...

It's just common sense.

Seriously though this is a very bad idea and apple needs to fix this ASAP.

O Great Oracle of Slashdot

[Dachannien (617929)]

If there's anything that Slashdot has taught us, it's that it's never safe to use your computer.

Didn't work on my system

[1nhuman (597328)]

I do use Tiger and Safari, but it didn't work on my system. Primarily because in Safari > System Preferences > General, I Unchecked the check box that automatically open's up Safe files, which includes archives (which I do not consider safe).

Another thing I did, was to redirect downloads to a special download folder which has a special Folder Action attached that scans new files for viruses and then changes new files permissions to "No Access" (even if there are no viruses). If I want to open/read a downloaded file I have to change it permissions to read/write, for which I made a single-click Apple script that I dragged in the Finders top bar thingie. Ok I'm slightly paranoid, mainly because IT security is my thing (btw the reason why I switched to Mac OS X last year), But it works.

Re:Serves you right

[Janitha (817744)]

There is no such thing is a secure OS, all Operating systems have flaws.

Re:Serves you right

[diamondsw (685967)]

No, because as you said, out of the box security is important. Mac OS X has no services running out of the box; Windows had several exploitable ones prior to XP SP2 (which I give them credit for doing a good job with).

As for this vulnerability, it is Safari categorizing a Dashboard widget as "safe" when it clearly isn't. Yes, it's a vulnerability, one with an exploit already shown, and it needs to be fixed NOW. No one is saying Apple is perfect or OS X is immune, but so far there has been very little to point to in Apple's track record.

What's really important is Apple's response. Anyone post this in RADAR yet? "As Seen On TV", any thoughts from your unique position?

Re:Firefox asks what to do

[Bungopolis (763083)]

This warning applies specifically to Safari. It's obviously not going to affect Firefox, because Firefox does not have the widget auto-installation feature that Safari does. Most users of Tiger, however, are probably using Safari, so this most certainly is dangerous.

Re:Thanks Slashdot!

[jericho4.0 (565125)]

Oh. My. God. There's a zip file on your desktop. Holy Shit. A zip file, for Christ's sake! What will your fate be? Long and painful, or medium and painful? How will your family go on?

Re:Ouch!

[mrchaotica (681592)]

Yeah, but "unchecked" should be the default.

Re:Ouch!

[LO0G (606364)]

So does IE. ActiveX controls have ALWAYS prompted.

And with XP SP2 (released in AUGUST) unsigned binaries simply can't be installed, and the default is "NO" for signed binaries...

Somebody thought they had a cool feature and didn't think about the consequences.

Re:Ouch!

[soulhuntre (52742)]

Um, never? Because it actually prompts you and asks you if you're sure you want to run it?

So the fact that IE does the same thing for, say, ActiveX and has similar options for control is consistently ignored on /. int he name of the great Jihad but a exactly similar (or worse) Apple problem gets apologists running.

So amusing.

Re:Ouch!

[mithras the prophet (579978)]

I think you already corrected yourself above, but for others reading this, no, it doesn't prompt the user before running an auto-installed widget, which is such a fantastically bad idea I can't believe it didn't occur to anyone what a security flaw that is.

Important correction

[daveschroeder (516195)]

Well, it turns out I spoke too soon.

I said that Dashboard would prompt you when the widget was run for the first time. It turns out that for auto-installed Safari widgets, it does NOT prompt you the first time the widget is run.

Interesting.

This is indeed a security issue, and it should be made to at least prompt the user.

Considering that ALL other new widgets always prompt when first run, this appears to be a bug, and not the intended behavior.

The temporary fix (and what I always recommend anyway) is to disable "Open 'safe' files after downloading" in Safari.

Re:Sky not falling, Safari warns user twice.

[mithras the prophet (579978)]

Safari will warn you when downloading a widget with cocoa calls in it by saying "widgetname contains an application. Are you sure you want to continue downloading widgetname?". You have the option to abort download and installation.

Yes, but you won't get that prompt for a widget that doesn't have Cocoa code, but does contain widget.System() calls -- which effectively means it's an application. You could put an executable in your widget, not set the executable bit, but then chmod a+x and run it from widget.System() calls.

Dashboard will ask you the first time a third-party widget is run and give you the option of not running it.

It's so bizarre I didn't believe myself at first, but this is not true of widgets that are auto-installed. Try it yourself -- here is my example exploit page [columbia.edu] with an entire set of widgets that look identical to the Apple widgets. You will be prompted for permission with none of them, including the `Calculator' widget, which makes a widget.System() call and could conceivably have deleted your home directory.