{"id":41629,"date":"2015-05-20T12:39:34","date_gmt":"2015-05-20T19:39:34","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=41629"},"modified":"2015-05-20T12:43:18","modified_gmt":"2015-05-20T19:43:18","slug":"security-bug-safari-browsers-osx-ios-users-at-risk","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/security-bug-safari-browsers-osx-ios-users-at-risk\/","title":{"rendered":"Security Bug in Safari Browsers Puts OS X and iOS Users at Risk"},"content":{"rendered":"

\"Image<\/p>\n

Security researchers have discovered a\u00a0serious Safari address-spoofing bug that can deceive\u00a0users about the sites they’re visiting. The exploit works on fully patched versions of OS X and iOS, and\u00a0could be used by\u00a0cyber-criminals in phishing or malware attacks.<\/p>\n

Deusen researchers have demonstrated a proof-of-concept\u00a0exploit that tricks Safari users on iPhone, iPad and Mac into thinking they are visiting a known or trusted site, when in fact, Apple’s web browser is connected to an entirely different address, which could be used in phishing\u00a0attacks to get login credentials or attempt to install malware.<\/p>\n

The recently discovered bug can be seen in action on this site<\/a>, where you will see your Safari address bar\u00a0display “dailymail.co.uk,” even though the browser is displaying content from deusen.co.uk.<\/p>\n

\"ScreenshotAs you can see in the demo, attackers can set up a phishing page and then make the URL appear legitimate, but the address-spoof is not foolproof.<\/p>\n

A quick test\u00a0using Safari on the iPhone 6 Plus\u00a0showed\u00a0the page’s address bar repeatedly refreshed, which is unusual behavior for the web browser. Similar tests by\u00a0Ars Technica, as reported by Dan Goodin<\/a>,\u00a0also showed\u00a0the demo code is far from\u00a0perfect: “On the iPad Mini Ars tested, the address bar periodically refreshed the address as the page appeared to reload. The behavior\u00a0might tip off more savvy users that something is amiss.”<\/p>\n

Most keen OS X and iOS users would likely notice something is off, however, as always the case, the oddity may go unnoticed by some users.<\/p>\n

Furthermore, as referenced by Eduard Kovacs at Security Week<\/a>, the JavaScript that the demo relies on shows that the PoC code is not very complex.<\/p>\n

“The [PoC] code is very simple: webpage reloads every 10 milliseconds using the setInterval() function, just before the browser can get the real page and so the user sees the ‘real’ web address instead of the fake one,”\u00a0explained Manuel Humberto Santander Pel\u00e1ez, handler at the SANS Internet Storm Center.<\/p><\/blockquote>\n

The script looks like this:<\/p>\n

<script>\r\nfunction f()\r\n{\r\nlocation=\"dailymail.co.uk\/home\/index.htm...\"+Math.random();\r\n}\r\nsetInterval(\"f()\",10);\r\n<\/script><\/pre>\n
When you load a web page, it should load and stay as-is\u00a0\u2014\u00a0easily verified by checking the URL and other details about the address by\u00a0clicking on the address bar. If any web page causes your browser to crash or hang in spite of attempts to correct the issue, it’s best to not trust the page you are on and simply exit the tab or force-quit your browser.<\/p>\n","protected":false},"excerpt":{"rendered":"
Security researchers have discovered a\u00a0serious Safari address-spoofing bug that can deceive\u00a0users about the sites they’re visiting. The exploit works on fully patched versions of OS X and iOS, and\u00a0could be used by\u00a0cyber-criminals in phishing or malware attacks. Deusen researchers have demonstrated a proof-of-concept\u00a0exploit that tricks Safari users on iPhone, iPad and Mac into thinking they […]<\/p>\n","protected":false},"author":4,"featured_media":41692,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[5],"tags":[52,69,168,589,115],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n