Apple Fixes Safari "Carpet Bomb" Windows Vulnerability 99
Titoxd writes "Apple has released a new version of Safari that fixes the carpet bomb vulnerability in Safari 3.1 for Windows. This comes in the heels of Microsoft recommending against using Safari in Windows, as well as the release of code exploiting this vulnerability."
You mean? (Score:5, Funny)
You think the carpet bombers did this?
Face it man, that rug really tied the room together...
Re: (Score:1)
Well Dude, we just don't know.
-Brant
I installed the update... (Score:4, Funny)
And my computer rebooted into OS X. Not that I mind, really.
But did they fix the real bug? (Score:5, Insightful)
Re: (Score:2)
Well, Safari isn't exactly embedded, but it's handy if you want to download Firefox or Opera and then make one of those your default browser...
Re:But did they fix the real bug? (Score:5, Informative)
Re:But did they fix the real bug? (Score:4, Informative)
np: Seabear - Sailors Blue (The Ghost That Carried Us Away)
Re:But did they fix the real bug? (Score:5, Insightful)
Why would they need to "fix" it. It is operating as they prefer it, the same as all the software MS includes in Windows that most of us would prefer we did not have to install. Is it so difficult for you to uncheck that box if you're performing an update?
Re:But did they fix the real bug? (Score:5, Insightful)
Yes.
Recently, the Java update software has begun asking for the Open Office installer to be installed on the system during an update for Java. Several users at my company have clicked straight through and added more crap to their desktop/registry/uninstall information.
Can we blame the users for not reading every detail and not unchecking a checkbox? Yes.
Can we also blame software vendors who are relying on the aforementioned user behavior to add their software to your computer on the sly? Yes.
Its a bad practice and it needs to stop.
If something is required for the operation of a software package, default to selected.
If something is optional or not required for the operation of a software package, default to unselected.
Why are we allowing marketing to override good engineering?
Re: (Score:1)
If something is required for the operation of a software package, default to selected.
If something is optional or not required for the operation of a software package, default to unselected.
That's not quite what I'd want. I think it should default to whatever "most users" would want. If it's related to the software being installed but optional, go ahead and leave it as default if it's useful: like plugins, additional media files, large level or graphics files for a game that can load files either from the HD or a CD, whatever you expect to be actively used by your users.
On the other hand, if it's unrelated software, leave it unchecked. If the company only WANTS "most users" to want their s
Ever since Bill "succeeded" ... (Score:1)
More and more managers are behaving as if following the example of the Bill & Steve act is actually good business.
Nothing new about it, read about it in the history of Rome and earlier, as far back as we can read history about nations warring against each other, in fact.
Money is like pus. It collects at wounds, and collects faster at dirty wounds.
Re: (Score:2)
Re: (Score:2)
Actually, I'm not. They don't want to hit me with that checkbox because I do pay attention to what comes up on my screen. So instead of getting an extra incidental hit for whatever they're pushing, they now have an annoyed customer. The people they're targeting with this is the people who won't notice that they're installing extra software.
So far Apple, Sun, and Daemon-Tools have all edged me away from their products because of this choice. Though I suppose you really can't be concerned with the dolphins ge
Re: (Score:2)
Re: (Score:2)
Well, at least I got a breeze. What exactly was the point of your comment then? Obviously I missed something.
Re: (Score:2)
It's even more obnoxious because the stupid Open Office installer comes with a JRE by default, too.
If you don't want to download the installer which is bundled with a JRE, you have to hunt through links on the OO.o site. The download link [openoffice.org] silently includes a JRE. Instead you have to click on "Get more platforms and languages [openoffice.org]" if you don't want the JRE.
But wait! Note the anchor on that more platforms link? By default, it jumps you to your current language. So now you need to scroll up and then uncheck th
Re: (Score:1)
I don't know where you're from, but in the United States of America, marketing overrides everything.
Re: (Score:2)
Open Office? Not just that, does Sun, Adobe (Flash) need couple of cents from Google to put "Google Toolbar" which can make any serious company with a security policy lose their minds?
Adobe Flash, Java (!!!!) comes with Google Toolbar if user doesn't unclick that selection box selected by default. Google Toolbar could be security nightmare if user does select some options.
Re:But did they fix the real bug? (Score:5, Insightful)
The real question is why are you defending Apple's unethical bundling - when the same is performed by Microsoft we criticize it. Call a spade a spade or you look foolish. Face it, this kind of practice is unacceptable, whether or not it comes from your favorite company.
