Microsoft Urges Windows Users To Shun Safari

benjymouse writes "The Register has picked up on a recent Microsoft security bulletin which urges Windows users to 'restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.' This controversy comes after Apple has officially refused to promise to do anything about the carpet bombing vulnerability in the Safari browser. Essentially, Apple does not see unsolicited downloads of hundreds or even thousands of executable files to users' desktops as being a security problem." Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you.

Accidentents.

[Vectronic (1221470)]

"Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you."

With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]

Re:Accidentents. --lol

[Vectronic (1221470)]

Time for bed.

Re:Accidentents. --lol

[DAldredge (2353)]

From the linked article "Apple does not feel this is a issue they want to tackle at this time. In my most recent email to Apple, I suggested that they incorporate an option in Safari so the browser can be configured to ask the user before anything is downloaded to the local file system. Apple agreed it was a good suggestion: ...the ability to have a preference to "Ask me before downloading anything" is a good suggestion. We can file that as an enhancement request for the Safari team. Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. We want to set your expectations that this could take quite a while, if it ever gets incorporated. [credit to BK have-it-your-way Rios for suggesting the term "Carpet Bomb" to describe this issue]."

Re:Accidentents. --lol

[recoiledsnake (879048)]

Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team.

You mean Apple actually has a HIG team for Windows applications like Quicktime, iTunes and Safari?????

I found this a bit more interesting

[TubeSteak (669689)]

I'd like to thank the Apple security team for ... and for letting me discuss these issues with the security community.

::raises hand::
Teacher, may I go to the bathroom?

What if Apple's security team had said no?

Re:Accidentents.

[Anonymous Coward]

It doesn't take hundreds of files. It takes one file.

According to Nate McFeters, Microsoft has a working "one click and the bad guy gets code running on your machine" exploit.

Re:Accidentents.

[dfm3 (830843)]

With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]

Or, even worse, on purpose.

First, imagine how many people would just blindly click on a new desktop icon just to "see what it does".

Second scenario, most Windows users I know keep file extensions off by default, and keep dozens of shortcuts to executables on their desktop among various folders, downloaded files, and other clutter. Now what if the downloaded file were named "safari.cgi" or "iTunes.cgi", but all the user sees is Safari with a generic file icon. I know many people who would think, "hmm, the icon to my internets is messed up" and click it anyway.

Re:Accidentents.

[thegnu (557446)]

First, imagine how many people would just blindly click on a new desktop icon just to "see what it does".

Well, if the icon is boobies, then about 49% of the population. If the icon is bunnies, however, I think it's much closer to 51%.

Re:Accidentents.

[Firehed (942385)]

What about bunnies with boobies?

Re:Accidentents.

[billcopc (196330)]

The world ends.

Re:Accidentents.

[Znork (31774)]

Why even bother with executing them? I can imagine a whole host of marketing people thinking this is a great way to obtain prime advertisement real-estate.

Getting an icon on a users desktop is something some companies pay a lot of money for. In fact, the ability to spam any download folder is probably something they regard as worthwhile.

Re:Accidentents.

[recoiledsnake (879048)]

Wrong, Apple has been installing Safari on Windows users machine disguised as an update to iTunes/Quicktime. And iTunes has hundreds of millions of users. Even if 5% of them use Safari, it's a pretty big demographic.

Re:Accidentents.

[kitgerrits (1034262)]

As a Linux user, I have to point out one thing in Microsoft's defense:
Lately, it seems to tag executables that have been downloaded and warns you about it when you try to run them.
Apparently, Safari does not have this mechanism, so users might assume it's a valid local icon.

I still run Firefox, though.

Re:Accidentents.

[MobyDisk (75490)]

It's funny that you say that, because on my MacBook Pro it is the exact opposite. Safari does this and Internet Explorer does not.

Under OS X, when you click an installer image downloaded by Safari it says something like "The application 'Whatever' was downloaded from the Internet on {date}. Are you sure this is safe to open?'

