Microsoft Urges Windows Users To Shun Safari

benjymouse writes "The Register has picked up on a recent Microsoft security bulletin which urges Windows users to 'restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.' This controversy comes after Apple has officially refused to promise to do anything about the carpet bombing vulnerability in the Safari browser. Essentially, Apple does not see unsolicited downloads of hundreds or even thousands of executable files to users' desktops as being a security problem." Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you.

Accidentents.

[Vectronic (1221470)]

"Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you."

With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]

Re:Accidentents. --lol

[Vectronic (1221470)]

Time for bed.

Re:Accidentents. --lol

[DAldredge (2353)]

From the linked article "Apple does not feel this is a issue they want to tackle at this time. In my most recent email to Apple, I suggested that they incorporate an option in Safari so the browser can be configured to ask the user before anything is downloaded to the local file system. Apple agreed it was a good suggestion: ...the ability to have a preference to "Ask me before downloading anything" is a good suggestion. We can file that as an enhancement request for the Safari team. Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. We want to set your expectations that this could take quite a while, if it ever gets incorporated. [credit to BK have-it-your-way Rios for suggesting the term "Carpet Bomb" to describe this issue]."

Re:Accidentents.

[dfm3 (830843)]

With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]

Or, even worse, on purpose.

First, imagine how many people would just blindly click on a new desktop icon just to "see what it does".

Second scenario, most Windows users I know keep file extensions off by default, and keep dozens of shortcuts to executables on their desktop among various folders, downloaded files, and other clutter. Now what if the downloaded file were named "safari.cgi" or "iTunes.cgi", but all the user sees is Safari with a generic file icon. I know many people who would think, "hmm, the icon to my internets is messed up" and click it anyway.

Re:Accidentents.

[thegnu (557446)]

First, imagine how many people would just blindly click on a new desktop icon just to "see what it does".

Well, if the icon is boobies, then about 49% of the population. If the icon is bunnies, however, I think it's much closer to 51%.

Re:Accidentents.

[Firehed (942385)]

What about bunnies with boobies?

Re:Accidentents.

[billcopc (196330)]

The world ends.

Re:Accidentents.

[Znork (31774)]

Why even bother with executing them? I can imagine a whole host of marketing people thinking this is a great way to obtain prime advertisement real-estate.

Getting an icon on a users desktop is something some companies pay a lot of money for. In fact, the ability to spam any download folder is probably something they regard as worthwhile.

Re:Accidentents.

[recoiledsnake (879048)]

Wrong, Apple has been installing Safari on Windows users machine disguised as an update to iTunes/Quicktime. And iTunes has hundreds of millions of users. Even if 5% of them use Safari, it's a pretty big demographic.

Re:Accidentents.

[kitgerrits (1034262)]

As a Linux user, I have to point out one thing in Microsoft's defense:
Lately, it seems to tag executables that have been downloaded and warns you about it when you try to run them.
Apparently, Safari does not have this mechanism, so users might assume it's a valid local icon.

I still run Firefox, though.

Re:Accidentents.

[MobyDisk (75490)]

It's funny that you say that, because on my MacBook Pro it is the exact opposite. Safari does this and Internet Explorer does not.

Under OS X, when you click an installer image downloaded by Safari it says something like "The application 'Whatever' was downloaded from the Internet on {date}. Are you sure this is safe to open?'

I sometimes use IE on Windows (for testing sites I develop) and I've never seen a comparable message from Internet Explorer.

Maybe you are talking about IE on Vista and Safari on Windows?

Re:Accidentents.

[x_MeRLiN_x (935994)]

When he says "recently", he means 6th August 2004; the release of Windows XP SP2.

Re:Accidentents.

[Hal_Porter (817932)]

This won't give admin rights to the app. UAC to the rescue.

If the Aliens in Independence Day had used Vista instead of OS X then UAC would have stopped the human virus running and they would have been able to complete their conquest of Earth.

MS says shun Safari?

[DrHackenbush (1273982)]

Finally, something I we can agree on.

1, 2, 3 ... SHUN!

[by Anonymous Coward]

Wow. Have to admit I'm on Microsoft's side here. Let's see:

1. automatically download browser as an update whether user likes it or not;
2. have the audacity to set the browser as default, again whether the user likes it or not;
3. introduce vulnerability;
4. ...
5. errr, no.

It's not just the vulnerability that hurts, but the compund bullshit caused by Apple's -- rather arrogant -- actions. This reads like something Microsoft would do!

Also, vulnerabilities in Apple software (and this bug affects both Windows and Mac), make all *nix stuff look bad: watch MS shills roll out the 'Microsoft software is only vulnerable because hackers target it' FUD in short order.

Posting as AC due to Apple fanboy-mods. Modding this down doesn't stop it being the truth.

Re:1, 2, 3 ... SHUN!

[Spy der Mann (805235)]

This reads like something Microsoft would do!

And that's no wonder. Steve Jobs and Bill Gates were cut with the same scissors. Back in the 80's, while Billy kept stealing whatever idea he stumbled upon, Steve Jobs only thought of becoming more powerful and promote a competitive environment inside Apple, even if that destroyed the moral of his employees.

Please do yourselves a favor and watch Pirates of Silicon Valley [imdb.com]. It's an enlightening movie. And yes, Steve did even worse things, but they're too shocking to be mentioned in public.

Such as...?

[Animaether (411575)]

A list of actual drive-by vulnerabilities in current Internet Explorer (name-calling went out of vogue when you reached the age of 15, man. You are at least 15, right?) that allow for code execution on the client to substantiate your claim, please.*

Now if you want to point fingers, visit that Dhanjani link and read about the vulnerability he's not disclosing, as a courtesy to Apple; "The third issue I reported to Apple is a high risk vulnerability in Safari that can be used to remotely steal local files from the user's file system [...] it is a high risk issue affecting Safari on OSX and Windows". There hasn't been an update to that in the past 2 weeks, implying that it has not yet been fixed.

The Slashdot headline is pure flamebait and you took it.

Re:Wow. Just wow.

[NewbieProgrammerMan (558327)]

Apple just needs to turn the tables and tell people to shun IE and use Firefox/Opera/what have you, is all.

Or, maybe, you know, fix their security holes.

Re:Wow. Just wow.

[JanneM (7445)]

Or, maybe, you know, fix their security holes.

It's Apple. By definition anything they make is perfect in any conceivable way. If Safari allows forced downloads of thousands of executables, then it is because all web clients really should, and Apple is the only company with the vision, the foresight, and the polo sweaters to implement it. Just ask any Apple fanboy in your neighbourhood; he'll tell you.

Re:Wow. Just wow.

[Zontar The Mindless (9002)]

May I be the first to say:

Whooosh

Re:Wow. Just wow.

[erikina (1112587)]

Because they don't give you permission to? And even they did, no one would bother without the source.
I think that anyone who gives a shit, has moved away from proprietary web browsers. (And yes, I'm aware their rendering engine is under GPL as it's based on KHTML or w/e)

Re:Wow. Just wow.

[99BottlesOfBeerInMyF (813746)]

Just to clarify the cause effect relationship, that is not clear enough for me in the parent. KHTML, that is Konqueror's core, is open source, free software, and easily reusable. That's why Apple forked the project and uses it as a part of Safari.

Just to clarify your clarification. Apple forked KHTML, which was developed by the Konquerer team, and named their fork WebKit, which is also free and open source. Since then, the developers of KHTML have decided to abandon KHTML in favor of WebKit themselves and are integrating WebKit into Konquerer. So Safari and Konqueror's rendering engine is named 'WebKit' not 'KHTML'.

Re:Quality of links

[esme (17526)]

some guy's blog

That guy appears to be the one who discovered the vulnerabilities and reported them to Apple.

Do you really think Slashdot shouldn't link to primary sources?

-Esme

Re:doesn't work?

[LuxFX (220822)]

Not a security bug? The downloaded files go directly to the desktop.

So, what if a site triggers an automatic download of a file called "My Computer.exe" to an XP computer, using the typical My Computer icon. Will a casual user be able to tell the difference? One click will take them to My Computer, another might install a spam zombie. Now think of a user with 500 extra My Computer icons. Which do they choose?

Re:doesn't work?

[that this is not und (1026860)]

Since I voted for George Bush (twice) and Bill Clinton (twice!) I classify MYSELF as a terrorist. I've certainly done enough damage to the country to sit the next election cycle or two out. heheh I need to be careful since whichever lame tool I vote for gets elected....