 |
Safari Autofill exploit |
Safari users are warned to avoid saving sensitive data to the autofill option, with recent discoveries pointing towards the browser exposing personal data without the user’s consent. The problem is yet to be identified as purely a Safari issue, or whether it poses a potential threat to all WebKit-based browsers, including Google Chrome. Chrome and Safari Users are advised as a result to disable the autofill feature immediately, until further notice.
Jeremiah Grossman, the chief technical officer of WhiteHat Security, noted on Wednesday that both Safari version 5 and legacy version Safari 4 users are at risk of personal info being exposed. The threat level is high, with malicious Web sites being able to access autofill information from Safari without the user entering in any personal information on the site, or even if without the user needing to have ever visited the site previously. Malicious websites would be able via Javascript to simulate A-Z keystrokes, which in combination with dynamic text fields (which could even be hidden from the viewers sight, working in the background) such as “credit card” or “address” could lift enough information to be able to do some serious damage to the unsuspecting browser user.Apple reassures Safari users that “We (Apple) take security and privacy very seriously. We’re aware of the issue and working on a fix”. until such time, switch off autofill, grab a pen and paper and keep it somewhere safe!
Safari browser can expose
personal data without the user’s
consent, a security researcher
reported on Wednesday. It
remains unclear as to whether
the problem affects Safari
specifically or all WebKit-based
browsers, which include Google
Chrome. It’s recommended that
Safari and Chrome users disable
the autofill feature
immediately, until further
notice.
Jeremiah Grossman, the chief
technical officer of WhiteHat
Security, documented the exploit
in a blog post on Wednesday,
saying that it affects both the
current version of Safari,
version 5, and the legacy
version, Safari 4. He said that
the exploit is severe enough
that a malicious Web site can
access autofill information from
Safari without the user entering
in any personal information on
the site, or even if the user
had never visited the site
previously.
A malicious Web site would only
have to create dynamic form text
fields with appropriate names,
such as “address” or “credit
card,” and simulate A-Z
keystrokes using JavaScript, and
then the data would be filled in
automatically, Grossman said in
the blog post. This would work,
he said, even if the text fields
were hidden from the visitor’s
view. He also added that he
notified Apple of the security
breach on June 17 in accordance
with accepted “best behavior”
practices for security
researchers, but received only
an automatic response.
But it looks like the exploit
may not be new. In a blog post
from April 2009, Swiss security
researcher Patrice Neff
uncovered a strikingly similar
exploit, which went unnoticed by
many people, where Safari would
submit a birthday without the
user’s consent. Neff was able to
write a script that could
harvest that information from
Safari browsers. It’s not clear
at this point whether the
exploits are identical, or just
have similar-looking outcomes.
Regardless, the exploit
highlights the risk in using
automatic data-filling
technology without stronger
security controls. Users can
disable autofill in Safari by
going to Preferences, AutoFill,
and AutoFill Web forms. In
Chrome, go to the “wrench” menu,
choose Options, Personal Stuff,
and click the AutoFill button.
The exploit does not appear at
this time to affect the mobile
Safari on iOS, or the WebKit-
based browser on Android.
Apple’s official statement on
the autofill vulnerability did
not address specifics. “We take
security and privacy very
seriously. We’re aware of the
issue and working on a fix,”
said an Apple representative.
Google did not comment but did
confirm that this autofill
exploit is not a vulnerability
in Chrome because the browser
requires a user confirmation to
populate text fields that can’t
be mimicked by JavaScript.
Related posts:
