Forgot your password?
typodupeerror
Microsoft Businesses Operating Systems Security Software Windows Apple

Microsoft Urges Windows Users To Shun Safari 502

Posted by CowboyNeal
from the big-surprise-there dept.
benjymouse writes "The Register has picked up on a recent Microsoft security bulletin which urges Windows users to 'restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.' This controversy comes after Apple has officially refused to promise to do anything about the carpet bombing vulnerability in the Safari browser. Essentially, Apple does not see unsolicited downloads of hundreds or even thousands of executable files to users' desktops as being a security problem." Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you.
This discussion has been archived. No new comments can be posted.

Microsoft Urges Windows Users To Shun Safari

Comments Filter:
  • Accidentents. (Score:5, Insightful)

    by Vectronic (1221470) on Saturday May 31, 2008 @08:01AM (#23608951)
    "Now while downloading a hundred files to your desktop won't automatically execute them, Microsoft's position is that a secondary attack could execute them for you."

    With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]
    • by Vectronic (1221470) on Saturday May 31, 2008 @08:02AM (#23608959)
      Time for bed.
    • Re:Accidentents. (Score:4, Interesting)

      by Anonymous Coward on Saturday May 31, 2008 @09:00AM (#23609261)
      It doesn't take hundreds of files. It takes one file.

      According to Nate McFeters, Microsoft has a working "one click and the bad guy gets code running on your machine" exploit.

    • Re:Accidentents. (Score:5, Insightful)

      by dfm3 (830843) on Saturday May 31, 2008 @09:09AM (#23609303) Journal

      With hundreds of files on your desktop, what are the odds you'd hit one when you are just blanking out a selection, or deleting them, or frustratingly smack your mouse for [whatever reason]
      Or, even worse, on purpose.

      First, imagine how many people would just blindly click on a new desktop icon just to "see what it does".

      Second scenario, most Windows users I know keep file extensions off by default, and keep dozens of shortcuts to executables on their desktop among various folders, downloaded files, and other clutter. Now what if the downloaded file were named "safari.cgi" or "iTunes.cgi", but all the user sees is Safari with a generic file icon. I know many people who would think, "hmm, the icon to my internets is messed up" and click it anyway.
    • Re:Accidentents. (Score:5, Interesting)

      by Znork (31774) on Saturday May 31, 2008 @09:15AM (#23609329)
      Why even bother with executing them? I can imagine a whole host of marketing people thinking this is a great way to obtain prime advertisement real-estate.

      Getting an icon on a users desktop is something some companies pay a lot of money for. In fact, the ability to spam any download folder is probably something they regard as worthwhile.
    • Re:Accidentents. (Score:5, Insightful)

      by kitgerrits (1034262) * on Saturday May 31, 2008 @09:17AM (#23609347)
      As a Linux user, I have to point out one thing in Microsoft's defense:
      Lately, it seems to tag executables that have been downloaded and warns you about it when you try to run them.
      Apparently, Safari does not have this mechanism, so users might assume it's a valid local icon.

      I still run Firefox, though.
      • Re:Accidentents. (Score:5, Informative)

        by MobyDisk (75490) on Saturday May 31, 2008 @11:37AM (#23610347) Homepage
        It's funny that you say that, because on my MacBook Pro it is the exact opposite. Safari does this and Internet Explorer does not.

        Under OS X, when you click an installer image downloaded by Safari it says something like "The application 'Whatever' was downloaded from the Internet on {date}. Are you sure this is safe to open?'

        I sometimes use IE on Windows (for testing sites I develop) and I've never seen a comparable message from Internet Explorer.

        Maybe you are talking about IE on Vista and Safari on Windows?
  • Wow. Just wow. (Score:3, Interesting)

    by yanyan (302849) on Saturday May 31, 2008 @08:02AM (#23608957)
    The irony level in this situation is simply astounding. Secondary attack can cause execution of said downloaded binaries? What about all that malicious content that Internet Exploiter happily executes for the user with nary a warning or confirmation?

    • Re: (Score:2, Insightful)

      by Flamora (877499)
      While it's true that IE's security isn't much better, they do have a point.

      Apple just needs to turn the tables and tell people to shun IE and use Firefox/Opera/what have you, is all.
    • Such as...? (Score:5, Informative)

      by Animaether (411575) on Saturday May 31, 2008 @08:20AM (#23609041) Journal
      A list of actual drive-by vulnerabilities in current Internet Explorer (name-calling went out of vogue when you reached the age of 15, man. You are at least 15, right?) that allow for code execution on the client to substantiate your claim, please.*

      Now if you want to point fingers, visit that Dhanjani link and read about the vulnerability he's not disclosing, as a courtesy to Apple; "The third issue I reported to Apple is a high risk vulnerability in Safari that can be used to remotely steal local files from the user's file system [...] it is a high risk issue affecting Safari on OSX and Windows". There hasn't been an update to that in the past 2 weeks, implying that it has not yet been fixed.