I sometimes use IE on Windows (for testing sites I develop) and I've never seen a comparable message from Internet Explorer.

Maybe you are talking about IE on Vista and Safari on Windows?

Re:Accidentents.

[Anonymous Coward]

Wrong. Anytime a browser can be made to download a file without the user agreeing to it it's a problem with the browser. Nice try though.

Re:Accidentents.

[stewbacca (1033764)]

I think what he is saying is that OSX has a built in download manager, regardless of browser, so the user indeed DOES have to authorize downloads. If an OSX user gets carpet bombed, it's because they said "ok" at some point. You haven't been dumbed. You should try to be less snarky if you want people to take you more seriously. And try some capital letters while you are at it ;-)

Re:Accidentents.

[recoiledsnake (879048)]

Safari on Mac OS X doesn't need it - it's built into the Finder itself, so you get the warning regardless of what you used to download the app. I think I have to agree with Apple on this. Flooding your download directory with crap is annoying as hell, and downloads should certainly be made optional for that reason. But it's not a security problem - the security problem is that Windows Explorer doesn't warn the user before running an unknown .exe.

MSDN contains clear instructions on how to mark a executable as unsafe. It's not Windows Explorer's fault that Apple chose to ignore it. Whatever you try to spin it as, the security problem is that Safari allows crapflooding of user folders without user intervention aside from just visiting a webpage. Otherwise Firefox/Opera would have this 'problem' too, not just Safari.

Re:Accidentents.

[x_MeRLiN_x (935994)]

When he says "recently", he means 6th August 2004; the release of Windows XP SP2.

Re:Accidentents.

[recoiledsnake (879048)]

On OS X Leopard, any executable .app that is downloaded from the Internet requires your explicit permission in order to execute.

So it does in Windows(even if downloaded through Firefox). It's just that Safari doesn't mark executables as 'Downloaded from the internet'. This has nothing to do with one OS vs. the other. It's just that Apple is not following proper Windows guidelines while Mozilla etc. do.

Re:Accidentents.

[93 Escort Wagon (326346)]

So it does in Windows(even if downloaded through Firefox). It's just that Safari doesn't mark executables as 'Downloaded from the internet'. This has nothing to do with one OS vs. the other. It's just that Apple is not following proper Windows guidelines while Mozilla etc. do.

As a Mac user, I get fed up whenever a company (usually Adobe) doesn't follow "proper procedure" - such as using their own proprietary installer that won't work correctly out of a non-admin account, or software that won't work at all unless you're an admin. It's not just annoying; it's a strike against security.

So if this is realy true - if Microsoft has indicated files should be flagged thus, and provides an API that allows software to do that - then shame on Apple. They want their guidelines followed on their OS; so they should do the same for their Windows software.

Basically it's the Golden Rule.

Re:Accidentents.

[Hal_Porter (817932)]

This won't give admin rights to the app. UAC to the rescue.

If the Aliens in Independence Day had used Vista instead of OS X then UAC would have stopped the human virus running and they would have been able to complete their conquest of Earth.

Re:Blurry eyes!

[Yvan256 (722131)]

"Apple generally believes that the goal of the algorithm should be to preserve the design of the typeface as much as possible, even at the cost of a little bit of blurriness.

Microsoft generally believes that the shape of each letter should be hammered into pixel boundaries to prevent blur and improve readability, even at the cost of not being true to the typeface."

http://technicalconclusions.wordpress.com/2007/08/23/subpixel-rendering/ [wordpress.com]

Oh Microsoft...

[Raian [phone])]

Talk about the stove calling the kettle black.

Re:Oh Microsoft...

[Vectronic (1221470)]

And what, you are trusting (Vista/Server2008 I would assume?) simply because there isnt a list of vulnerabilities that have been exploited that doesnt have an update/fix for it?

Side Note: Im typing this from XP and I have a another computer in the room next to me currently booted into Vista.

Did I say Microsoft is bad? No.

