Security researcher demos autofill exploit in Apple Safari

Posted:
in Mac Software edited January 2014
The autofill feature found in Apple's Safari Web browser could be used by a hacker to illegally obtain a user's personal information, including their name and e-mail address, a security researcher has discovered.



Jeremiah Grossman revealed on his blog this week that users who have the "AutoFill web forms" feature enabled on Safari versions 4 and 5 is vulnerable to malicious code. The AutoFill feature is enabled by default in Apple's Web browser.



The feature automatically fills online text forms that have specific, common names, such as "name," "company," "city," "state," "e-mail," and more. The information is automatically grabbed from the user's personal record included in the operating systems' address book. That means the information could be obtained without the user even entering it into the Safari browser.



"All a malicious website would have to do to surreptitiously extract Address Book card data from Safari is dynamically create form text fields with the aforementioned names, probably invisibly, and then simulate A-Z keystroke events using JavaScript," Grossman wrote. "When data is populated, that is AutoFill'ed, it can be accessed and sent to the attacker."



He also created a proof-of-concept to show how it takes "mere seconds" to obtain the personal information. Grossman said the data could be used to send e-mail spam or conduct a phishing attack.







"Fortunately any AutoFill data starting with a number, such as phone numbers or street addresses, could not be obtained because for some reason the data would not populate in the text field," he said. "Still, such attacks could be easily and cheaply distributed on a mass scale using an advertising network where likely no one would ever notice because it's not exploit code designed to deliver rootkit payload."



Safari 5, the latest version of Apple's Web browser, was released in June. It added extensions and expanded HTML5 support for the desktop software.
«1

Comments

  • Reply 1 of 27
    mstonemstone Posts: 11,510member
    Quote:
    Originally Posted by AppleInsider View Post


    The autofill feature found in Apple's Safari Web browser could be used by a hacker to illegally obtain a user's personal information, including their name and e-mail address, a security researcher has discovered.



    Yikes that is a bad one. I unchecked it right now.
  • Reply 2 of 27
    nasseraenasserae Posts: 3,158member
    I've always made sure that these two are unchecked.
  • Reply 3 of 27
    MacProMacPro Posts: 18,443member
    I will be interested to hear the Apple response to this. I find it almost too obvious to be plausible. What malicious code has been proven to access this so far? I did disable it though
  • Reply 4 of 27
    sheffsheff Posts: 1,407member
    Tested this, is confirmed (and scary). Luckily I switched over from Firefox+Safari to Chrome+Firefox a while ago. It does not seem to work on either of those 2 (I have autofill off on both though).



    It would take about 30 seconds of so to find out your name, email, address, which means a video site or a long article site would be the best place for this to wok.
  • Reply 5 of 27
    mstonemstone Posts: 11,510member
    Quote:
    Originally Posted by digitalclips View Post


    I will be interested to hear the Apple response to this. I find it almost too obvious to be plausible. What malicious code has been proven to access this so far? I did disable it though





    Yep. Javascript and Ajax, the savior of the of the web.



    I just tested the fields that have numbers. When you start the phone with a "(" it does give you a drop down list presumably using Javascript. So if you could figure out the innerHTML being used, one might be able to get that info as well. Same thing with the address field. You get a drop down select list.



    I have to do some more testing. I'm curious whether SSL prevents it, but signed certificates would at least be more trustworthy.
  • Reply 6 of 27
    ihxoihxo Posts: 562member
    That's not good, but I use 1password.
  • Reply 7 of 27
    asciiascii Posts: 5,941member
    I also uncheck that every time I install Safari. Human beings can't make perfectly secure software, that's the evidence anyway.
  • Reply 8 of 27
    postulantpostulant Posts: 1,270member
    Could? I could break my ankle while walking.
  • Reply 9 of 27
    dunksdunks Posts: 1,248member
    Thanks for the info. Autofill almost wrecked a holiday earlier this year because safari auto-populated my first name onto my partner's airline ticket without me noticing. Thankfully the lady at the check-in desk was moderately understanding.
  • Reply 10 of 27
    prof. peabodyprof. peabody Posts: 2,860member
    Quote:
    Originally Posted by AppleInsider View Post


    The autofill feature found in Apple's Safari Web browser could be used by a hacker to illegally obtain a user's personal information, including their name and e-mail address, a security researcher has discovered. ...



    I don't get why this is being viewed as any kind of real issue, or why some web sites are saying that this could potentially compromise passwords and credit card info as well. It seems quite obvious that it cannot.



    *IF* you have autofill turned on (and any security conscious person would not do so), and

    *IF* you go to a malicious web site,



    That web site can get your name and address. Wow.



    I'm shakin in my boots right now. My address? Freely available to complete strangers? This is almost as bad as ...



