Safari "Carpet Bomb" Attack Code Released 118
snydeq writes "A hacker has posted attack code that exploits critical flaws in the Safari and Internet Explorer Web browsers. The source code can be used to run unauthorized software on a victim's machine, and could be used by criminals in Web-based computer attacks, security experts say. The public example of the attack code allows attackers to litter a victim's desktop with executable files, an attack known as 'carpet bombing.' In combination with bugs in Windows and Internet Explorer, attackers can run unauthorized software on a victim's computer."
This is a longstanding Windows flaw. (Score:2, Insightful)
I am still boggled by the fact that Microsoft didn't fix the deep problems here ten years ago.
Better yet... (Score:3, Insightful)
Re:Best Solution (Score:3, Insightful)
mod parent up (Score:5, Insightful)
If Windows has an "unsafe" flag for files, it should be used by Safari. Also, I find using desktop as default download space incredibly annoying (yes, i'm looking at you firefox).
That said, IE should also know better than to execute random files from the desktop, which seems like the nastier issue here.
Re:This is a longstanding Windows flaw. (Score:5, Insightful)
Re:Quick Workaround... (Score:5, Insightful)
C:\Program Files\Notepad++\notepad++.exe %1
This problem seems to be two fold. First, Safari will automatically download stuff, to your desktop, without asking you. Secondly, IE will load DLLS from the desktop, just because they happen to have the same name as some other DLL it is looking for. I think the bigger problem here is with IE, because it doesn't matter how the dll got on your desktop, it shouldn't be using it.
Dear Apple, Please stop sucking (Score:1, Insightful)
Re:This is a longstanding Windows flaw. (Score:2, Insightful)
Re:Wrong section, eds! (Score:4, Insightful)
No, it isn't.
Re:Best Solution (Score:3, Insightful)
If it weren't for Safari downloading the files to the desktop by default, they wouldn't get there.
If it weren't for IE opening these files from the desktop by default, they wouldn't open.
Now, if you'll excuse me, I'd like to feel completely secure. I'm going to go install my old copy of OS/2 Warp v3 and Netscape Communicator.
Re:Wrong section, eds! (Score:3, Insightful)
Safari isn't implementing the basic security that is implemented in Windows.
Re:This is a longstanding Windows flaw. (Score:3, Insightful)
If so, why is %PROFILE%\Desktop in %PATH%?
Oh, no, it's this one: "While this is true, the behavior of the "DLL Search Order" (when it's disabled) is to look for the DLL in the current directory, right after the Internet Explorer's directory. As most users execute Internet Explorer from the Desktop, the current directory will be of course the user's Desktop (see screenshot below)."
Why is Internet Explorer's current directory the desktop?
It's not because Internet Explorer is in %PROFILE%\Desktop, because it isn't.
It's not because Internet Explorer is a shortcut on the Desktop, because that would run it with the current directory in the destination directory of the shortcut.
Perhaps it's because the Internet Explorer icon on the desktop is a special case, because of the browser-desktop integration?
Nah, that's crazy talk.
Re:Secure from the ground up! (Score:3, Insightful)
Re:Best Solution (Score:3, Insightful)
Sure, Safari (on Windows) can carpetbomb & spam your desktop. That's potentially annoying (but ultimately doesn't harm your system).
There's a distinction between Safari "making available" the malicious executable versus it actually being executed, which like I was saying, the person I was responding to was talking about.
Re:Closest resources first (Score:3, Insightful)