Safari "Carpet Bomb" Attack Code Released

snydeq writes "A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers. The source code can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks, security experts say. The public example of the attack code allows attackers to litter a victim's desktop with executable files, an attack known as 'carpet bombing.' In combination with bugs in Windows and Internet Explorer, attackers can run unauthorized software on a victim's computer."

Wrong section, eds!

[himself (66589)]

This is a _Windows_ Safari problem, not an _OS X_ Safari problem. And yes I RTFBlogPost.

Re:Wrong section, eds!

[Qwerpafw (315600)]

It's a Windows Internet Explorer problem, not a Mac OS X Safari problem.

the "bug" is that Safari has the users desktop as the default download directory, and will automatically download files if you go to some websites. This is normal and fine behavior. The problem is that Internet Explorer loads files from the desktop on launch, which means if you craft a malicious library and put it on the desktop Internet Explorer will happily load it.

Microsoft should fix IE to avoid loading files from the Desktop.

Re:Wrong section, eds!

[oyenstikker (536040)]

"This is normal and fine behavior."

No, it isn't.

Re:

[Khyber (864651)]

No, the problem is that Safari doesn't utilize the functionality Windows has for marking files as safe or unsafe when it downloads something, thus allowing IE to open said files.

Safari isn't implementing the basic security that is implemented in Windows.

Re:Wrong section, eds!

[Chas (5144)]

No. It's a problem with Windows Internet Explorer that's exacerbated by a problem with Windows Safari.

Safari should NOT be auto-dumping files onto the Windows desktop. PERIOD.

There's enough blame to go around everywhere.

Re:Wrong section, eds!

[ClassMyAss (976281)]

Safari should NOT be auto-dumping files onto the Windows desktop. PERIOD.

Totally agreed. I'd go further - no website should be able to trigger any action on my computer that persists after I close the damn browser window without my explicit permission, apart from saving cookies and leaving an entry in my history log (even then, only if I've enabled both of these things).

That said, IE is worse here - downloading files without my permission is bad form, but a pre-installed system app loading DLLs from any old place that it finds them, especially one of the most common places to dump downloaded files, is just idiotic.

Shame on all.

Quick Workaround...

[Manip (656104)]

Here are two very quick temp' workarounds for the issue.

1) Launch IE from a location other than your desktop (e.g. Start Menu, Quick Launch Tray).

2) Go to Program Files\Internet Explorer, Create Shortcut, and then place that shortcut on your desktop. Make sure the "Start In" setting is set to any location other than your Desktop.

Better yet...

[HerculesMO (693085)]

Best workaround is to use Firefox.

Re:Quick Workaround...

[CastrTroy (595695)]

For me it runs even when launching from the quick launch bar, or from the start menu. For some reason, IE seems to like to load things from the desktop by default. For instance, to change your "view source" application from notepad to notepad++, you can put the following in a notepad.bat file on your desktop.

C:\Program Files\Notepad++\notepad++.exe %1

This problem seems to be two fold. First, Safari will automatically download stuff, to your desktop, without asking you. Secondly, IE will load DLLS from the desktop, just because they happen to have the same name as some other DLL it is looking for. I think the bigger problem here is with IE, because it doesn't matter how the dll got on your desktop, it shouldn't be using it.

Best Solution

[Skye16 (685048)]

Clearly the quickest way we can get Apple to fix this is to host this attack on all of our own websites, with the .exe in question being the uninstall program for Safari.

As soon as the attack centers on an Apple product, they'll start moving their ass. Until then, it's "not [their] problem".

Re:

[Entropy2016 (751922)]

It's something Microsoft has to fix. The article is your friend.

Re:

[Skye16 (685048)]

I'm sorry, but allowing a malicious website to provide hundreds or thousands of executables on my desktop is *still* an Apple bug. What's worse, it's the root cause. Yes, Windows and IE have a flaw that allow that file to be executed, but it wouldn't be there in the first place - especially in such quantity - if the flaw in Safari didn't exist first.

As you say, the article is your friend.

"The Safari bug, originally disclosed on May 15 by security researcher Nitesh Dhanjani, allows attackers to litter a vi

Re:

[oahazmatt (868057)]

Half of the problem is with Safari, the other half is with IE. Let's give credit where credit is due.

If it weren't for Safari downloading the files to the desktop by default, they wouldn't get there.

If it weren't for IE opening these files from the desktop by default, they wouldn't open.

Now, if you'll excuse me, I'd like to feel completely secure. I'm going to go install my old copy of OS/2 Warp v3 and Netscape Communicator.

Who uses safari for windows and IE?

[wattrlz (1162603)]

Personally I think the bigger issue is that Safari will auto-download, auto-mark-safe, and auto-run files silently. IE's broken too, but either one of the players involved could render this exploit moot. Let's see who responds first before stoning someone to death.