    ... the phone book in every public telephone in my home town.
  • Reply 11 of 27
    You can't get it to run faster than 30 seconds per field. every key event you can fake to produce the autofill effect takes 1/2 a second and if you interrupt that time you'll end up ruining the autocomplete hack.





    function start() {

    \tvar str = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";

    \tvar charset = str.split("");\t

    \tvar d = document.getElementById('data');

    \tvar f = [];

    \tvar i = [];

    \t//var char = charset.shift();

    \tfor(var xx = 0; xx < 26; xx++){

    \t\tf[xx] = document.createElement('form');

    \t\tf[xx].id = 'form'+xx;

    \t\ti[xx] = document.createElement('input');

    \t\ti[xx].type = "text";

    \t\ti[xx].name = 'name';

    \t\ti[xx].id = "iname"+xx;

    \t\tf[xx].appendChild(i[xx]);

    \t\tdocument.getElementById('hack').appendChild(f[xx]);

    \t\tvar event = document.createEvent('TextEvent');

    \t\tevent.initTextEvent('textInput', true, true, null, charset[xx]);

    \t

    \t\ti[xx].value = "";

    \t\ti[xx].selectionStart = 0;

    \t\ti[xx].selectionEnd = 0;

    \t\ti[xx].focus();

    \t\ti[xx].dispatchEvent(event);\t

    \t}

    \t

    \tsetTimeout(function() {

    \t\tfor(var xx = 0; xx < 26; xx++){

    \t\t\tvar i = document.getElementById('iname'+xx);

    \t\t\tif (i.value.length > 1) {

    \t\t\t\td.innerHTML += i.value + "<br>\

    ";

    \t\t\t}

    \t\t}

    \t}, 500);



    }
  • Reply 12 of 27
    mstonemstone Posts: 11,510member
    Quote:
    Originally Posted by Prof. Peabody View Post


    I don't get why this is being viewed as any kind of real issue, or why some web sites are saying that this could potentially compromise passwords and credit card info as well. It seems quite obvious that it cannot.



    *IF* you have autofill turned on (and any security conscious person would not do so), and

    *IF* you go to a malicious web site,



    That web site can get your name and address. Wow.



    I'm shakin in my boots right now. My address? Freely available to complete strangers? This is almost as bad as ...



    ... the phone book in every public telephone in my home town.



    If you started getting solicited with emails personally addressed to you and telemarketing on your cell phone where they address you by name (assuming it might be possible to get numbers), it might become a bit disconcerting. Never the less, the personal info is being harvested without your knowledge. It is not like you volunteered the information, so yes it IS a security flaw.
  • Reply 13 of 27
    prof. peabodyprof. peabody Posts: 2,860member
    Quote:
    Originally Posted by mstone View Post


    If you started getting solicited with emails personally addressed to you and telemarketing on your cell phone where they address you by name (assuming it might be possible to get numbers), it might become a bit disconcerting. Never the less, the personal info is being harvested without your knowledge. It is not like you volunteered the information, so yes it IS a security flaw.



    Agreed that it's a security flaw.



    It's just a small, weird, kind of silly security flaw IMO.



    But all over the web today there are scary stories about this "awful" "dangerous" flaw. Ars is actually running with a headline that says "Apple the new world leader in software insecurity." Which is absolutely ridiculous in it's implications.



    As with Antennagate, the media is having fun making it seem like Apple is evil incarnate etc.
  • Reply 14 of 27
    palegolaspalegolas Posts: 1,289member
    Nasty.

    I think we'll see a quick security patch here. I guess a LOT of people are using Auto Fill..
  • Reply 15 of 27
    bartfatbartfat Posts: 432member
    How come I can't get it to Autofill anything? I'm using WebKit, which essentially uses Safari 5, only difference is the rendering engine is slightly newer. I got all blanks for everything when I ran it, so I must be doing something wrong, even though Autofill is checked for all those boxes. Well, since the test failed, I suppose I can claim I broke the test even though I used Safari
  • Reply 16 of 27
    lilgto64lilgto64 Posts: 1,147member
    Maybe an opportunity here for someone to write a plugin that responds to auto-fill requests with a bogus address book entry - and then allow you to manually allow the correct data to be filled in.
  • Reply 17 of 27
    hirohiro Posts: 2,663member
    What we really need is a Safari version of NoScript (a FF plugin). That would preclude untrusted Javascript, especially JS not from the server you are knowingly visiting, from running and completely cut off malicious JS and click-jacking as possibilities.



    It does take a little bit to get it configured, but guess what, ssshhhhh ... <whispering>NoScript can also kill all the 3rd party analytic Javascript running on your browsing sessions.



    If you can't get click-jacked, almost all the web malware gets cut out except for the crap like giving out your password to load video codecs...
  • Reply 18 of 27
    pinoloxpinolox Posts: 2member
    Could it be because I have a different language set-up as default?
  • Reply 19 of 27
    The autofill is really handy for all the forum, lo risk sites that require usernames and passwords. I just don't use it for Banks, Paypal etc anything with sensitive information, plus my Bank does not allow you to save passwords and usernames. Isn't it just a case of using common sense when it comes to your own security?. Like someone mentioned 1Password is a good alternative, and make sure you have Firewall's activated as well as router security.
  • Reply 20 of 27
    pbpb Posts: 4,233member
    Quote:
    Originally Posted by mstone View Post


    If you started getting solicited with emails personally addressed to you and telemarketing on your cell phone where they address you by name (assuming it might be possible to get numbers), it might become a bit disconcerting.



    It is many years since I get unsolicited telemarketing on my home phone line, personally addressed to me. It is very annoying and has obviously nothing to do with such vulnerabilities in web browsers. Companies have other and more sure means to collect personal information, with the most obvious being the telephone directory. That one is not going to disappear auto-magically after a security update.



    Quote:
    Originally Posted by mstone View Post


    Never the less, the personal info is being harvested without your knowledge. It is not like you volunteered the information, so yes it IS a security flaw.



    Here I agree but I don't see much potential for harm. Hopefully it will be trivial for Apple to close the hole.
Sign In or Register to comment.