Shocked? Horrified? Bemused?
You must be logged in to the O'Reilly Network to post a comment.

Showing messages 1 through 12 of 12.

• For the sake of clarity...
  2005-05-11 05:13:22  Giles Turnbull | [Reply | View]
  
  
  Some people have suggested that the threat is lessened because there are warnings about running newly-installed widgets, or that the user is responsible for 'running' the widget by dragging it out of the widgets bar. I wanted to clarify *exactly* what happened when I tried out this exploit on my machine.
  
  Here's what happened, step-by-step.
  
  1. In Safari, I opened http://stephan.com/widgets/zaptastic/
  
  2. The page loaded, and the Downloads window opened, showing that a file had been downloaded.
  
  3. I invoked Dashboard, and found a new widget listed called 'Zaptastic'. I dragged it out of the widgets bar, and it ran immediately - there was no warning of any kind, nothing asked me if I intended this to happen - and caused my default browser (Firefox, in this instance) to open a new tab at the GreenZap web site.
  
  4. Further investigation showed that the file 'zaptastic.wdgt' had been installed in ~/Library/Widgets. The widgets that come with Tiger are in the /Library/Widgets directory (ie, not within my User space).
  
  The *install* was automatic. User intervention was required to run the widget, but if the user has been informed that the widget does something cool or useful, that isn't hard to bring about.
  
  What's more, if I were a newbie, someone who had only recently switched to OS X, I would *not* have known where to look for the offending widget. I would not know how to remove it from the system.
  
  It seems clear to me that the opportunity exists for so-inclined people to release malicious .wdgt files that auto-install, fool the user into activation, and are, at the very least, intrusive and annoying.

• Some lessons must be learned the hard way
  2005-05-10 21:37:18  eberharda [Reply | View]
  
  
  When windows hackers on their $300 Mac Mini's get wind of this, they're going to have a field day creating the PERCEPTION that the Mac isn't as secure as it's been cracked up to be. Apparently Apple learned nothing from Microsoft's sorry trip down ActiveX lane. I completely agree with the author: incredibly simplified dialog boxes are no solution. In fact, in my opinion, the very existence of such a dialog tells me the widget shouldn't have been installed automatically. Couldn’t Apple have said only “safe” widgets get auto installed? More complexity, oh good. Finally, I agree that on a platform which professes to be “the computer for the rest of us,” expecting users to do literally anything more than use the software EXACTLY as it was shipped in order to maintain the PERCEPTION that their computer is safe is pure folly.

• Widget Manager
  2005-05-10 15:56:06  Giles Turnbull | [Reply | View]
  
  
  Just found this: Widget Manager is
• Widget Manager
  2005-05-10 15:57:40  Giles Turnbull | [Reply | View]
  
  
  (gah! hit wrong key there!)
  
  As I was saying; Widget Manager is a prefpane for, um, managing widgets. It makes removal or disabling individual widgets very easy.

• Simple fix for now, use Folder Actions
  2005-05-10 13:46:55  jdb8167 [Reply | View]
  
  
  OS X has a feature called Folder Actions. It allows you to run Applescripts when a folder changes. You can enable it from
  '/Applications/AppleScript/Folder Actions Setup'
  
  In addition there is a script called 'add - new iitem alert.scpt' that you can attach to the ~/Library/Widgets folder. This will alert you when anyone or anything tries to alter your Widgets folder.
  
  Problem solved. The potential issue here is being overly exaggerated as far as I can tell. This is one lame avenue for spyware and the like if it is this trivial to overcome.
• Simple fix for now, use Folder Actions
  2005-05-10 15:16:16  Giles Turnbull | [Reply | View]
  
  
  Yes, it is a fairly simple fix for anyone with some experience of using Mac OS X, but my point was that for newbies, for the kind of people Apple wants to attract, even this solution would be far from straightforward.
  
  These people might well be switching to Apple products because they've heard that they're more secure, and more stable. If we start blinding them with stuff about Folder Actions and Scripts, Mac OS X won't seem nearly as user-friendly as they might have been lead to believe.
  
  I'm talking about perception of difficulty, rather than the level of difficulty itself.
• What's the diff between this and any other trojan ?
  2005-05-10 18:52:39  nst [Reply | View]
  
  
  Not having experienced Tiger yet myself, I have to rely on other people's reports of Tiger's behaviour.
  
  From what has been reported, the user still has to manually install downloaded widgets. What's the difference between this and any other Trojan Horse ?
  
  If this exploit had the potential to be self-replicating without user intervention it would be a concern. Otherwise, the golden rule of "Know what a program does before you run it" still applies.
  
  No matter what an OS publisher does, there are still going to be people who click on programs that purport to be screensavers of Paris Hilton or promise to make them rich. That's how it goes.
  
  

• Meh
  2005-05-10 09:50:21  MickeyKnox [Reply | View]
  
  
  Knee-jerk reaction to a very small problem. I know people who would LOVE to be able to use their PCs for more than a week without it slowing down to a crawl. I've set up numerous Windows machines, emphasizing to the owner to run Ad-Aware or other similar program EVERY TIME they get off of the internet. Do you think they remember? Until 2 weeks later, when they call me and say, "I can't get online!" or "My PC is sooo slow!"
  
  "Have you been running that software I told you to?"
  
  "Uh, I forgot..."

• The first-time-run warning doesn't always appear
  2005-05-09 09:20:26  jason. [Reply | View]
  
  
  While I haven't been able to determine when and why, that first-time-run warning doesn't always appear. I know that, according to Apple's own page [1], the warning is supposed to appear if you use certain resources (like running a command-line utility), but even then I haven't seen it always.
  
  [1] http://developer.apple.com/documentation/AppleApplications/Conceptual/Dashboard_Tutorial/Security/chapter_10_section_1.html
  
  

• An Excellent Point
  2005-05-09 09:00:08  joshuawait [Reply | View]
  
  
  I thought about writing a short article called "Is Dashboard a security threat?", but I never got a around to developing a proof of concept.
  
  You make an excellent point when you talk about the average user. The average user lacks an understanding of how applications and the operating system work.
  
  Such a person trusts the software developers to know what they are doing. Spyware and other malicious applications prey upon this trust.
  
  Dialog boxes may help some, but often times people are so bombarded with meaningless but seemingly important dialog boxes "Do you, 70 year old person who was a lifelong homemaker wanting see photos of your grandchildren, promise never to reverse engineer our software?" that they have become habituated clicking the default answer without even reading it. I know I have. And I should know better.
  

• it's not that bad...
  2005-05-09 04:52:37  bluesthemoose [Reply | View]
  
  
  Well, when you launch a newly installed a widget for the first time, you are asked if you really want to run said widget.
  So I don't think there is a way to have a widget that would install and run silently on your machine.
• it's not that bad...
  2005-05-09 05:21:02  rmeister0 [Reply | View]
  
  
  Windows does that now too when you download an executable. That doesn't stop people from simply clicking through that dialog box without readng it; all you have to do is give the widget some innocuous sounding name and most people won't think once about it.