Re: (Score:2, Insightful)
I guess it's about as unethical as Microsoft forcing IE7 on all users who use automatic updates. If fact, Microsoft forces new stuff all the time this way.
Not defending it - just saying that Apple, Microsft and Sun all do this, so don't single out Apple as being unethical in this manner.
Re:But did they fix the real bug? (Score:4, Insightful)
Re: (Score:3, Insightful)
Nevertheless, IE7 broke a bunch of stuff at my company. The IT folks spent a considerable amount of time and and energy getting everything on the intranet working with it.
I would strongly argue that IE7 was a new product with a similar name, and not an upgrade.
Re: (Score:1)
The real question is why are you defending Apple's unethical bundling - when the same is performed by Microsoft we criticize it.
Actually, in Apple's case it is tying, but not bundling. The concept is the same, except for two things. First, it has to be tying to a monopolized product. In this case Apple is tying iTunes to the iPod (which is nearly a monopoly force) and which they, in turn, tied to Safari. In this case, however, those markets are both already destroyed by MS's prior monopoly abuse into those same markets. Apple is actually helping those markets by leveraging the iPod to bring some choice into those markets. Compare,
Re: (Score:2)
The real question is why are you defending Apple's unethical bundling - when the same is performed by Microsoft we criticize it.
Bundling and peddling are not the same. I have no objection to Microsoft default check boxes to install things. When I install Office, if it tries to select MSN Messenger by default, I will uncheck it. When I fill out registration forms online, those newsletter signups are checked by default. I uncheck them.
Microsoft is free to set whatever checkboxes it wants. That's not bundling--it's not like the data has been downloaded yet or that it comes along without permission. It's not anticompetitive. I d
Re: (Score:1)
It is unethical for Microsoft to use its monopoly power in the marketplace to dictate to its partners what they can and can't install on the computers they manufacture in order to protect and enlarge Microsoft's monopoly power. Apple has no monopoly power in the marketplace and is not threatening anyone who refuses to install Safari.
What Apple is doing here is merely annoying. However, I do think that when Microsoft was found guilty for the umpteenth time and got away with a slap on the wrist, Apple noticed
Re: (Score:1)
My god, there sure are a lot of apologists for Apple who will use whatever twisted logic they can in a futile attempt to spin Apple's practices as anything but what they are - unethical.
'But - but - but, Safari does'nt have a monopoly!' Ergo, what they are doing is ok? Give me a break.
Pull your heads out of the Apple spin cycle and try to examine the issue dispassionately, you might find you come to a similar conclusion.
As far as people not knowing how to remove checkboxes having 'not being allowed to sit i
Re: (Score:2)
I know a company who has thousands of clients and their admin. You know the result of the cheap trick of adding Safari to Software Update on their machines and policy? They mass uninstalled Quicktime, the core of Apple technologies on Windows and banned everyone from installing anything related to Apple Inc. coming with software update.
Now they may have fixed it but that company (or several others) will keep that policy thanks to Carpet Bombing type things coming with the updated (!) Safari browser. Sadly,
Re: (Score:2)
Re: (Score:2)
I installed Safari for Windows about a week after it came out. That was several months ago.
It was very clearly marked as "new software". It was not marked as an update to anything. I just checked on a different system, and Safari is still marked as "new software".
Re: (Score:2)
Did they fix the bug where Safari installs as an iTunes update? I'd say that that is a fairly severe bug right there.
More importantly, did they fix the ipod software itself? Every update cripples me even further without fixing what the previous broke (80GB gen 5).
I'm afraid of the next update, where I can only have 1 song total on it.
Believe me, the support is sub-par to say the least. The online help is very confusing: sc [imageshack.us]
Re:"Carpet bomb"? (Score:4, Funny)
So if she's a squirter then you have an IED on your hands?
What a stupid vulnerability (Score:3, Insightful)
It's pretty common that some badly configured web server will send content to me that firefox will then ask if I want to download.
Just letting it download and then moving on to the next file is...well such an obviously stupid behaviour.
Also, please don't let carpet bombing become the next security buzzword along with bricking and zero-day.
Re: (Score:2, Informative)
Just letting it download and then moving on to the next file is...well such an obviously stupid behaviour[sic].
I disagree. If I click a link to download something, well obviously I want to download it. Clicking a second time to confirm is an annoyance. Apple's solution is to let things download, but put them in the downloads folder and flag them as untrusted content from the internet (well not flag them as trusted, since the default is untrusted). That is to say, that is their solution on OS X. On Windows, there is no download folder and for some reason they screwed up and did not flag it as untrusted in Vista (XP
Re:What a stupid vulnerability (Score:4, Informative)
Actually, Windows has this as well.
If you download a file using Internet Explorer, an NTFS file attribute is set that marks it as "downloaded - untrusted". Double click the file and you get a popup asking "DO you want to run this executable?" with a popup and showing the executable properties (signed by, etc). Problem is, it requires that you run NTFS, and if you copy the file to a network server, that network server to support extended attributes. Use Firefox or other browser, and the attribute isn't set, or copy to a fileserver that doesn't support extended attributes, and it's lost.
(Most frustrating when you have to apply 12+ patches to a program that Microsoft Update doesn't have support for. I wrote a little bash script that shells out cmd.exe (was an MSI file) to do this, but you're still left with these popups).
As for OS X, I believe these notifications started in Leopard. They too are extended attributes, I believe. Though I think OS X copies attributes to filesystems/servers that don't support them by using dotfiles, so copying the file around doesn't get rid of it. (It goes away after you've approved it, though. No reason why Apple couldn't figure out what flag IE sets and have Safari do same on Windows, either.
Windows untrusted attribute in Firefox 3 (Score:2)
Re: (Score:2)
Re: (Score:2)
If you download a file using Internet Explorer, an NTFS file attribute is set that marks it as "downloaded - untrusted". Double click the file and you get a popup asking "DO you want to run this executable?"
As I recall, that is true of Vista, but in XP only explorer knows about the flag, not the entire OS, so running it from the command line of via a script bypasses this... as does using windows explorer to autorun the files as in the demo.
Use Firefox or other browser, and the attribute isn't set, or copy to a fileserver that doesn't support extended attributes, and it's lost.
Firefox on Vista, currently does set the attribute for new files.
No reason why Apple couldn't figure out what flag IE sets and have Safari do same on Windows, either.
I know. I mentioned this specifically as something Apple should fix. I did point out, however, that on OS X, downloaded files from any application are set to this by default and developers need to figur
Re: (Score:2)
True, but that's not the only way to get it to download. As the proof of concept code [liudieyu.com] showed, all you have to do is put it inside a hidden iframe. If I go directly to a url ending in .dll, this might be excusable, but definitely not with an iframe.
Re: (Score:3, Informative)
Actually, Vista -does- have a specific Download folder now, for the record.
Re: (Score:2)
Badly configured Web Servers are also very well known in Apple developer and user community. There are still people ZIPPING bz2 compressed disk image (DMG) around. Why? Because if Webserver isn't configured to handle DMG mime type, user gets it in plain text inside browser. Look to all those *.dmg.zip things, no they aren't illiterate, they know what will hit them randomly.
Did Microsoft fix the vulnerability in IE? (Score:2, Insightful)
Did Microsoft fix the vulnerability caused by Internet Explorer running with its current directory set to the Desktop and its library search path going through the Desktop? Because until they do that, the actual vulnerability in Windows that Safari made slightly easier to exploit still exists.
Re: (Score:3, Insightful)
The actual vulnerability is that Safari downloaded files without the user's permission. Trying to make this a Windows issue smacks of fanboyism.
You are both right. (Score:3, Informative)
It isn't a mutually exclusive situation. There are two disparate vulnerabilities here. By themselves they aren't that big of a threat , but when used in concert the threat is greater than the sum of it's parts. You need the IE issue to load the compromised dll and you need Safari in order to "secretly" download the compromised dll in the first place.
Re: (Score:1)
All a malicious website needs to do is push some sort of malware to the user's desktop, then wait and hope they run it. There is no requirement for IE to do anything, that just happens to be a path to another vulnerability that can increase the danger from this one.
Simply throwing a file on the desktop with a familiar icon and a malicious payload would be enough to get a number of users to click it. Bam, compromised.
The IE flaw is a threat even without Safari. (Score:3, Interesting)
By themselves they aren't that big of a threat
Um, yes, the IE flaw *is* that big of a threat. There is no circumstance where it should EVER be acceptable for a downloaded file, whether with permissions or not (who other than a geek is going to worry about downloading a file called "somethingobscure.dll"?), to be AUTOMATICALLY executed just because of the name it's given.
I hope Microsoft fixes it bloody quick.
