Safari Flaw Worse Than First Thought

Microsoft is warning that a previously disclosed flaw in Apple's Safari browser could have dire consequences for Windows users.


Safari Flaw Worse Than First Thought, Microsoft Warns

The Safari bug, originally disclosed on May 15 by security researcher Nitesh Dhanjani, allows attackers to litter a victim's desktop with executable files, an attack known as "carpet bombing."

It turns out that if this flaw is exploited in combination with a second unpatched bug in Internet Explorer, attackers can run unauthorized software on a victim's computer, according to Aviv Raff, a security researcher. Raff says he originally reported the IE flaw to Microsoft more than a year ago, and then told them about how it could be combined with the carpet bombing bug just over a week ago.

IDG News Service tested Raff's demonstration attack code, which runs Windows Calculator on a victim's system. For the attack to work, a victim must first visit a maliciously crafted Web page with the Safari browser, which in turn will trigger the carpet bombing attack and exploit the IE flaw.

Both the Safari and IE bugs "are moderate vulnerabilities that, combined, produce a critical flaw, which allows remote code execution," Raff said in an instant message interview.

Microsoft is taking the issue seriously. It released a security advisory on the problem late Friday, a sign that it may be working on a patch for the IE flaw. The advisory says that the vulnerability has to do with the way Windows handles desktop executables and recommends that Windows users "restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple."

The attack reportedly affects all versions of Windows XP and Vista, Microsoft said.

Apple may not be rushing out to patch this bug, however. Dhanjani says that Apple has told him that it is not treating the Safari bug as a security issue, a response that has generated criticism from the security community. Last week, for example, the consumer advocacy group Stopbadaware.org urged Apple to reconsider this stance.

According to Raff, unless Apple patches the bug, more attacks like the one he found in IE are likely to pop up. "This is not the only issue that can be combined with the Safari vulnerability," he said. "If Microsoft fixes this, Safari users will still be vulnerable."

Apple Stops Pushing Safari to PCs

A new version of Apple's Update utility lets you choose which components to install and which to ignore.


Apple Stops QuickTime Nagging About Safari

Apple made my pet-peeves list recently with its decision to push Safari out to Windows customers via its QuickTime Update software, and I certainly wasn't the only one. The good news is that Apple seems to have finally relented.

A new version of QuickTime Update, available beginning today, uses a two-pane interface to separate legitimate updates to your currently-installed components from any new applications that Apple would like you to install. Shockingly, that even includes iTunes, for those of us who use our PCs mainly for business. And, though the option isn't easy to find, the new version even lets you opt out of Safari and iTunes downloads completely.

To get it, first run your existing QuickTime Update software. You can find it by opening the QuickTime control panel from your Start menu, selecting the Update tab, then pressing the button marked "Update..." You should see an application called "QuickTime Update 2.1" -- leave the box next to that checked, but uncheck all the others.

Inexplicably, installing the new QuickTime Update requires you to restart your computer. Once you're back up and running, launch QuickTime Update again (the same way you just did) to see the new interface.

By default, all the current updates are checked (including Safari and iTunes), but you might notice that you can now download the latest version of the standalone QuickTime software, without iTunes. Hooray for that.

Here's the kicker, though. With the new division of software, it's relatively painless to opt out of Apple's iTunes and Safari nagging for good. Make sure that you've installed the QuickTime updates that you need, then launch QuickTime Update again. You should now see only the updates that you don't want. Now go to the Tools menu and choose "Ignore Selected Updates." (You can always reset your ignored updates later if you change your mind.)

Voila! You should now have a functioning Apple Software Update that does what it was intended to do -- update your software, not push multi-megabyte applications that you don't really want.

The Modern Browser Wars

Apple's Safari, Mozilla's Firefox 3, and Microsoft's Internet Explorer 8 duke it out to be the program you use most on your PC.


Updated Web Browsers: Which One Works Best?

Back when the earliest programs for viewing Web content simply browsed flat pages of images and text, the name browser truly fit the software.

But yesterday's amateur pages have evolved into dynamic, content-rich portals and powerful online programs. For many online habitués, the do-it-all browser has become a PC's single most important program.

Recognizing that fact, Apple's Safari, Microsoft's Internet Explorer, and Mozilla's Firefox are battling to win the nod as your browser of choice. So which one should you use--Safari 3.1, Firefox 3, or Internet Explorer 8?

Apple's latest offering, Safari 3.1, preserves the company's signature focus on clean design and smooth usability, but it lacks any phishing or malware filters.