I still don't see why someone would be browsing around in safari and then open up IE. A regular user's likely to only use his favorite browser and a dev who needs to view the same site in multiple browsers would probably notice that there're a bunch of new .dll files all over the desktop.

Re:Secure from the ground up!

[spud603 (832173)]

RTFA. Actually, it looks like this is a windows problem. Safari automatically downloads a file to the desktop. Then when you start Internet Explorer it runs the file on your desktop and there is the problem.
So the real issue is that Safari can be told to automatically download a file while internet explorer will automatically run a malicious dll from the desktop. actual post and proof-of-concept code here [fc2.com].
seems like a misleading summary to me.

Re:Secure from the ground up!

[Colonel Korn (1258968)]

RTFA. Actually, it looks like this is a windows problem. Safari automatically downloads a file to the desktop. Then when you start Internet Explorer it runs the file on your desktop and there is the problem.
So the real issue is that Safari can be told to automatically download a file while internet explorer will automatically run a malicious dll from the desktop. actual post and proof-of-concept code here [fc2.com].
seems like a misleading summary to me.

IE won't run anything "automatically." It sounds like the problem is that Safari both autodownloads to the desktop and then tells IE to open that file on its next load.

Re:

[bluelip (123578)]

IE will load its DLLs automatically. If the current PATH contains the DLL, IE will use that version instead of the system version.

Re:Secure from the ground up!

[spud603 (832173)]

from TFA:

The problem originated from an error that Windows Internet Explorer will load some program library files(DLL) from user's Desktop instead of its own library file folder(usually C:\WINDOWS\SYSTEM32). Apple's Safari for Windows downloads and saves requested file to user's Desktop by default - this default behavior itself does not constitute a mistake.

The 'workarounds' suggested by MS include "Change the download location of content in Safari to a newly created directory". I don't actually know what's going on with this, but it seems like it's IE opening an improperly-named (or maybe there's some bad meta-data that comes along with it?) file from the desktop, no matter how it got there.

Re:Secure from the ground up!

[FatMacDaddy (878246)]

You know, this is pretty clearly explained in the article. To quote: "Microsoft's advisory says that the vulnerability has to do with the way Windows handles desktop executables and recommends that Windows users "restrict use of Safari as a Web browser until an appropriate update is available from Microsoft and/or Apple."

So yes, IE is in fact autoloading executables from the desktop. It's Safari's vulnerability to carpet bombing that sets the stage, but it's IE and Windows that cause the big boom.

Re:Secure from the ground up!

[Richard_at_work (517087)]

Read Slashdot: Microsoft Urges Windows Users To Shun Safari [slashdot.org] - it explains what happens in more detail.

Basically, on Windows Safari automatically downloads files, in imitation of its behavior on OSX, but whereas on OSX it downloads them to a nice ~/Downloads directory on Windows it downloads them to the desktop. Also, on OSX Safari tags the downloaded file as 'unsafe', but it fails to use the Windows functionality to do the same on Windows. This leaves a whole load of files that you never asked for or wanted lying around on your computer in a state that is one step away from being executed.

This 'attack' allows a malicious person to force Safari to dump thousands of files on your desktop, which in and of itself is not a nice thing, but when coupled with other exploits it can lead to code execution of these files you never wanted in the first place - whether those exploits are patched by the vendor (Microsoft) or not, we both know that a significant portion of desktops are not kept fully up-to-date with security releases.

mod parent up

[spud603 (832173)]

very informative.
If Windows has an "unsafe" flag for files, it should be used by Safari. Also, I find using desktop as default download space incredibly annoying (yes, i'm looking at you firefox).
That said, IE should also know better than to execute random files from the desktop, which seems like the nastier issue here.

There is one

[Titoxd (1116095)]

If Windows has an "unsafe" flag for files, it should be used by Safari.

Windows has it. It's the Attachment Execution Service [bartdesmet.net], located in the Alternate Data Streams [wikipedia.org] in NTFS.

Yup!

[nobodyman (90587)]

It would be easy enough to test this out though. manually download this DLL using IE (which marks the file as unsafe), then fire up IE7.

I tried it out: the exploit still works when you manually download the file using IE instead of Safari. So either IE isn't marking downloaded executables as unsafe either, or IE ignores this flag when loading DLL's. Either way it undermines the"Apple is at fault" argument.

Carpet bombing is still an issue, if for no reason than it is an annoyance.

Re:

[Jabrwock (985861)]

Yes, the "Downloads" folder was introduced in 10.5.

Re:This is a longstanding Windows flaw.

[brunascle (994197)]

I'd say it is a security flaw in Safari, but for different reasons. As the same blog explains [fc2.com], you could have Safari download an executable to the desktop that pretends to be e.g. Internet Explorer. If they normally launch IE from the desktop, they could click the fake IE next time, running arbitrary code.