My Jesus has street cred (aka, Do not read this post in Safari. Again.)

I was really surprised to see the following bit of Javascript show up in the comments of a previous post, and waited awhile to see if it'd get picked up by anyone, but it didn't, so here we are. While I knew Apple knew about it internally for quite awhile, I hadn't yet seen it floating about in the wild -- and I wasn't at liberty to say anything as sometimes part of getting to know something is not being able to talk about it without making the life of the person who passed it on very difficult.

I'm also including it as a separate file for your perusal, as it nails Safari and other things allowing Javascript via WebCore and WebKit. Again, while I know Apple knows about this particular issue (I.E., it's in their system, and fixed in the nightly builds, which means this page won't crash in a forthcoming version of Safari) my knowledge of its existence just included sample code and that they were aware of it...

See no evil, hear no evil

I got curious as to how this person stumbled across it, and whether they were the original reporter of it to Apple as I didn't know the timeframe for how long Apple's known, so I gave Brent Traut a ping. Nice guy, was fine with my including his name and a link, and our conversation turned up:

  • Brent found the nastiness at torrent-finder.com, via these steps:
    1. Search anything
    2. Click on the "New Nova" link
    3. Boom go Safari

    He then whittled down the issue to that small bit of scripting, and submitted it to Apple.

  • He wasn't sure when he'd found it and reported it, and it turned out he'd sent it in via consumer channels under the common misconception a human would see it.

  • I asked for the creation date of the script on his server, which would at least give us a ballpark figure: His Killsaf.html was created on January 21, 2006.

While I know Apple is aware of it, without the radar number and date, there's only so much to infer. If he found it independently from what's in Apple's system, he went above and beyond what most users would do -- and it's another data point that those channels available are entirely ineffectual. Otherwise, a human did see his submission, and it's gone unfixed for months. Eww all around.

A few additional notes...

  • Just because you're unaware of this stuff doesn't mean it's not there, and be under no illusion that there's not more floating around. I care less about another thing that can take down Safari and more about what you're not aware of.

  • There's a lot you're not aware of, simply because Apple would prefer you're generally not aware of these things. I know I'm always amused by someone ranting about how APE or mach_star will bring about security Armageddon on a normal user's system as soon as a script kiddie finds them -- without realizing that more than those two projects are doing code injection in some form.

    There's a bunch of apps that have rolled some form of the functionality on their own, and even entirely separate code injection projects going on -- in some cases no one knows how they're being used or why the exist. I don't lose sleep over it, but knowledge that these types of things exist certainly changes how I view some things, although you shouldn't interpret this as more than a data point meant to illustrate a point.

  • Since the original Safari Image of Doom and Deja-Doom, around 10 image-related vulnerabilities cross in front of my eyes (Primarily because people bring them to my attention after seeing the posts). Apple is aware of them all, and some have been fixed, and they'll all (hopefully) get fixed eventually, but there's no real guarantee on the timetable. Most importantly, that it's going on to the degree it is should be serious cause for concern, whether it can be further exploited or acts as a DOS.

  • When your neighbor's house catches fire due to faulty wiring after someone plugs in a space heater, you don't break out the marshmallows -- you check your damned wiring in case someone plugs in a space heater. Similarly, when another platform gets smacked by an issue, the correct response is not "Haha," but rather "Could we get hit by something like this, and if not, why?"

    I.E.:

    1. Does the technology used to produce the code make us immune?

    2. Does the quality of the code we're using make us immune?

    3. Do the design decisions in the code we're using make us immune?

Not asking the questions because you don't want to hear the answers to them (or be forced to rethink what you've adopted from a pundit) doesn't make you any less vulnerable, it simply makes you less informed. To be fair, ignorance can often be more comforting in the short run. Hint: In the grand scheme of things, OS X and Windows are more alike than they are different now, because of the decisions they've made to accommodate the user.

"Unix Foundation!" is often pointed to as the panacea, however:

  • Most of the scary stuff that's come out has been introduced via code Apple's tacked on top of the hardcore unix underpinnings.

  • Unix and its systems of permissions plays a very small role when it is systematically dismantled in order to make things more convenient for a single user, especially when the whole system essentially spreads its legs wide for whatever is pushes its way over the network.

  • When what immune system that is there is compromised due to fragile code pushed out the door to make a ship date, your likelihood of getting sick is more and more of a numbers game, adding up to the same calculated risks Microsoft originally took (and was subsequently burned by, causing a massive pause in development and an entire reorientation on how their software is developed and tested).

Now it's entirely fair to say you do lower your probability of getting sick by using OS X right now compared to Windows, however that probability should be drastically lower than it currently is, and the situation is getting more and more dangerous. Deciding everything is A-OK because viruses aren't in the wild yet is akin to deciding you don't need to do backups because you've never had a hard drive die.

Stuff is shipping that just shouldn't be in its current form, providing plenty of ways for those with the will and just hoping to God those with the will aren't paying attention. As a user you may be unwilling to demand better, and even prefer not to even know that it could be, but you for damned sure shouldn't be throwing stones.

yummy alcohol posted button Posted by drunkenbatman
    April 12, 2006, at 12:25 PM


Comments (61)




Post a comment



Anonymous comments are allowed, but please enter something for a name.

And do endeavor to appear sane.









Remember personal info?