Re:Did Microsoft fix the vulnerability in IE? (Score:4, Insightful)
How did safari even get on most of those computers. I think people are seriously missing the big issue here.
Imagine if Netscape won the browser wars and you installed Windows Media Player which later on, in the middle of then night, downloaded and installed IE for you. If Office 2008 did this on OSX there would be riots in the street. When Apple does it, its of course Microsoft's fault.
Granted, there's a lot of blame to go around, but claiming this is a MS problem is being pretty unfair and only shows up that Apple can do anything, and few will complain.
Re: (Score:2)
Imagine if Netscape won the browser wars and you installed Windows Media Player which later on, in the middle of then night, downloaded and installed IE for you.
Except that iTunes didn't "in the middle of the night, download and install Safari".
However Microsoft did force IE into Windows, using techniques that created many inherent security flaws that we are still battling 11 years later, this being one of them.
Apple can do anything, and few will complain.
When Apple fucks up, I'll be the first to complain.
The actual vulnerability is in IE. (Score:4, Interesting)
The actual vulnerability is that Safari downloaded files without the user's permission.
Asking for permission before doing something that may potentially lead to a security exploit is no protection at all. Seriously. In the eight years between the time Microsoft introduced the browser-desktop merge, and the time I quit being a system admin and went back to programming, I had many many cases where some user (and these weren't dumb users, these were engineers and programmers with PhDs and patents to their name) would come to me and say "Peter, I just clicked the wrong button again, and I think I have a virus". That "again" is important. That means that they have the "Windows pops up stupid dialogs all the time so I have to approve this one" reflex burned into their cortex.
A user is not going to realize that a web page asking to download "someobscuregibberish.dll" is attacking them.
Stupid permission dialogs are no protection.
The actual vulnerability is twofold:
1. The path goes through the current directory by default, and it goes through the current directory first.
This is something that UNIX used to do, and it was widely recognized as a BAD idea by 1980. MS-DOS wasn't even out yet, let alone Windows.
2. The default download directory is the default directory of any program, let alone a program that is run virtually every time you log in.
This one is, well, beyond stupid. This is like having the mailslot in your front door connect to your safe deposit box. The directory that is MOST likely to contain malicious code is the one that you're MOST likely to be running code from on any given day.
Trying to make this a Windows issue smacks of fanboyism.
Name one other operating system or application where downloading files to the default download folder would cause them to be run, under any normal circumstances. The whole idea is completely insane.
Re: (Score:1)
All very well and good, and the completely unrelated vulnerability in IE should also be fixed. But that still has nothing to do with the Safari vulnerability. Your deflection skills are weak.
Re: (Score:1)
So, you're saying that it's perfectly logical to expect IE to execute DLLs in my Desktop folder?
To use your vernacular, trying to make this a Windows non-issue smacks of fanboyism.
Re: (Score:2)
Sure, Microsoft will fix this, in about 2 years.
I guess this proves how important they consider security these days. Does anybody still believe anything that they say? Yes, I really believe they have given up the fight over ODF.
Re: (Score:1)
Except Safari follows future standards (CSS 3, for example) instead of making up it's own random "standards" like IE 6 did.
Re: (Score:1)
The fact that I'm replying at all is a testament to the quality of the ACs troll.
I just spent 2 hours getting div transparencies to work with IE 6. The Safari and Firefox portions took a few minutes. Getting it to work in IE6 was a royal pain. To compound the problem, IE6 also doesn't support PNG alpha channels.
With any luck, IE6 will go the way of the dodo bird soon enough and I won't have to worry about it anymore.
Hmm? (Score:5, Insightful)
Safari downloads files (e.g. dynamic libraries) in user directories where the Internet Explorer could autoload them on start. Isn't the bigger problem within Internet Explorer? Why did Microsoft setup a library path to a user's directory at all?
Yes, the flaw is in IE. (Score:5, Informative)
Microsoft's library path ALWAYS goes through the current directory. For some obscure reason that IE icon on the Desktop, the one that isn't a shortcut but is actually something special Microsoft added back in 1997 to make it harder to remove IE, runs IE on the Desktop instead of in the IE install directory, the way it would if it was a shortcut.
It's all a side effect of Microsoft's shenanigans when they tried to use browser-desktop integration to make an end-run around their agreement with the US DoJ. That they've convinced people that the big news is a bug in Safari that makes it slightly easier to take advantage of this problem is, well, bizarre.
