12-05-2005 09:34									#1
	Mac OS X Tiger's Dashboard May Leave Mac's Vulnerable! Browse Apolyton AD-FREE

Warning for those who have OS X Tiger!!

http://www.wired.com/news/mac/0,212...tw=wn_tophead_2

quote: A security hole in Dashboard could expose users of Apple Computer's new Tiger operating system to attack, and may put personal information like passwords and credit card data at risk. A new feature of Mac OS X Tiger, Dashboard is a suite of simple programs called widgets that often access information on the internet. Tiger comes preloaded with 14 widgets, including a world clock, a dictionary and a weather station. For the convenience of users, most widgets automatically install themselves. But experts fear any program that auto-installs is ripe for exploitation. Dashboard allows any user with basic skills in HTML or JavaScript to build their own widgets. Apple's Dashboard widgets page, as well as third-party sites like Dashboard Widgets, maintain constantly updated databases, but it's not clear if the sites vet their offerings. Further, there is no immediate way to delete a widget that has been installed. According to Tiger's own Help file, "You cannot remove widgets from the Widget Bar or change their order." A growing number of Mac experts are sounding the alarm over the dangers of widgets -- which can carry Unix commands that could be run invisibly from within a widget. "It's really just wrong and stupid of (Apple) to not give a regular user a way to take widgets out of Dashboard," said Stephan Meyers, an unemployed artist and developer who was one of the first to publicize the hole. "It just flat-out says you cannot remove a widget from Dashboard. That's just dumb." Meyers felt so strongly that Apple erred by not giving Tiger users a way to delete widgets directly from Dashboard that he created two of the downloadable tools designed to demonstrate the vulnerability. His Zaptastic widget (warning: following the link in Safari automatically downloads Zaptastic.wdgt) is benign, but when run, it loads a Safari browser and takes the user to a web page promoting the forthcoming launch of a new online payment system. But on his website, Meyers argues that widgets can carry a dangerous payload. His Zaptastic Evil is a widget that, when run, forces a user's computer to open a Safari browser pointing at the online payment site every time Dashboard is booted. Still, Meyers said he's not too concerned about what havoc widgets could wreak, and he said the problem is nothing new for downloadable software. "You can't ... prevent bad programs from running on a computer," Meyers said. "You have to strike this balance between usability and security, and that's always the case. It's like human immune systems: You'd never get sick if you didn't take in air and food." Widgets can be removed manually by deleting them from a user's /Library/Widgets/ folder. But that's something many novice Tiger owners may not know how to do. "It does pose a certain security risk, because (widgets) can do all sorts of things web pages can't because they're loaded into the system all the time," said Dan Pourhadi, an administrator at Dashboard Widgets. "It's possible, if the developer knows what they're doing, and a user downloads widgets from places that don't check them." J. Nicholas Tolson, a Mac fan who is building his own widgets, said auto-installation is the most dangerous feature of the simple programs. "(Apple needs) to disable the auto-install feature of widgets," he said. "There should be some user interaction when installing things, either via an actual installer or via drag-and-drop installers that are popular on Macs." Mark Charbonneau, who runs Downtown Software House, which developed a free application called Widget Manager that automates the process of manipulating widgets, agreed. "I ... think that's something that may not have been the best move on their part," said Charbonneau. "I wouldn't be surprised if that's something that (Apple changes) in the future." Apple did not return several requests for comment. "Even though widgets can't access system files," said Charbonneau, "they can access personal files and things like that.... It can access basically anything in the Documents folder or the user's home folder." And some say that includes personal passwords or even credit card numbers, all of which could be affected without a user even knowing it. Of course, some feel the situation is a strong case of buyer beware and that Apple shouldn't necessarily be taken to task for inattentive users. "If the user doesn't take a stand to protect themselves," said Dashboard Widgets' Pourhadi, "he is vulnerable to this kind of stuff." Still, Mac fans want Apple to recognize that widgets pose potential problems, and for more than just users' safety. "I hope they see the danger, if only for their marketing," said Tolson. "All it will take is one seriously nasty widget to completely wreck (Apple's) image of 'no viruses' or 'Macs are inherently more secure' message. And you better believe that would become news."

Just a warning to you who have gotten the new Mac OS!

	12-05-2005 09:36									#2
	Tired of ads?

It is a remarkably stupid design.

	12-05-2005 10:10									#3
	Support Apolyton, buy Civilization III: Complete

I read somewhere that most widgets are huge, the average being 20 MB.

	12-05-2005 10:25									#4
	Support Apolyton, buy Galactic Civilizations

It is a remarkably stupid design.

You wanna know what the real kicker is?

It's ActiveDesktop. Identical, in fact. It essentially makes the desktop use an embedded internet browser to display dynamic data.

Dashboard uses Safari's engine, ActiveDesktop used IE's engine...

ActiveDesktop is no longer supported on new versions of Windows, by the way.

	12-05-2005 10:41									#5
	Remove this text

Hmm. I'm no fan of automatic downloads/launches (especially from the Internet). I like being to to tell the 'puter just where I want the damn thing to go and, gosh, if it means having to click through a few prompts, then so be it.

That said, it sounds like if a problem is to arise, it would require user complicity (i.e., downloading crap without double-checking its source). That's such a human fallibility, regardless of the OS they use.

Gatekeeper

	12-05-2005 10:45									#6
	Support Apolyton, buy Call to Power 2

quote: That said, it sounds like if a problem is to arise, it would require user complicity (i.e., downloading crap without double-checking its source). That's such a human fallibility, regardless of the OS they use.

It is also, by FAR, the #1 way spyware and viruses get on PCs.

	12-05-2005 10:57									#7
	Avatar Enlargement: We've got the solution

I think that is what Gatekeeper was alluding to -- the complacency that he was talking about -- by mentioning htat, he was probably implying the danger of increased viruses and/or spyware.

	13-05-2005 00:09									#8
	Lose 30 kilos (of popups)

That's basically it.

Last time I checked, most malware needs human interaction at some step for it to get on one's hard drive. That can range from users not changing "automatic download" options to users deliberately clicking on unknown attachments and/or downloading Web content of "curious" origin.

So, regardless of OS, the one thing that's common to computer woes across all platforms is, well, the user.

Gatekeeper

	13-05-2005 00:26									#9
	Support Apolyton, buy GURPS/ Alpha Centauri

I completely agree, Gatekeeper. That's why I've argued against the opinion of certain people on this site that the "design" of OS X makes it effectively immune to viruses.

Most viruses don't exploit design flaws, but user ignorance.

Users of all platforms ought to have anti-virus software, not just Windows. A user of Windows with a firewall and anti-virus software is more secure than a user of MacOS without.

	13-05-2005 00:27									#10
	Support Apolyton, pre-order Civilization IV

quote: Originally posted by Gatekeeper That's basically it. Last time I checked, most malware needs human interaction at some step for it to get on one's hard drive. That can range from users not changing "automatic download" options to users deliberately clicking on unknown attachments and/or downloading Web content of "curious" origin. So, regardless of OS, the one thing that's common to computer woes across all platforms is, well, the user. Gatekeeper

Are you making the outrageous claim that humans are flawed?

	13-05-2005 11:58									#11
	Suffering from ads?

Asher:

I'm not a "nuts and bolts" kind of guy when it comes to arguing the ins and outs of computer guts, but I do put some stock in the belief that, yes, the MacOS is a *bit* harder to crack than Windows — but that's basically because of its Unix core, not anything super special like Steve Job's Secret Gravy Recipe. The vast majority of the reason why MacOS isn't targeted is because, well, it *doesn't* have this huge, honking target on its back that screams "I dominate 90 percent (or so) of the marketplace! Kick me!"

In the end, what it comes down to (for me) is this: MacOS works for me, and that's all I care about. Everyone else can have fun arguing back and forth about the "nuts and bolts" of things. We all have our passions, after all!

Gatekeeper

***

MrFun:

I've got roughly 7,000 years of modern human history (using conventional archaeology, rather than the more far-out, but funner, stuff) to back me up on that one!

Gatekeeper

	13-05-2005 16:05									#12
	Support Apolyton or Terrorists Win

quote: Further, there is no immediate way to delete a widget that has been installed. According to Tiger's own Help file, "You cannot remove widgets from the Widget Bar or change their order."

What kind of ****ing stupid design is that?

	13-05-2005 20:51									#13
	Got spare money?

quote: Originally posted by Gatekeeper MrFun: I've got roughly 7,000 years of modern human history (using conventional archaeology, rather than the more far-out, but funner, stuff) to back me up on that one! Gatekeeper

yeah, that's true

	13-05-2005 20:57									#14
	Inflate your Upload Space

quote: Originally posted by Kuciwalker quote: Further, there is no immediate way to delete a widget that has been installed. According to Tiger's own Help file, "You cannot remove widgets from the Widget Bar or change their order." What kind of ****ing stupid design is that?

That's what strikes me as worst. Even the smartest person can accidentally download something they shouldn't. But you should damn well be able to get rid of it.