      The Slashdot headline is pure flamebait and you took it.
      • Re: (Score:3, Insightful)

        by gmuslera (3436)
        Since internet explorer creation were a long, dangerous, ridiculous and at times even funny list of code execution vulnerabilities in internet explorer. How many times Microsoft ordered users to shun Internet Explorer (our Outlook, or IIS or MSSQL, to put an small example) because had such kind of vulnerability being actually exploited?

        How many times passed long time before Microsoft acknowledged that were a problem, and then even more time to fix it?

        And, maybe more important... what are the odds of Microso
        • Re: (Score:3, Insightful)

          by recoiledsnake (879048)
          Maybe they're worried because Apple is pushing Safari on hundreds of millions of unsuspecting users disguised as a iTunes and Quicktime update?
  • by Raian +3 (1119035) on Saturday May 31, 2008 @08:02AM (#23608963)
    Talk about the stove calling the kettle black.
  • by DrHackenbush (1273982) on Saturday May 31, 2008 @08:09AM (#23608995)
    Finally, something I we can agree on.
  • doesn't work? (Score:4, Interesting)

    by v1 (525388) on Saturday May 31, 2008 @08:10AM (#23608997) Homepage Journal
    ok I'm the curious type so I made a test on my server, with the provided example.

    Since Safari does not know how to render content-type of blah/blah, it will automatically start downloading carpet_bomb.cgi every time it is served.

    Not for me? Safari 3.0.4 running on Mac OS X 10.5.2 renders a web page of numerous blank empty boxes. Nothing was placed in any local folder. Is anyone else able to duplicate this?

    • Re:doesn't work? (Score:4, Interesting)

      by TheRaven64 (641858) on Saturday May 31, 2008 @08:15AM (#23609015) Journal

      I didn't try this specific code, but Safari does have an irritating habit of randomly downloading things instead of displaying them. I have a load of .php files in my downloads directory because I've clicked on things in online svn browsers and it's decided it can't render them. It's not a huge vulnerability, but it is an irritation which could be easily fixed and it's frustrating that they don't.

      I really don't understand why Safari on OS X runs with so many privileges. OS X has a fine-grained access control mechanism in the kernel as of 10.5 and I would really like to see Safari configured so it can't write anywhere except your downloads and preferences directories and can't read anywhere other than your preferences by default.

      • Re:doesn't work? (Score:4, Interesting)

        by nine-times (778537) <nine.times@gmail.com> on Saturday May 31, 2008 @08:24AM (#23609059) Homepage

        That's all this is about? Safari downloads some things instead of displaying them? Is that even a security bug?

        If my browser doesn't know how to display it, I think I'd rather it didn't try. Trying seems like it might be even more dangerous. Am I wrong?

        • Re:doesn't work? (Score:4, Insightful)

          by Dogtanian (588974) on Saturday May 31, 2008 @08:34AM (#23609115) Homepage

          That's all this is about? Safari downloads some things instead of displaying them? Is that even a security bug? If my browser doesn't know how to display it, I think I'd rather it didn't try. Trying seems like it might be even more dangerous. Am I wrong?
          I'll give you the benefit of the doubt and assume that you posted this in good faith. However, what you're essentially saying ("it's not perfect, but I'd rather it was done the way it's done now") implies a false dichotomy.

          What's stopping the browser from saying "I can't handle this file/etc, but please click here if you wish to save it to your desktop"? In the majority of situations, most people wouldn't bother downloading it anyway.
          • Re: (Score:3, Insightful)

            by kiddygrinder (605598)
            i wish people would stop saying false dichotomy, it makes me feel uncomfortable... a false set of mutually exclusive groups? how does that even work?
        • Re:doesn't work? (Score:5, Insightful)

          by LuxFX (220822) on Saturday May 31, 2008 @09:40AM (#23609481) Homepage Journal
          Not a security bug? The downloaded files go directly to the desktop.

          So, what if a site triggers an automatic download of a file called "My Computer.exe" to an XP computer, using the typical My Computer icon. Will a casual user be able to tell the difference? One click will take them to My Computer, another might install a spam zombie. Now think of a user with 500 extra My Computer icons. Which do they choose?
      • by Malekin (1079147)
        Realistically you'd want Safari to be able to read more than just its preferences/cache files. What about the case of adding an attachment in a webmail interface? Or uploading a photo to a photo-sharing site? Or submitting an assignment for school? The file the user is trying to read could exist anywhere the user has read privileges for.