Besides, obviously a vulnerability is not going to be found if its already patched on the system being tested. Again quoting you "Please list some actual 2008 vulnerabilities that were exploited before being patched." But you are neglecting the fact that en masse there are alot of people who dont update/patch their machines every day.

Futhermore, a lot of vulnerabilities are found by third parties and Microsoft is notified by them, not necissarily by microsoft employees themselves.

And finally, because it hasnt been reported, does not mean they do not exist. Assuming something is secure without proof is far worse than assuming its not.

Found by Microsoft, currently unpatched*:
http://secunia.com/advisories/29867/ [secunia.com]

Found by non-Microsoft, currently unpatched*:
http://secunia.com/advisories/29458/ [secunia.com]

* According to them.

Im sure I could find more, but, ive fed the troll enough as it is.

MS says shun Safari?

[DrHackenbush (1273982)]

Finally, something I we can agree on.

doesn't work?

[v1 (525388)]

ok I'm the curious type so I made a test on my server, with the provided example.

Since Safari does not know how to render content-type of blah/blah, it will automatically start downloading carpet_bomb.cgi every time it is served.

Not for me? Safari 3.0.4 running on Mac OS X 10.5.2 renders a web page of numerous blank empty boxes. Nothing was placed in any local folder. Is anyone else able to duplicate this?

Re:doesn't work?

[TheRaven64 (641858)]

I didn't try this specific code, but Safari does have an irritating habit of randomly downloading things instead of displaying them. I have a load of .php files in my downloads directory because I've clicked on things in online svn browsers and it's decided it can't render them. It's not a huge vulnerability, but it is an irritation which could be easily fixed and it's frustrating that they don't.

I really don't understand why Safari on OS X runs with so many privileges. OS X has a fine-grained access control mechanism in the kernel as of 10.5 and I would really like to see Safari configured so it can't write anywhere except your downloads and preferences directories and can't read anywhere other than your preferences by default.

Re:doesn't work?

[nine-times (778537)]

That's all this is about? Safari downloads some things instead of displaying them? Is that even a security bug?

If my browser doesn't know how to display it, I think I'd rather it didn't try. Trying seems like it might be even more dangerous. Am I wrong?

Re:doesn't work?

[Dogtanian (588974)]

That's all this is about? Safari downloads some things instead of displaying them? Is that even a security bug? If my browser doesn't know how to display it, I think I'd rather it didn't try. Trying seems like it might be even more dangerous. Am I wrong?

I'll give you the benefit of the doubt and assume that you posted this in good faith. However, what you're essentially saying ("it's not perfect, but I'd rather it was done the way it's done now") implies a false dichotomy.

What's stopping the browser from saying "I can't handle this file/etc, but please click here if you wish to save it to your desktop"? In the majority of situations, most people wouldn't bother downloading it anyway.

Re:doesn't work?

[that this is not und (1026860)]

Since I voted for George Bush (twice) and Bill Clinton (twice!) I classify MYSELF as a terrorist. I've certainly done enough damage to the country to sit the next election cycle or two out. heheh I need to be careful since whichever lame tool I vote for gets elected....

Re:doesn't work?

[LuxFX (220822)]

Not a security bug? The downloaded files go directly to the desktop.

So, what if a site triggers an automatic download of a file called "My Computer.exe" to an XP computer, using the typical My Computer icon. Will a casual user be able to tell the difference? One click will take them to My Computer, another might install a spam zombie. Now think of a user with 500 extra My Computer icons. Which do they choose?

1, 2, 3 ... SHUN!

[Anonymous Coward]

Wow. Have to admit I'm on Microsoft's side here. Let's see:

1. automatically download browser as an update whether user likes it or not;
2. have the audacity to set the browser as default, again whether the user likes it or not;
3. introduce vulnerability;
4. ...
5. errr, no.

It's not just the vulnerability that hurts, but the compund bullshit caused by Apple's -- rather arrogant -- actions. This reads like something Microsoft would do!

