Safari for Windows Not So Secure

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
If you were thinking about using Safari for Windows, you might want to hold off a bit until Apple fixes all the security holes found within the first few hours of its release yesterday. So much for “Apple engineers designed Safari to be secure from day one.” Ouch.

Security researcher David Maynor, posting on his Errata security blog, said he was also able to generate a memory corruption error "in no time." By the end of the day, he was able to generate a total of six bugs--four producing a denial of service (crash), and two capable of executing remote code.
Click to expand...
 
Just wait, Apple will come back saying how this is all Microsoft's fault for making an OS that can be attacked through a browser or something like that. Anything to push the blame to Microsoft like they always do.
 
Well according to the latest update in Maynor's blog, the bugs are also present in OSX's Safari. Whether it can be exploited, it's another issue I guess. Win Xp users would probably the most vulnerable seeing as to how most of them run in admin mode.
 
kheldorin said:
Well according to the latest update in Maynor's blog, the bugs are also present in OSX's Safari. Whether it can be exploited, it's another issue I guess. Win Xp users would probably the most vulnerable seeing as to how most of them run in admin mode.
Click to expand...

That to me is the key, can this be exploited on OSX. For that matter, how easy is it to attack a Vista machine. If a typical OSX install isn't vulnerable to code execution and Vista is, then score one for OSX.

I still haven't installed Vista, but I do know if any protection from this bug required UAC, i probably would get nailed. I'm 99.99999999% sure I'd disable UAC quickly. I found it excessively annoying in RC2.
 
I grabbed safari for my windows laptop yesterday... and have to say I was pretty impressed. Pages really do load quickly, and the RSS views are really nice.

But ultimately... I won't ever switch away from Firefox... I've just grown too used to the plugins... there are way too many that I rely on every day that will keep me from switching browsers.

It is nice to have choice though... and I could definitely see Safari on windows being big useful for a lot of people.

Friedmud
 
friedmud said:
I grabbed safari for my windows laptop yesterday... and have to say I was pretty impressed. Pages really do load quickly, and the RSS views are really nice.

But ultimately... I won't ever switch away from Firefox... I've just grown too used to the plugins... there are way too many that I rely on every day that will keep me from switching browsers.

It is nice to have choice though... and I could definitely see Safari on windows being big useful for a lot of people.

Friedmud
Click to expand...

You're kidding right? Pages load quickly? It's slow.
 
nilepez said:
That to me is the key, can this be exploited on OSX. For that matter, how easy is it to attack a Vista machine. If a typical OSX install isn't vulnerable to code execution and Vista is, then score one for OSX.
Click to expand...

It really wouldn't mean anything at all. Writing programs that look the same doesn't mean they behave the same.
 
Let me get this right, you can't have IE on Mac but we can get Safari on Windows? And who would want to use it anyways? Safari on a Mac is the worse, you pretty much have to use Firefox to get pages to load in less than 5 minutes on a 7Mb connection.
 
It's up to 18 flaws discovered in just 1 day: http://www.pcworld.com/article/id,132845-c,browserbugs/article.html

Choice quote:
Another researcher, Tom Ferris said his vulnerability testing "fuzzer" software turned up 10 flaws in the browser in just five minutes.

He had harsh words for Apple's security team. "That's horrible, and just goes to show that they took no initiative to fuzz their own software," he said Tuesday in an e-mail interview.
Click to expand...
 
Okay, so maybe they didn't do an entirely thorough job of tweaking code prior to release. So what? It's a BETA. They're prolly just looking to save money and effort by letting all the security professionals find the bugs for them.

And as for the speed debate, it's pretty pointless to try to say which is faster/slower without running them on the same computer/connection/pages/etc.
 
LeTUOtter said:
Okay, so maybe they didn't do an entirely thorough job of tweaking code prior to release. So what? It's a BETA. They're prolly just looking to save money and effort by letting all the security professionals find the bugs for them.

And as for the speed debate, it's pretty pointless to try to say which is faster/slower without running them on the same computer/connection/pages/etc.
Click to expand...

everything is in beta nowadays to excuse their bugs.
 
Nemesis999 said:
It really wouldn't mean anything at all. Writing programs that look the same doesn't mean they behave the same.
Click to expand...

Huh? The bug is on OSX. It has nothing to do with what the program looks like. What's unknown, AFAIK, is if OSX's prevents an attacker from causing damage that could apparently happen when running Safari on windows.
 
LeTUOtter said:
Okay, so maybe they didn't do an entirely thorough job of tweaking code prior to release. So what? It's a BETA. They're prolly just looking to save money and effort by letting all the security professionals find the bugs for them.

And as for the speed debate, it's pretty pointless to try to say which is faster/slower without running them on the same computer/connection/pages/etc.
Click to expand...

Sounds like there's software that can pretty much test this for them, so to have bugs that both hackers and security specialists can turn up with no effort is not good.

It's also why so many say that one of Apple's strongest security feature is it's low market share.

That said, I think it'll be interesting to see how Apple does head to head with IE. I'll probably stick with Firefox myself.
 
If it actually presents the speed boost they claim, I just might jump ship, but I agree with a previous poster that I love my firefox add-ons a little too much. I like my mouse gestures, dangit! ;)
 
A Safari 3.0.1 update is available today that fixes 8 of the security problems.
 
You must log in or register to reply here.
Back
Top