Homeland Security Warns About Latest Dangerous Apple Browser Bug
May 10, 2010 5:20 PM
comment(s) - last by
Apple, which perpetually makes fun of Microsoft's Windows for being "buggy" and "virus prone" is yet again endangering its users with lax security and poorly written code.
This time Apple's latest security woe is a "highly critical" flaw in its Safari browser; and Apple is yet again silent on the issue.
Cyberthieves can use the vulnerability to execute arbitrary code, steal information
when it comes to security has yet again come back to bite it. This time Danish security research firm Secunia
yet another vulnerability in the web browser Safari, which they billed as "highly critical" -- their most serious rating.
Secondary confirmation of the bug came from the United States Computer Emergency Readiness Team (US-CERT) (part of the U.S. Department of Homeland Security), which
an advisory after Polish researcher Krystian Kloskowski disclosed the bug on Friday.
The bug exploits Apple's
of code that handle's the browser's parent windows. According to Secunia, "This can be exploited to execute arbitrary code when a user visits a specially-crafted Web page and closes opened pop-up windows."
US-CERT adds that HTML email opened in webmail services such as Gmail or Windows Live Hotmail may also exploit the flaw. By compromising the operating system, hackers are free to log user information (such as credit cards or personal contacts) and install malware to accomplish a host of evils.
The flaw works in Windows 7 on the latest version of Safari 4 (4.0.5). "Other versions may also be affected" according to US-CERT -- so OS X users of Safari aren't off the hook yet. Charlie Miller, noted Mac hacker and security expert was not available to verify whether the bug existed in OS X. He's on vacation after hacking Safari and
earning $10,000 in loot
in March at the Pwn2Own contest.
Miller has stated that Macs and Apple software are often easier to hack than PCs and Windows software. Overall there's been relatively little interest in hacking Macs or Apple products, but what little attention there has been has revealed a host of security flaws. Apple patched 16 flaws in Safari in mid-March -- including 10 that affected OS X. Miller's exploit was among those flaws fixed.
Many security experts have criticized Apple's lax stance on security and poorly implemented products. Charlie Miller
Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town.
Mac researcher Dino Dai Zovi
once put it
There is no magic fairy dust protecting Macs. Writing exploits for [Microsoft] Vista is hard work. Writing exploits for Mac is a lot of fun.
This article is over a month old, voting and posting comments is disabled
5/10/2010 6:09:47 PM
Most likely because you gave Safari access to make changes to your system when you installed it. UAC pretty much only happens when you want to install something or run an update like for Java.
5/10/2010 7:08:19 PM
No, UAC pops up when something requires privileges higher than the current user privileges. This means that any administrator task would need permission no matter what. There is no way to "white-list" an application or give it permissions before-hand. It's likely that code that has been executed by this exploit did not require any admin privs at all. (Not all malware requires admin in order to accomplish their goals).
One could easily create a keyboard hook and use a keylogger without admin privs, and if the code is executed through the safari process, it likely already has firewall privs to bypass it and send back the data. That is just one example, and many other tasks like reading registry keys are more examples (assuming the registry keys have read permission by the current user)
5/11/2010 4:26:54 PM
Never mind the fact that most people seem to blindly click the "get out of my way" button on UAC messages.
“And I don't know why [Apple is] acting like it’s superior. I don't even get it. What are they trying to say?” -- Bill Gates on the Mac ads
Stem Cells Generate New Trachea for Patient, First Organ Grown In Vivo
March 22, 2010, 11:09 AM
Another Major Mac Computer Security Flaw Discovered
July 30, 2009, 10:52 AM
Mac Gets The Girl In New Anti-Microsoft Ad
May 13, 2009, 9:33 AM
Safari Plagued By Bugs, Accidental Violation Of Its Own EULA
March 27, 2008, 1:03 PM
Twitter Senior VP: "Diversity is Important, But We Can’t Lower the Bar"
November 9, 2015, 9:59 AM
CNN Resorts to Internet Censorship to Promote Clinton Over Senator Sanders
October 15, 2015, 2:47 PM
Breaking Bad: How to Crash Google's Chrome Browser With Just 8 Characters
September 23, 2015, 11:08 AM
Quick Note: Amazon UK Offers £10 Back on Any Order £50 or Over
August 3, 2015, 12:05 PM
Editorial: Reddit Allows Itself to be Hijacked as a Hate Platform For Racist Bigots
July 21, 2015, 6:32 PM
Mozilla and Facebook to Adobe: It's Time to Kill Flash
July 20, 2015, 6:30 PM
Most Popular Articles
DHS and TSA: Whoops, We Missed That 73 Airport Employees May be Terrorists
November 19, 2015, 2:16 PM
Creationists are Mad About Google Doodle Depicting Evolution
November 24, 2015, 8:48 PM
iPhone 7 May Pack 3-4 GB Memory, More Storage; 4-Inch Comeback is Rumored
November 20, 2015, 10:12 PM
Jumbo Joust: iPad Pro vs. Surface Pro 3 vs. Surface Pro 4
November 11, 2015, 1:00 AM
"Prepare to be Punished": Microsoft is Killing OneDrive With Cuts, Blames Users
November 3, 2015, 8:23 PM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information