Also, vulnerabilities in Apple software (and this bug affects both Windows and Mac), make all *nix stuff look bad: watch MS shills roll out the 'Microsoft software is only vulnerable because hackers target it' FUD in short order.

Posting as AC due to Apple fanboy-mods. Modding this down doesn't stop it being the truth.

Re:1, 2, 3 ... SHUN!

[Spy der Mann (805235)]

This reads like something Microsoft would do!

And that's no wonder. Steve Jobs and Bill Gates were cut with the same scissors. Back in the 80's, while Billy kept stealing whatever idea he stumbled upon, Steve Jobs only thought of becoming more powerful and promote a competitive environment inside Apple, even if that destroyed the moral of his employees.

Please do yourselves a favor and watch Pirates of Silicon Valley [imdb.com]. It's an enlightening movie. And yes, Steve did even worse things, but they're too shocking to be mentioned in public.

Microsoft

[kardelen133 (1299169)]

Hi all I'm in the uncomfortable position of agreeing with Microsoft on this issue. If a browser (any browser) allows a website to randomly download files without the user's explicit permission, regardless of the location, it is a security issue in my opinion. Having said that, I take issue with Microsoft's security advisory. The only thing they say is: "What causes this threat? A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a userâ(TM)s machine without prompting, allowing them to be executed." OK, but how about telling us the how or why? Since it is a direct contributor which causes the blended threat, I don't think it's asking too much to want to know exactly "how the Windows desktop handles executables" and how that contributes to the threat. http://www.evden-eve-nakliyat.name.tr/ [evden-eve-...at.name.tr]

Slightly OT: why corps bother with browsers?

[Bazman (4849)]

Why does MS and Apple put huge amounts of money into developing browsers when Firefox exists? IE and Safari generate zero revenue for the company since they give the software away, so it can't look too good on the balance sheet.

I can only think that it's some kind of NIH syndrome, or content-control-freakery, or that if they suddenly stopped making a browser and said 'oh flip it, Firefox wins' that confidence in the corporation (and hence share price) would nose dive.

Any other ideas?

prefs

[Beer_Smurf (700116)]

You can tell Safari to put downloaded files where ever you want.
So they don't have to be on the desktop

Denial of Service

[Inf0phreak (627499)]

It certainly opens the possibility for some "fun" denial of service attacks. How many files do you need on your desktop before explorer.exe croaks? I presume the number is well under 100,000?

Such as...?

[Animaether (411575)]

A list of actual drive-by vulnerabilities in current Internet Explorer (name-calling went out of vogue when you reached the age of 15, man. You are at least 15, right?) that allow for code execution on the client to substantiate your claim, please.*

Now if you want to point fingers, visit that Dhanjani link and read about the vulnerability he's not disclosing, as a courtesy to Apple; "The third issue I reported to Apple is a high risk vulnerability in Safari that can be used to remotely steal local files from the user's file system [...] it is a high risk issue affecting Safari on OSX and Windows". There hasn't been an update to that in the past 2 weeks, implying that it has not yet been fixed.

The Slashdot headline is pure flamebait and you took it.

Re:Wow. Just wow.

[NewbieProgrammerMan (558327)]

Apple just needs to turn the tables and tell people to shun IE and use Firefox/Opera/what have you, is all.

Or, maybe, you know, fix their security holes.

Re:Wow. Just wow.

[ozmanjusri (601766)]

Or, maybe, you know, fix their security holes.

If Apple won't fix it, why doesn't someone fork the project and produce a version that doesn't have the vulnerability?

Re:Wow. Just wow.

[erikina (1112587)]

Because they don't give you permission to? And even they did, no one would bother without the source.
I think that anyone who gives a shit, has moved away from proprietary web browsers. (And yes, I'm aware their rendering engine is under GPL as it's based on KHTML or w/e)

Re:Wow. Just wow.

