Developer Demonstrates Dashboard Exploit [UPDATE]
Developer Demonstrates Dashboard Exploit [UPDATE]
by , 10:45 AM EDT, May 9th, 2005
A developer has demonstrated a Dashboard exploit in Mac OS X 10.4 "Tiger" that a malicious Web site owner could use to install Widgets you might not want on your Mac. Writing under the name of Stephan.com, the developer said that a combination of Apple's lack of documentation for removing Widgets, Safari's download controls, and a Widget feature all make it possible for the bad guys to use Dashboard to take you to any Web site of their choosing, hijacking Dashboard for their nefarious purposes.
At issue is a feature in Safari called "Open safe files" that is turned on by default. This feature allows your Mac to automatically open image files, PDFs, movies, disk images, and other files considered safe when downloaded. Unfortunately, this also includes Widget files downloaded, which are installed when opened.
When combined with the ability to automatically download a file when visiting a Web page (an HTML feature not limited to Safari), Stephan.com demonstrated how easy it is for a Web site operator to autoinstall a Dashboard Widget without the consent of the user.
Where this really becomes a problem, however, is what the designer of the Widget does. According to Stephan.com, a Widget can be made to do such things as automatically send the user to a given Web page whenever the Widget is clicked on, and even when a user simply switches to Dashboard.
"This could be taken further, of course," wrote Stephan.com, "using all the nasty tricks developed by the [porn] industry over the last few years - opening hundreds of different pages in a few seconds, or moving the close box around quickly. I haven't tried this, but it looks like you can trivially make a Dashboard widget continue to execute even when Dashboard isn't open."
What makes the issue particularly difficult to deal with, according to Stephan.com, is Apple's decision not to provide a documented way to remove Widgets once installed. In fact, Apple's Mac OS X Help files state specifically that "You cannot remove widgets from the Widget Bar or change their order."
The work around for this is to manually remove any particular Widget from your ~Library/Widget directory, and rebooting your Mac, but this is something that many, if not most, users won't know. That means that for many people, once a malicious Widget is installed, it's going to stay installed.
He details further examples of areas of potential problem at his Web site. Please note that visiting the demonstration page with Safari in Tiger with the "Open safe files" option turned on will install his demonstration Widget, called Zaptastic, into your Dashboard panel.
Warning: In his discussion of the issue, Stephan.com links to (but does not display) a porn image that many will find offensive and/or disturbing.
Update: A safety precaution for those worried about these problems is to turn off "Open safe files" in your Safari general preferences. This will not prevent someone from auto-downloading a Widget to your system, but it will prevent it from being auto-installed.
Observer Comments
So if I'm reading this right, as long as I only download Widgets from trusted sites (like Apple.com) then I should be ok?
I'm guessing the eventual fix to this will be to disable the automatic openning of the Widget. Well, and an easy way to remove it. You could still load a bad one on purpose if it's mis-labled.
But hey, this wouldn't ACTUALLY happen, right? I mean, everyone's been telling me for years that the only reason Macs don't have viruses is because the market-share is so small. So of that means no one would take the time to write bad Widgets either! Right? 
We poke fun at the Windows users because of their lack of proper security and then Apple creates a "feature" that smacks of the same lax mentality towards security. I'm a devoted Mac user but we should give Apple some feedback on this one. (And I don't get a bunch or responses about how it doesn't really compromise your security, it's just a nuisance, blah blah blah... My point is that even a nuisance shouldn't be tolerated by users.)
Stephan has done us a bit of a favor identifying a potential problem for users of Widgets and identified a need for users to find and download Widgets from safe sites, like Apple.com.
It also presents a good opportunity for others (like TMO) to review and list Widgets that are "safe" and, hopefully, generate a little big of revenue from the service. Maybe TMO can provide a page called "The Widget Shop" where we know the code has been checked and cleared.
This brings into focus that Widgets are programs and, like any other program, can be either good or dangerous.