        Similarly you could restrict Safari's write privileges to just its preferences, cache files and a downloads folder but this removes much of the functionality of things l
      • Re: (Score:2, Insightful)

        by Swizec (978239)

        I have a load of .php files in my downloads directory because I've clicked on things in online svn browsers and it's decided it can't render them.

        And how was it supposed to render them? There's nothing there that's gonna run the php script and serve the contents it provides. At best the browser would get headers that tell it "hey, this is a text file" and the browser would display it as such, but there is such a thing as headers that say "always download this no matter what you think you can do with it".

        Now I'm not sure whether that's the case or not, but files in svn repositories were never meant to be parsed by browsers.

  • So just how does Safari react when you go to Microsoft's update website?
  • 1, 2, 3 ... SHUN! (Score:5, Insightful)

    by Anonymous Coward on Saturday May 31, 2008 @08:18AM (#23609031)

    Wow. Have to admit I'm on Microsoft's side here. Let's see:

    1. automatically download browser as an update whether user likes it or not;
    2. have the audacity to set the browser as default, again whether the user likes it or not;
    3. introduce vulnerability;
    4. ...
    5. errr, no.

    It's not just the vulnerability that hurts, but the compund bullshit caused by Apple's -- rather arrogant -- actions. This reads like something Microsoft would do!

    Also, vulnerabilities in Apple software (and this bug affects both Windows and Mac), make all *nix stuff look bad: watch MS shills roll out the 'Microsoft software is only vulnerable because hackers target it' FUD in short order.

    Posting as AC due to Apple fanboy-mods. Modding this down doesn't stop it being the truth.

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      I agree with you. Apple programs seem to have an extraordinary amount of arrogance when it comes to stuff like this ("have iPods act as generic USB devices like many competitor MP3 players do? No thanks, we'd rather obfuscate the file structure just so Windows users can learn how irritating and laggy the iTunes port is!"). Plus, a browser that downloads files when it can't render them does seem like a stupid security hole.

      Having said that, I think Microsoft's concern here is a bit dumb - they're basically
    • Why do Apple's Safari vulnerabilities on both Windows and Mac make all *nix stuff look bad? I think this is one case where fanboy mods or no, the point fails.

      All vulnerabilities in Safari do is make Apple look bad. Apple controls their OS and their applications. Linux doesn't come with Safari and yet it is a *nix flavor. Most Apple users probably don't even realize that OSX is Apple's GUI over BSD.

      Personally, I'll take Linux over OSX or Windows any day.
    • Re:1, 2, 3 ... SHUN! (Score:5, Interesting)

      by Spy der Mann (805235) <spydermann.slash ... m ['ail' in gap]> on Saturday May 31, 2008 @08:59AM (#23609259) Homepage Journal

      This reads like something Microsoft would do!


      And that's no wonder. Steve Jobs and Bill Gates were cut with the same scissors. Back in the 80's, while Billy kept stealing whatever idea he stumbled upon, Steve Jobs only thought of becoming more powerful and promote a competitive environment inside Apple, even if that destroyed the moral of his employees.

      Please do yourselves a favor and watch Pirates of Silicon Valley [imdb.com]. It's an enlightening movie. And yes, Steve did even worse things, but they're too shocking to be mentioned in public.
    • Re: (Score:3, Insightful)

      by Jesus_666 (702802)
      Apple software for Windows is shit. Always has been. Apple spends all the polishing time on its own platform.
  • but how can Safari download the files without user consent (and the fact that asking user whether to download the file is a feature request :-O). I haven't seen any other browser behaving like that.
  • Microsoft (Score:4, Insightful)

    by kardelen133 (1299169) on Saturday May 31, 2008 @08:36AM (#23609125)
    Hi all I'm in the uncomfortable position of agreeing with Microsoft on this issue. If a browser (any browser) allows a website to randomly download files without the user's explicit permission, regardless of the location, it is a security issue in my opinion. Having said that, I take issue with Microsoft's security advisory. The only thing they say is: "What causes this threat? A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a userâ(TM)s machine without prompting, allowing them to be executed." OK, but how about telling us the how or why? Since it is a direct contributor which causes the blended threat, I don't think it's asking too much to want to know exactly "how the Windows desktop handles executables" and how that contributes to the threat. http://www.evden-eve-nakliyat.name.tr/ [evden-eve-...at.name.tr]
  • Good advice (Score:2, Interesting)

    by labmonkey09 (992534)
    This is a reasonable warning that would be applied as is to any other app. Apple leaving this unpatched is feeding fuel to fire, that started with Quicktime vulnerabilities and the sudden uptick of Mac vulnerabilities over the last few years, that Apple is no more serious or maybe capable about security than any other company.
  • Well, let's see:

    A combination of the default download location in Safari and how the Windows desktop handles executables creates a blended threat in which files may be downloaded to a user's machine without prompting, allowing them to be executed.