For its part, Mozilla should have applied the finishing touches to Firefox 3 by the time you read this. From under-the-hood memory improvements to a major reworking for bookmarks, version 3 represents a big step forward.

Whereas the new Firefox and Safari browsers are ready to roll, Microsoft's early beta of Internet Explorer 8 remains a work in progress. Bugs and rough edges are to be expected in a first beta intended for developers and testers. But IE 8 beta 1 provides a glimpse of new features such as WebSlices (which let sites create widgety snippets of information that you can view by clicking a bookmark button) and Activities (which add right-click menu options for looking up selected text and pages on map, translation and other sites) that will distinguish the browser Microsoft eventually releases.

Firefox, IE, and Safari are the three most popular browsers, according to Internet usage statistics, but they aren't the only ones available.

(SIDEBAR: This is my 100th post in this blog! Kudos to me :))

Mac Gets Hacked

A MacBook Air goes down first at the CanSecWest security conference's hacking contest.

Gone in 2 Minutes: Mac Gets Hacked First in Contest

It may be the quickest $10,000 Charlie Miller ever earned.

He took the first of three laptop computers -- and a $10,000 cash prize -- Thursday after breaking into a MacBook Air at the CanSecWest security conference's PWN 2 OWN hacking contest.

Show organizers offered a Sony Vaio, Fujitsu U810 and the MacBook as prizes, saying that they could be won by anybody at the show who could find a way to hack into each of them and read the contents of a file on the system, using a previously undisclosed "0day" attack.

Nobody was able to hack into the systems on the first day of the contest when contestants were only allowed to attack the computers over the network, but on Thursday the rules were relaxed so that attackers could direct contest organizers using the computers to do things like visit Web sites or open e-mail messages.

Miller, best known as one of the researchers who first hacked Apple's iPhone last year, didn't take much time. Within 2 minutes, he directed the contest's organizers to visit a Web site that contained his exploit code, which then allowed him to seize control of the computer, as about 20 onlookers cheered him on.

He was the first contestant to attempt an attack on any of the systems.

Miller was quickly given a nondisclosure agreement to sign and he's not allowed to discuss particulars of his bug until the contest's sponsor, TippingPoint, can notify the vendor.

Contest rules state that Miller could only take advantage of software that was preinstalled on the Mac, so the flaw he exploited must have been accessible, or possibly inside, Apple's Safari browser.

Last year's contest winner, Dino Dai Zovi, exploited a vulnerability in QuickTime to take home the prize.

Dai Zovi, who congratulated Miller after his hack, didn't participate in this year's contest, saying it was time for someone else to win.

The Fastest Internet Browser

Apple Safari is faster than Internet Explorer and Mozilla, a testing firm says.


Surfing with Apple Safari

A testing firm says that Apple is faster than Microsoft's Internet Explorer, and Firefox - proof to what Apple said in June when it released the new beta version.

The testing firm has tried to download a webpage off a busy server using Apple's Safari, Microsoft Internet Explorer, and Firefox, and timed the results. Based on the tests, Apple's Safari is faster than Microsoft Internet Explorer 7 by 1.6 seconds, and Firefox by 1.2 seconds -- way slower than what Apple is currently advertising: 2x faster than Internet Explorer












However, the test is not conclusive. The firm has tested the browsers by downloading on a busy server - a huge no-no when testing for speed. This will result in bad data as busy servers may respond quicker or slower depending on the load. What they should have used is a local, dedicated testing server, to avoid interference with the data.

Apple has released a public version of Safari 3 on their website, available for both Mac and Windows.

I have tested the new Safari, and I must say it is faster than Internet Explorer 6 and 7. Loading Safari is comparable to Internet Explorer, but loading the page is faster - probably because it uses the progressive technique of loading pictures rather than displaying the image once the download is complete, a technique used by Internet Explorer. Using progressive loading, a blurry avatar or the image is displayed first, and later refined as the whole image is downloaded completely.

Other cool stuff is the tabbed browsing of Safari, and the ability to customize the toolbar (with cool movement animations). Safari for Windows uses manifests from Apple, meaning, the checkbox, option button, buttons, and checkboxes look like the ones on a Mac. Also, the ability to resize a text box is pretty neat. That way, if you want to see your entire text inside one, just drag and resize.

But the biggest drawback is that it does not display all pages correctly, especially the ones with Flash content. Adobe has not yet released a Flash player for Safari for Windows at the time of this writing. Since this version is also a beta, crashes are often.

You can find the latest version here and download the beta here.

Story:
Copyright 2007 by Sonicsoft Corporation
All Rights Reserved
Image: Apple Website