[TheRaven64 (641858)]

WebKit is LGPL, not GPL. If it were GPL'd, it would not be possible for Safari to be proprietary. You can run Safari with your own version of WebKit relatively easily (and the LGPL requires Apple to allow this), but I don't think the changes you would need to fix this are in the WebKit layer. It's been a while since I looked at the WebKit code, but I seem to recall that it would be possible by wrapping one of the delegates, but that would be a very ugly hack.

Re:Wow. Just wow.

[dotancohen (1015143)]

If Apple won't fix it, why doesn't someone fork the project and produce a version that doesn't have the vulnerability?

For the same reason that nobody's forked Windows. It is not open source.

Re:Wow. Just wow.

[99BottlesOfBeerInMyF (813746)]

Just to clarify the cause effect relationship, that is not clear enough for me in the parent. KHTML, that is Konqueror's core, is open source, free software, and easily reusable. That's why Apple forked the project and uses it as a part of Safari.

Just to clarify your clarification. Apple forked KHTML, which was developed by the Konquerer team, and named their fork WebKit, which is also free and open source. Since then, the developers of KHTML have decided to abandon KHTML in favor of WebKit themselves and are integrating WebKit into Konquerer. So Safari and Konqueror's rendering engine is named 'WebKit' not 'KHTML'.

Re:Wow. Just wow.

[JanneM (7445)]

Or, maybe, you know, fix their security holes.

It's Apple. By definition anything they make is perfect in any conceivable way. If Safari allows forced downloads of thousands of executables, then it is because all web clients really should, and Apple is the only company with the vision, the foresight, and the polo sweaters to implement it. Just ask any Apple fanboy in your neighbourhood; he'll tell you.

Re:Wow. Just wow.

[Zontar The Mindless (9002)]

May I be the first to say:

Whooosh

Re:Quality of links

[esme (17526)]

some guy's blog

That guy appears to be the one who discovered the vulnerabilities and reported them to Apple.

Do you really think Slashdot shouldn't link to primary sources?

-Esme

So if it does this on OS X...

[Animaether (411575)]

Supposedly it does this on OS X as well, but the a comment above says it's not doing it, but that as an aside..

If it -does- do this on OS X, then it is called a convenience?

What is the convenience in having a folder automatically stuffed with files, downloaded without your say-so, exactly? Regardless of whether they can then be arbitrarily executed by a second program, or whether the user can execute them without a warning dialog popping up or not, etc. What, in your opinion, is convenient about it?

I find alt+click in Firefox convenient to download a file that I want without clicking on it and then going through the download dialog. I find it even more convenient that Firefox -asks- me if I want to download a given file if some crazy redirect page pointed me to one; gives me the opportunity to say "Hell no!" before the file even ends up on my drive.
But our opinions on convenience may differ.

Re:pot/kettle

[recoiledsnake (879048)]

One other thing that hit me immediately... MS: "Omigod they found a BUG in our competitor's web browser! Because we're very concerned for our users' security, we urge you to stop using that browser immediately! Users should NEVER use a buggy web browser! (unless it's explorer)"

Safari has been sneaked into millions of computers by Apple disguised as a iTunes/Quicktime update. Guess who gets the blame for all the spyware and exploits that get loaded up on Windows by Safari. Hint: You see hundreds of highly moderated comments on Slashdot blaming said entity whenever there's an article about spyware/virues/malware.

Re:first!

[tubapro12 (896596)]

I've already started exploiting this!!

<?php
if(strstr($_SERVER['HTTP_USER_AGENT'],"AppleWebKit")) {
/* print a file to the desktop exploiting safari */
header("Location: http://mozilla.mirrors.tds.net/pub/mozilla.org/firefox/releases/2.0.0.14/win32/en-US/Firefox%20Setup%202.0.0.14.exe [tds.net]");
} else
if(strstr($_SERVER['HTTP_USER_AGENT'],"MSIE")) {
header("Location: http://getfirefox.com/ [getfirefox.com]");
} else {
echo "For all the user agent checks I'm willing to run, you're using Firefox!";
}
?>