    Oh, I see. So, the auto-download feature doesn't "properly" tag them like IE7 does, so users might accidentally execute a program without being first informed it was downloaded? Gosh. Sounds less like a security vulnerability than MS blowing smoke.

    But, wai

    • Re: (Score:3, Insightful)

      by Quantumstate (1295210)
      Just because the code cannot be executed directly hardly means it isn't a security problem. Basically you have a file downloaded to the users desktop without the users permission. I could create an executable called My Computer.exe with the my computer icon and that will be downloaded to the desktop without user consent. How is that not a security risk?
  • by johnrpenner (40054) on Saturday May 31, 2008 @08:53AM (#23609227) Homepage

    One hundred rounds does not constitute firepower.
    One hit contitutes firepower. (Gen. Merritt Edson, USMC)

  • by Bazman (4849) on Saturday May 31, 2008 @08:58AM (#23609257) Journal
    Why does MS and Apple put huge amounts of money into developing browsers when Firefox exists? IE and Safari generate zero revenue for the company since they give the software away, so it can't look too good on the balance sheet.

    I can only think that it's some kind of NIH syndrome, or content-control-freakery, or that if they suddenly stopped making a browser and said 'oh flip it, Firefox wins' that confidence in the corporation (and hence share price) would nose dive.

    Any other ideas?

  • prefs (Score:4, Informative)

    by Beer_Smurf (700116) on Saturday May 31, 2008 @09:01AM (#23609265) Homepage
    You can tell Safari to put downloaded files where ever you want.
    So they don't have to be on the desktop
    • But Safari places them on the desktop by default. This is the key problem, and in fact a good number of security vulnerabilities woudn't be an issue if it weren't for the fact that the majority of users stick with the default settings.

      And you can't make the argument that the only people downloading Safari are power users anymore - if you have an iPod, odds are that Apple Update has pushed Safari to your machine.
    • Re: (Score:3, Funny)

      by recoiledsnake (879048)

      You can tell Safari to put downloaded files where ever you want. So they don't have to be on the desktop
      How can I tell Safari to put downloaded files in /dev/null ?
  • Uhh... (Score:3, Insightful)

    by lilfields (961485) on Saturday May 31, 2008 @10:27AM (#23609799) Homepage
    I keep reading comments like "well in OSX blah blah" or "Windows just isn't secure"...ok that's informative, but it's really beside the point. I'm willing to bet that Apple is not addressing this fix because it's good PR to the uninformed. If the user perceives that it's Windows' fault then they might well go all Mac since they are already using Safari...Anyhow, I think that along with the PR bit, Apple doesn't want to admit that there is a huge gaping hole in their web browser, which raises a question...is Apple ready for a bigger market share? Microsoft may have security holes, but you can almost bet they will be patched in a timely matter. With Apple, from my experiences, it takes quite a while for updates to hit the servers. I don't really see this as controversial at all, Apple needs to patch their product, Microsoft has an obligation to protect their users...I would expect Apple to do the same with IE if Microsoft out right REFUSED to patch it. I know there is a lot of Microsoft hate here on Slashdot...but this is pretty obvious in that it's Apple being the "bad guy" here.
  • by Inf0phreak (627499) on Saturday May 31, 2008 @10:56AM (#23610029)
    It certainly opens the possibility for some "fun" denial of service attacks. How many files do you need on your desktop before explorer.exe croaks? I presume the number is well under 100,000?
  • by Vexorian (959249) on Saturday May 31, 2008 @02:09PM (#23611571)
    It can really be a serious vulnerability, most default windows setups hide the .exe of executable filenames, with this I could easily place a bogus "My computer" icon that executes my favorite rootkit.
    • Re: (Score:3, Interesting)

      by El_Oscuro (1022477)
      Oh, the wannabe Mac "Hide file extensions of known file types"? Been annoying me since Windows 95. With the security vulnerabilities this represents, you would have thought M$ would have changed the default by now?
  • by wicka (985217) on Saturday May 31, 2008 @03:40PM (#23612273)
    I guarantee you someone at Microsoft had to bake cupcakes when they found out they could justifiably classify an Apple product as a security risk.

Save gas, don't use the shell.

Working...