Print 40 comment(s) - last by bupkus.. on May 11 at 5:35 PM

Apple, which perpetually makes fun of Microsoft's Windows for being "buggy" and "virus prone" is yet again endangering its users with lax security and poorly written code.  (Source: Apple)

This time Apple's latest security woe is a "highly critical" flaw in its Safari browser; and Apple is yet again silent on the issue.
Cyberthieves can use the vulnerability to execute arbitrary code, steal information

Apple's arrogant air when it comes to security has yet again come back to bite it.  This time Danish security research firm Secunia discovered yet another vulnerability in the web browser Safari, which they billed as "highly critical" -- their most serious rating.

Secondary confirmation of the bug came from the United States Computer Emergency Readiness Team (US-CERT) (part of the U.S. Department of Homeland Security), which issued an advisory after Polish researcher Krystian Kloskowski disclosed the bug on Friday.

The bug exploits Apple's poor implementation of code that handle's the browser's parent windows.  According to Secunia, "This can be exploited to execute arbitrary code when a user visits a specially-crafted Web page and closes opened pop-up windows."

US-CERT adds that HTML email opened in webmail services such as Gmail or Windows Live Hotmail may also exploit the flaw.  By compromising the operating system, hackers are free to log user information (such as credit cards or personal contacts) and install malware to accomplish a host of evils.

The flaw works in Windows 7 on the latest version of Safari 4 (4.0.5).  "Other versions may also be affected" according to US-CERT -- so OS X users of Safari aren't off the hook yet.  Charlie Miller, noted Mac hacker and security expert was not available to verify whether the bug existed in OS X.  He's on vacation after hacking Safari and earning $10,000 in loot in March at the Pwn2Own contest.

Miller has stated that Macs and Apple software are often easier to hack than PCs and Windows software.  Overall there's been relatively little interest in hacking Macs or Apple products, but what little attention there has been has revealed a host of security flaws.  Apple patched 16 flaws in Safari in mid-March -- including 10 that affected OS X.  Miller's exploit was among those flaws fixed.

Apple is keeping quiet on the latest danger to its customers -- its usual response to such security dangers.  Security experts at US-CERT and Secunia are providing Safari users with some sound advice for now at least -- don't open untrusted HTML emails, and disable JavaScript except on trusted sites.

Many security experts have criticized Apple's lax stance on security and poorly implemented products.  Charlie Miller states, "Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town."

Or as Mac researcher Dino Dai Zovi once put it, "There is no magic fairy dust protecting Macs.  Writing exploits for [Microsoft] Vista is hard work. Writing exploits for Mac is a lot of fun."

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

This is a windows bug
By Tony Swash on 5/11/2010 7:35:23 AM , Rating: -1
This is a windows bug. The solution to running Safari on Windows is simple - get a Mac and relax.

99.9% of all actual attacks or security breaches on computers occur on PC's running windows, that fact may irritate many but it is still a fact. If you want security avoid Windows.

RE: This is a windows bug
By Hieyeck on 5/11/2010 7:49:39 AM , Rating: 3
Are YOU the retard Jason was walking about?

RE: This is a windows bug
By MrBlastman on 5/11/2010 8:46:21 AM , Rating: 2
Wow. Sooo avoid the platform that has the most people working on actually FIXING security holes and instead, move to the platform where the people in charge of ever fixing something remain silent at all times and never admit there is a problem... You might never know if something gets fixed.

Yeah, that makes total sense.

The only problem 99% of actual attacks occur on Windows is because the majority of people use Windows. Apple's OS's have far more security holes, you just don't know it yet.

RE: This is a windows bug
By Tony Swash on 5/11/10, Rating: -1
RE: This is a windows bug
By bupkus on 5/11/2010 5:35:35 PM , Rating: 1
I don't think the reason that the mac platform has less malware than windows (by an order of magnitude) is because of market share but even if it was - so what? If you want a computing experience that's free from malware, viruses, trojans and all that sort of crap - get a mac. If you are happy with all the malware shit then stick with Windows. The choice is pretty simple.

If you want a computing experience that's free from malware, viruses, trojans and all that sort of crap - get OS/2 Warp . It also fits your market share model.

"What would I do? I'd shut it down and give the money back to the shareholders." -- Michael Dell, after being asked what to do with Apple Computer in 1997

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki