Apple

News broke across the ‘net over the past day or so that there is a verifiable, serious security threat under Mac OS X 10.3 (Panther) involving Safari (or any other web browser) and the Help viewer application.

What’s going on is that Mac OS X maps different “helper applications” to handle different protocols as you surf around the internet. A ‘net address that begins with http:// is handled by Safari (or your default web browser), an address that begins with ftp:// is handled by the Finder’s built-in FTP, and so on.

By default, the help:// protocol is handed off to Apple’s Help application, which (no big surprise here) is a viewer for documentation for OS X applications. Some documentation is stored locally on your hard drive, but Apple wanted to make it easy for updates to the documentation to be added, so Help also has the ability to fetch documents over the ‘net — essentially, it’s a stripped-down web browser. And that’s where the vulnerability kicks in.

While Safari has built-in controls to prevent malicious attacks, the Help viewer does not. It is able to run scripts that are fed to it, and can do so with the full user permissions of whichever user is logged in to the machine at the moment.

In this rather disturbing example of the exploit, the web page makes a help:// call, which launches the Help application. Help is then directed to an Applescript which is fed the terminal command ‘du‘ (disk usage, I believe), which presents a scrolling list of all the files on your hard drive inside a terminal window. Now, this is just an example, so it’s harmless — but if the Applescript or the terminal command had been more malicious in nature, some serious damage could have been done.

Luckily, the fix for this is quite simple:

1. In Safari, go to Safari > Preferences…. In the “General” settings pane, uncheck “Open ‘safe’ files after downloading.”
2. Download and install the ~~More Internet Preference Pane~~ [RCDefaultApp preference pane]{.underline}.
3. Open your System Preferences (Apple Menu > System Preferences…) and go to the ~~More Internet~~ RCDefaultApp{.underline} preference pane (it should be at the very bottom of the System Preferences window).
4. Scroll down the protocol list and click on the ‘help’ protocol, then ~~change that to an application other than Safari or Help — many people are recommending changing it to the Chess game application, as it’s harmless and will provide a distinct visual clue that something has happened~~ [set it to ‘\<disabled>’. Do the same for the ‘disk’ and ‘disks’ protcols]{.underline}.
5. There is no step 5. You’re done!

(via lots and lots of people)

Update: John Gruber recommends another application for the same approach, as MoreInternet doesn’t show the disk:// and disks:// protocols that can also be used for this attack.

iTunes: “Coda” by Webley, Jason from the album Only Just Beginning (2004, 10:10).

For the second time in just over a month, panicky news stories are alerting us about a trojan horse attack against Mac OS X. Last time the exploit was disguised as an .mp3 file, this month it’s disguised as a Microsoft Word beta installer.

And for the second time in just over a month, it’s a lot of panic over very little.

The details are simply this: one person downloaded what purported to be an installer for a public beta of Microsoft Word from the Gnutella peer-to-peer filesharing service. This “installer” — actually an AppleScript application weighing in at a hefty 108k — actually deleted the contents of their home directory when ran.

In other words, someone got stupid, got bit by a stupid (and extremely simple), if nasty, practical-joke style hack.

They then ran to MacWorld UK, who contacted Intego (the anti-virus company whose press release fanned the flames of the previous trojan scare) and Microsoft, and MacWorld UK proceeded to write two shining examples of FUD that have since started to run rampant over the ‘net.

It’s very simple, people. Don’t blindly trust every little file you run across on the ‘net, and use a little common sense.

The two best comments I’ve seen on this so far —

From Codepoet:

See, for there to be real security on a computer, a use cannot be stupid. The computer can only do half the work needed t make itself secure; the user must do the other half. The reason fo this is that a computer exists to do things we tell it to do, and if w tell it to, oh, I don’t know, run a Trojan Horse then it will run the Trojan horse. There’s nothing in the system that will say “Hey! This is a Trojan horse!” nor can there be. It’s a program, you told it to run it, and that’s that.

And from Will Parker:

I just don’t know too many people who, when they find an open soft drink bottle full of foamy yellow liquid at a bus stop, drink it to find out if there’s a new Sprite Remix flavor.

iTunes: “I Don’t Want Nobody to Give Me Nothing (Open Up the Door, I’ll Get It Myself)” by Brown, James from the album 40th Anniversary Collection (1969, 3:06).