And now you know the rest of the story.
Re:Yes, the flaw is in IE. (Score:5, Interesting)
You can't get around this by avoiding the "special" IE icon, though. You can make a real shortcut, set the working directory to whatever you want, or even launch IE from its own program directory from a command prompt, and it will still consider the desktop to be the current directory.
As a fun experiment,
- copy cmd.exe to the desktop and rename it to notepad.exe
- launch IE the "safest" way you can think up
- view page source
YRMV, but in my tests with IE 6 and 7 in 2k and XP, it will launch the command prompt instead of notepad, and you can see the current directory and the stuff it prepends to the PATH variable.Until this is fixed in IE, I recommend copying notepad.exe and all your system .DLLs from the system32 directory onto each user's desktop, and use an ACL on each one to make sure your users do not have permission to overwrite them. No, seriously. (Or you could just use another browser.)
Re: (Score:3, Funny)
You can make a real shortcut, set the working directory to whatever you want, or even launch IE from its own program directory from a command prompt, and it will still consider the desktop to be the current directory.
Whiskey Tango Foxtrot?
Every time I think I'm being to hard on Microsoft, that I'm just being a cynical old fart, I come across something like this.
Holy Mother of Turing, what were they thinking of?
Re: (Score:2)
Microsoft's library path ALWAYS goes through the current directory.
This isn't true. If an application calls SetDllDirectory(), it overrides the search path. The order becomes:
The above function is highly useful to force a single specified path (it takes ONE path, not a list) early into the DLL load search order. It's pretty much necessary to use this to avoid getting screwe
Re: (Score:2)
Apologies for the reply-to-self, but I forgot to mention another important special-case use of SetDllDirectory(): if passed the empty string, it removes the current directory from the DLL search path. So even if your app doesn't require some particular directory to be 'blessed', this call can still mitigate a variety of DLL-related risks.
Re: (Score:2)
Will that also override the application search path going through the current directory?
Re: (Score:2)
Re: (Score:2)
What, you mean if I kill some service Windows will stop beabling at me about "do you really want to run this program you just downloaded"? Do tell!
Re: (Score:2)
What, you mean if I kill some service Windows will stop beabling at me about "do you really want to run this program you just downloaded"? Do tell!
Re: (Score:3, Interesting)
This issue has been avoided in UNIX systems for decades I believe. I remember when I was first learning about the command-line that I thought it was strange you couldn't just compile a new program and type $ a.out to launch it. That's because the current directory is not in the path. You have to type $ ./a.out to get the executable seen. The reason this is a system default is to prevent someone sneaking in a malicious copy of a system command such as ls into a directory where you'd accidentally use the fake
3 decades, to be precise... (Score:2)
We had regular warnings about not adding "." to $PATH when I was at Berkeley... in 1978.
Damn... (Score:3, Funny)
Re:Damn... (Score:4, Funny)
Amazed at the hubris in these comments (Score:2, Insightful)
While I am no Microsoft fan, I am amazed at the hubris of comments in this thread.
Surely anyone with half a brain HAS TO ADMIT that the Safari vulnerability is FAR WORSE than IE setting it's current path to the windows desktop.
In fact, the Safari vulnerability can be exploited for root access to the box without IE being in the equation AT ALL. Just pick some program or two that are likely to be installed on any user's computer ( iTunes, Firefox? ), and download .exe files with those names to the desktop. *B
Re:Amazed at the hubris in these comments (Score:4, Interesting)
Certainly not for the average Slashdot user and arguably not for anyone. Safari won't overwrite a user's existing icons, just add new ones. I also opens a download manager so users know something is being added. There are some pretty ignorant users out there, but not many that won't take not that some random Web site is downloading something called "Firefox.exe" to their desktop with an icon that looks just like their Web browser's. Finally, I notice you use the present tense. The ability to do this in Safari has been fixed, whereas the flaw with Windows has not. So, yeah I'd say the flaw in Windows is currently a FAR WORSE vulnerability, as you put it.
The main thing here, is the Safari flaw requires user interaction to work by itself, which means you have to manage a social engineering feat and get people to do something (double click and icon). With the flaw in Windows, any download from any source that they can get on a user's desktop can be automatically run.
Re: (Score:2, Insightful)
Safari won't overwrite a user's existing icons, just add new ones. I also opens a download manager so users know something is being added. There are some pretty ignorant users out there, but not many that won't take not that some random Web site is downloading something called "Firefox.exe" to their desktop with an icon that looks just like their Web browser's
This is a laugh an a half. I am pretty sure if I took an informal survey of my acquaintances many would not even know what a download manager was if
Re: (Score:2)
No, it's your user directory, one level up from your desktop. Much harder for crap to end up there by accident, though it does happen (fools are ingenious, etc.)
Running from the WIN+R prompt searches the path like it should, and will not run things from the desktop unless it's been added to the path.
Re: (Score:2)
I agree 100%. In fact, I'll go one step further and say that any application
Re: (Score:2)
Re: (Score:2)
This is a laugh an a half. I am pretty sure if I took an informal survey of my acquaintances many would not even know what a download manager was if I asked them. People nowadays just instinctively close the download manager window, both in Firefox and Safari.
Maybe they don't now the name, but most know what the little window showing their downloads is and even if they click to close it, they still know it is happening and see the icon. It certainly is not any more a conditioned response to close it than it is to click through the warning in Firefox.
Like I said before, there is no social engineering required *AT ALL*. Just pick a common application name and odds are they already have it installed and it *WILL* be clicked.
That is social engineering. You're tricking people into thinking it is a different program than it is. In order for it to work, you have to guess what application shortcuts they have on their desktop (if they ha
What do you think "social engineering" means? (Score:2)
Like I said before, there is no social engineering required *AT ALL*. Just pick a common application name and odds are they already have it installed and it *WILL* be clicked.
What do you think social engineering *means*?
You CAN learn not to be social engineered.
It's a LOT harder to learn when it's OK to approve one of Windows myriad stupid "security theatre" dialogs.
In the decade that I was a WIndows network admin, I would ROUTINELY have people who came by and say "peter, I clicked on the wrong button again
PS... (Score:2)
For example, if you hit WIN+R and type 'CMD", the desktop is your default working directory.
Wrong. It's your profile, the parent directory of your desktop.
And virtually no GUI applications on Windows EVER change their current working directory.
No one should give a rat's ass what the working directory of any application is
True. The current working directory should not be in the search path for applications or DLLs.
Namely, you should not be storing .EXE or .DLL file son your desktop for any reason
Wrong. That
Re: (Score:2)
Re: (Score:1)
While I am no Microsoft fan, I am amazed at the hubris of comments in this thread.
Well, imagine... I hate Apple and still: this is weird!
Safari vulnerability can be exploited for root access to the box without IE being in the equation AT ALL.
And I can tell you that, on the other hand, it will work even without Safari involved. Simply placing a DLL on a desktop will autoload it when Internet Explorer starts. This is exactly as stupid as having "." in path environment variable. Let's think about it a moment... how many applications, tools and programs have access to a user's desktop?
But hey... it's Microsoft... who the hell understands their "security" ideas?
Re: (Score:2)
Almost as bad as having the desktop be a swamp of shortcuts to programs. Start menu anyone? Windows desktops of the average user remind me heavily of MySpace.
Re: (Score:2)
Re: (Score:2)
Mod me redundant (Score:1)
Even though someone else said it already, I'm going to try to make it glaringly obvious for all the mods that modded you up insightful or whatever --
In the unix world, we learned a long time ago not to put the home directory or the current working directory in the default executable path variable. The reasons were known before MS-Dos was a product, although there were still some *nix products from the less savvy vendors that had .profile put "." in "$PATH" when MSWindows95 became a product.
Reputable *nix ve
Re: (Score:2)
Social engineering automatic execution. (Score:2)
Just pick some program or two that are likely to be installed on any user's computer ( iTunes, Firefox? ), and download .exe files with those names to the desktop. *BOOM*, next time someone wants to run iTunes or Firefox, if they click that exe by accident instead of their shortcut (how would they know any different? ), they're toast.
This is called a "social engineering attack".
You don't need Safari to do this. People have been "phished" by this kind of attack as long as there have been desktop operating sy
How windows handles files... (Score:2)
I am subscribed to Apple security mailing list, I recommend it to everyone. It is less BS, plain text alert about anything related to security update released from Apple. They mail immediately too even beating software update. It is both for OS X and Windows.
http://lists.apple.com/mailman/listinfo/security-announce [apple.com]
I noticed something really bothers me as OS X only user:
http://lists.apple.com/archives/Security-announce/2008/Jun/msg00001.html [apple.com]
"Impact: Saving untrusted files to the Windows desktop may lead to
t