Mon May 09, 2005 11:24 am Subject: Widget Manager available on VersionTracker
Just released this morning is Widget Manager 1.0.1, which "is a Preference Pane for OSX 10.4 that allows you to inspect, remove, and disable Dashboard Widgets. To remove a widget without it, you would have to browse your Library/Widgets folder, delete the .wdgt file, and either log out or force-quit the Dock... what a pain!
Widget Manager also shows you the version numbers of widgets installed on your system, so you know when it's time to look for updates. It can also disable Widgets you don't want cluttering up the Widget bar, but don't necessarily want to delete, either.
What's new in this version:
Widget Manager will now show Widgets in the system Widget library folder.
Widgets are now sent to the Trash, rather than deleted immediately.
Widgets which cannot be deleted will be shown as read-only.
Minor bugfixes and improvements."
I think this should handle removing and knowing what widgets are on your system. Once again, it comes down to people being aware of what they are doing. Common sense is all it takes.
Mon May 09, 2005 11:37 am Subject: Firefox forever!
If you read this carefully, it does not say you should only visit sites you know are safe to download widgets. It says that as soon as you enter the site it automatically downloads and installs the widget. It is not something you are able to choose to do or not to do. The quick and easy way to avoid this is to turn off the the ability to "open 'safe' files after downloading" in the general tab of Safari's prefs. This is a smart thing to do anyway.
Mon May 09, 2005 11:49 am Subject: Yay Paranoid Android
Mon May 09, 2005 11:53 am Subject: Shame on you, Apple
The possibilities of this extend far beyond "opening unwanted web sites". A widget can execute shell scripts. That means it can, quite trivially, erase your entire hard drive, or do pretty much anything. (Source: http://www.macosx.com/forums/showthread.php?t=52482 )
And the whole point here is that it doesn't require you to download the Widget yourself. So the whole "only download from trusted sources" thing (which is not an acceptable solution anyway) is irrelevant.
This is truly a Microsoftian security hole, and it should NEVER have made it through the front gate. Safari's "Open 'safe' files after downloading" feature has always been ill-conceived and dangerous. Personally, I think it just needs to go outright. Or at the very least, make it a little smarter!
I'm really disgusted at Apple. I'm sorry, but we Mac users have just officially lost the right to talk about security.
"I'm really disgusted at Apple. I'm sorry, but we Mac users have just officially lost the right to talk about security."
You want some cheese with that whine???
If you don't think Apple will have this fixed within a week, you're nuts. But given your logic so far, I wouldn't doubt you'll complain about that too.
Mon May 09, 2005 12:10 pm Subject: Awful. Fix it Immediately.
This is, truly "Microsoftian" in lack of foresight. If Apple doesn't address this immediately, it's gonna get out into the press, and all those years of creating a locked-down, safe, virus-free OS will be down the toilet. Once OSX is just as bad as Windows in the average user's mind, a HUGE advantage Apple has will be erased.
Fix it now, Apple. This could blow up in your face.
Mon May 09, 2005 12:31 pm Subject: I guess billg was right
Mon May 09, 2005 1:21 pm Subject: Blah blah blah - a non-issue (but it will be fixed anyway)
Lost in all this is the fact that for the "exploit" to work, you first MUST go to a website run by such a nefarious hacker.
If you don't make a habit of clicking in porn spam, you really don't have think one to worry about.
Not even a nuisance -- a non-issue. Should be fixed (and will, Apple is very good and quick at this), but hardly something for the average user to waste their time on.
Apple is coping Microsoft. Now anyone can automatically download something on my machine that I don't want.
Actually there are two steps here. One is downloading things to your disk using your browser, and the other is to open such a downloaded file.
(1) Downloading things to your disk is something we all want and use. Usually this comes at the behest of clicking on a "download" link. What stephan.com did was to make this happen when the page is fist loaded. We see that variation all over the web too. But we normally end up with a .pdf .zip .tar or some other file.
(2) Opening such a file can be a problem, and it really is for a .widget. Opening a .pdf is no big deal. Opening a compressed or archive file is not usually a big deal either. But safari's opening a .widget causes some interesting side effects. Instead of opening the widget like the Finder would, Safari seems to move it to the ~/Library/Widgets folder and leaves it there for Dashboard to discover it.
Mon May 09, 2005 1:34 pm Subject: Widget running shell script
QuoteMikuro wrote:
The possibilities of this extend far beyond "opening unwanted web sites". A widget can execute shell scripts. That means it can, quite trivially, erase your entire hard drive, or do pretty much anything. (Source: http://www.macosx.com/forums/showthread.php?t=52482 )
It's bad, but not quite AS bad as you claimed. It could erase your entire home directory, but not the entire hard drive. It'd need root access to do the latter. Still, that would be one nasty widget.
But, don't forget that you need to do more than just visit the page: You have to drag it to from the widget bar before it can do any damage. I'm not saying this isn't a potentially serious problem, but anybody could write a "normal" application that'll also erase your home directory, for any platform (Windows, Mac OS 9 and X, Linux, etc.).
personally i don't think it's that big of a problem. the thing that puzzles me the most is that reality check hasn't chimed in yet... looks like he's starting to lose his edge 
apple will probably fix the security hole, it isn't that big a deal anyway, all they need to do is patch safari to prompt you whenever you download a widget file with one of those ominous security warnings and MOST people will not accidentally install them. of course there are much more thorough ways to patch the hole, but in order to keep the functionality of the auto install feature intact, that would be the best bet. (the admin pass is a good idea, but many people don't have the admin pass of the computer they use, i'm sure that was apple's reasoning in making the widget folder password-less.)
QuoteGuest wrote:
If you don't make a habit of clicking in porn spam, you really don't have think one to worry about.
Actually that is not true, all you have to do is go to a site (just like this one) that has a bug in their comment/forum software that allows someone to put HTML into their message, and then it will automatically install and do whatever its designer wants it to do (as opposed to whatever the user wants).
Saying that you have to visit a porn site (or whatever) to get it so it doesn't matter pretty much means that windows users don't have to worry about any exploits either right? As long as they stay away from porn.
Sorry, but life just got a little bit harder for Mac users.
Mon May 09, 2005 3:04 pm Subject: I prefer to be in the loop when installing software
I personally approve the suggested password request for the widget downloads but beside this new issue I was expecting that Apple would have already addressed a few issues of compatibility/functionality I have experienced across several machines (ibook, powerbook, iMac and G4 desktops). Thre major ones are:
1) Lost the ability to connect and print to several network deskjet and officejets etc.
2) Pages does not allow font changes (I was trying to use symbol instead of helvetica for some scientific notation)
3) the iMac (17" swivel flat screen) that was fine before installing Tiger now freezes after the screen saver is on for more than 1-2 hours (It does not wake up I should say)
4) I tried to update my email client (eudora from 6.0 to 6.2. It worked in the powerbook 15" where I still have 10.3.9) but I could not and had to do a 'new install' instead.
5) Norton antivirus 9.2 (corporate edition) and LiveUpdate are having problems and the Norton autoprotect module is not working at all.
I am sure the list of glitches will keep growing. I have been there and so have many of you and that is why I have installed only in machines that are not critical to my work. I expect both Apple and third party companies (HP, Symantec, qualcomm etc..) to fix most of these issues in the coming month or so. Or at least I hope so. 
Mon May 09, 2005 4:15 pm Subject: Re: Tiger Fixes
QuoteAnonymous wrote:
I expect both Apple and third party companies (HP, Symantec, qualcomm etc..) to fix most of these issues in the coming month or so. Or at least I hope so.
It looks like many of your issues are on the list to be fixed in 10.4.1
http://www.appleinsider.com/article.php?id=1058
Hard to say for sure, the descriptions are still kind of vague. But it looks like you'll be happy with it. They're saying you'll see it before the end of the month.
I'm not sure that your mac freezing is a Tiger thing. My PowerBook has started freezing the exact same way since the last security update and I'm not running Tiger on it. Once it goes to sleep, with the lid open, for a long period of time it will not wake up. If I close the lid, it works fine. Go figure.
Quotemacdude wrote:
I'm not sure that your mac freezing is a Tiger thing. My PowerBook has started freezing the exact same way since the last security update and I'm not running Tiger on it. Once it goes to sleep, with the lid open, for a long period of time it will not wake up. If I close the lid, it works fine. Go figure.
You may be right. Of 2 iMac (identical hardware specs) only one is displaying this behaviour and both got Tiger installed. It could be due to the software installed and/or the HD. The one that freezes has a lot of high end software that's not installed in the one that works fine. The one that works fine also has an upgraded HD (160 GB) since I lost the original one.
The people that are posting the "just download widgets from Apple" line don't get it ... in its default state, SAFARI will AUTO-DOWNLOAD AND AUTO-INSTALL WIDGETS ... sure, YOU have to RUN them, but a little social engineering is not difficult to work out for users who are not that computer savvy - Now add into the equation a widget that calls on something like Automator - which has already demonstrated the ability to override QUICKTIME 7s default non pro settings - refer: MacFixit forums "Getting a quicktime movie to play full screen with Automator" ... the thing is it appears that no-one at Apple has really thought through the implications of these features and the links that may be made from one to another ... I expect better. The PORN industry must be laughing it up right now as they conceive of loading your machine with something that hijacks your browser every time you use it, heck the widget could be one pixel by one pixel wide - how are you going to track that, not to mention that guy who wants to log every key stroke on your machine and send them to another site ... WAKE UP.
I'm extremely pissed off and you should be too.
Open Safe Files is a feature that Apple should have never included, but any security flaw in it means nothing as long as no one successfully exploits it.
At least Tiger users can easily fix it, and it'll also be easy for Apple to patch, which they'll probably want to do rather quickly.
a week ago all the mac people on these forums were praising Tiger and how badass it is. All I can do now it laugh laugh laugh laugh laugh.
"Sorry, but life just got a little bit harder for Mac users."
Just think, it's only been a week. A week. Just wait a month, six months, a year. Bahahahaha. I love it.
I totally agree! I have been banned from apples discussion boards and all of my posts have been deleted. Furthermore, at least 6 other threads have been deleted. This is truly a sad day for us mac users...
QuoteMikuro wrote:
The possibilities of this extend far beyond "opening unwanted web sites". A widget can execute shell scripts. That means it can, quite trivially, erase your entire hard drive, or do pretty much anything. (Source: http://www.macosx.com/forums/showthread.php?t=52482 )
And the whole point here is that it doesn't require you to download the Widget yourself. So the whole "only download from trusted sources" thing (which is not an acceptable solution anyway) is irrelevant.
This is truly a Microsoftian security hole, and it should NEVER have made it through the front gate. Safari's "Open 'safe' files after downloading" feature has always been ill-conceived and dangerous. Personally, I think it just needs to go outright. Or at the very least, make it a little smarter!
I'm really disgusted at Apple. I'm sorry, but we Mac users have just officially lost the right to talk about security.
Wed May 11, 2005 4:18 pm Subject: Re: Man, just
QuoteAnonymous wrote:
a week ago all the mac people on these forums were praising Tiger and how badass it is. All I can do now it laugh laugh laugh laugh laugh.
Wow, just think how hard you'll laugh when someone actually makes a widget that does all the stuff people are talking about here.
Be sure to tell us when you find one! I'm sure that will make you really happy.
Wasn't it less than a week ago all sorts of posters to this site were going on about how awesome widgets and the dashboard are?
"Wow, just think how hard you'll laugh when someone actually makes a widget that does all the stuff people are talking about here.
Be sure to tell us when you find one! I'm sure that will make you really happy."
Yes, because no one ever in their entire life will ever try to exploit a mac. It just won't happen. Wow what a computer loser. My mac is impenetrable, no one wants to do anything to it ever! It will make me happy when you go on thinking like you do and all of a sudden your computer is gone. Remember, Windows users were just like you mac users, unconcerned about security, thinking the OS was untouchable.
Less than a week is all it took and after mac users and Job's were ranting and raving about how secure the Tiger OS is. Less than a week.
Wed May 11, 2005 5:39 pm Subject: Re: Widgets last week.
QuoteAnonymous wrote:
It will make me happy when you go on thinking like you do and all of a sudden your computer is gone. Remember, Windows users were just like you mac users, unconcerned about security, thinking the OS was untouchable.
Right, but when a problem like this comes up Mac users talk about it to death, come up with temporary solutions, and Apple fixes them before they become actual problems.
You act like finding this problem is a bad thing. It's BECAUSE we find problems like these (and Apple fixes them swiftly) that we're safer. Compare that to MS which takes months to fix something, and even then it's usually not totally fixed. (See IE, for example.)
Why is it that Firefox was able to come in and make a much more secure browser than IE is? Maybe it's because MS users DON'T go onto message boards like these and talk about security problems. Instead, you come to Mac boards and tell us about our problems. Spend some time complaining to MS like we do to Apple and maybe your situation will get better.
Thu May 12, 2005 12:56 pm Subject: Re: And who said I use MS?
Comments are currently closed. Please email the author instead.
Recent Headlines - Updated November 8th
- Sat, 7:58 PM
- News - Apple TV 3.0.1 Update Fixes Missing Content Bug
- Fri, 7:45 PM
- Rumor - Taiwan Leak Shows Verizon UTMS/CDMA iPhone for Q3 2010
- 6:40 PM
- News - iPhone Moves Into RadioShack
- 6:30 PM
- News - Apple to Open Stunning Paris Apple Store in Le Louvre on Saturday
- 5:43 PM
- Free on iTunes - Dictionary, Dictionary, Dictionary, And More
- 4:09 PM
- John Martellaro's Blog - Particle Debris (week ending 11/6) Failure IS an Option
- 3:32 PM
- Games - The Latest App Store Games: Gravity Sling, RocketBird, Ground Effect, Checkers!
- 2:25 PM
- Games - Star Soccer 2010 for Mac Puts Gamers in Role of Up-and-Coming Player
- 2:15 PM
- How-To - The Mysteries of Rosetta Housekeeping
- 1:33 PM
- News - iPhone Game Developer Sued for Collecting User’s Cell Numbers
- 1:17 PM
- Games - Warhammer Online Expands Trial Play Option
- 11:19 AM
- Rumor - Apple May Be Bringing RFID to the iPhone
The Mac Observer Reader Specials
- TypeStyler For Mac OS X is Now Shipping! Download The Free Fully Functional 60 Day Tryout at www.typestyler.com
RamJet Memory: Mac Pro 8-core 8GB Kit $199.99, 4GB Kits $109.99! Sale on MacBook and MacBook Pro 8GB kits $549.99! New MacBook DDR3 2GB for $49.99. iMac and Mac mini 4GB Kits for $79.99! 1TB SATA Hard Drives for $109.99! Click here
OWC: Mercury On-The-Go FW800+USB2 up to 1.0TB. Bus Powered, no external power supply needed. Macworld Editors Choice, CNET Very Good Starting from $99.97, 500GB $159.99. Click here
If you're using a Mac, then you've gotta check out Full Tilt Poker for Mac. This Full Tilt Poker bonus code does the unthinkable, it actually rewards!For the latest Apple products use Ciao, a price comparison website, to find laptops like MacBook Air. Then find the best prices on MP3 players and use our comparison tool to evaluate mobile phones like the Apple iPhone.
Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.
