Friday, June 13, 2008

Safari Carpet Bombing from the SANS OUCH Newsletter Volume 5, Number 6 June 2008 Serious vulnerabilities in Safari have spawned a troubling attitude from Apple about them. It has been known for years that the Safari browser does not warn users before downloading files to their system. It's a simple trick to get Safari to download a file to the user default file location with no user intervention or notice from the browser. For users who install the Windows version of the Safari browser, that default location is the desktop, so the attacker could fill up your desktop with unsolicited files. The next step is for the Bad Guys to load up your desktop with malware in files named "My Computer"-thus the name "Carpet Bombing" for the attack. On the Mac, the files end up in the Downloads folder. Apple has decided to treat this as a normal product enhancement request and not a security problem. More information: http://blogs.pcmag.com/securitywatch/2008/05/safari_carpet_bombing.php http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html 9:24:40 PM    comment []