I know your name, where you work, and live (Safari v4 & v5)

http://jeremiahgrossman.blogspot.com/2010/07/i-know-who-your-name-where-you-work-and.html

by tptacek • 16 years ago

165 54 16 years ago

jeremiahgrossman.blogspot.com

tptacek6• 16 years ago

(Title sic).

Short summary: Safari autocompletes forms from your private address book, and can be tricked into doing that by Javascript events on form fields named in ways Safari would want to autocomplete; worse, once autocompleted, that data can be read out of the form by the same JS that triggered the event.

Long story short, if you browse to a site with Safari and you have autocomplete on, that site can slurp some stuff out of your address book.

jvdh• 16 years ago

    that site can slurp some stuff out of your address book.

More specifically, it can slurp some stuff from your personal address card that you've set in AddressBook.app This hack does not allow you to get the address of someone's mother-in-law.

jonknee2• 16 years ago

> This hack does not allow you to get the address of someone's mother-in-law.

Unless you're the mother-in-law :).

macrael2• 16 years ago

What do other browsers do differently to prevent this from being a problem?

tuxychandru• 16 years ago

They do not use your system's address book to fill forms online.

macrael2• 16 years ago

Doesn't firefox autofill forms? I didn't realize that was a safari only feature.

maxjg• 16 years ago

Understand that it's fetching the data from the system's address book, but obviously this is going to be the same data it would remember if you entered it elsewhere. Keep in mind that this is a feature of Safari being exploited, it's not like this is an vulnerability in the address book gives you unlimited access to all the user's contacts.

jey2• 16 years ago

Er, the problem seems to be more that Javascript-initiated keyboard events can trigger AutoComplete. Only KB events from the system should be allowed to do that.

confuzatron2• 16 years ago

I have only tested this with Chrome, but what I see is that Chrome does not autocomplete the form field (i.e. insert your name/etc into the text field). In Chrome, the decision to add previously-entered text into the field is left to the user, through selection from a dropdown that Chrome displays below the text field. Presumably Safari just sticks the text in the field as soon as the prefix added to the field using fake keypresses matches up with your addressbook info.

I havent used the autofill feature (have never trusted it), but in Chrome apparently it is site-specific, and requires user intervention for it to work. I'd be interested in how FF handles it.

Robin_Message• 16 years ago

I don't have Safari to test, but it looks like it does two things differently to other browsers. The first has been mentioned — slurping data from the local address book and feeding it to any site.

The second I can't test, but looking at the screenshot, it appears that Safari actually fills in the text field with the contents of the auto-fill, before you actually choose that auto-fill, and it highlights that text so typing something overwrites it, which is a standard way of doing autofill. However, using script to ask the textbox for its contents then exposes sensitive data. In contrast, other browsers display the sensitive data in (inaccessible to script) browser chrome, so no data is exposed.

  Safari:    R|*obin Message* (in the textbox itself)
  Firefox:   R|
             Robin Message (in a popup, push down to get to it)

mbrubeck• 16 years ago

My first Firefox security bug report (five years before I became a Mozilla employee!) was for a somewhat similar issue where pages could read form autofill data that wasn't explicitly entered by the user. Even before that vulnerability was fixed, it required significantly more user interaction than this Safari exploit. Normally Firefox will not make autofill data accessible to scripts except in response to user interaction.

Details here: http://www.advogato.org/person/mbrubeck/diary/92.html

caf• 16 years ago

It occurs to me that the reason it doesn't work for saved information that begins with a digit is probably to protect CC numbers / CVVs from a similar attack.

izendejas• 16 years ago

This reminded me of Gator and their disingenuous practices. http://en.wikipedia.org/wiki/Claria_Corporation

GFischer• 16 years ago

Argh... my mother used eWallet to store her credit card info... I deleted it as adware and she was extremely upset.

loewenskind3• 16 years ago

Since this is a problem in the JS handling (as mention in another comment in this thread, Safari isn't differentiating between keyboard entries that were generated from JS from ones that actually came from a keyboard), that's probably in Webkit itself and therefor fixable by the community, no?

bruceboughton• 16 years ago

That doesn't help with an actual Safari release though, does it?

loewenskind3• 16 years ago

If the code is accepted it would, and likely faster than sitting on our hands hoping that Apple will care about this.

retube• 16 years ago

> These fields are AutoFill’ed using data from the users personal record in the local operating system address book.

Sorry, maybe a stupid question, but can someone explain this? I had no idea my OS had an address book. Why does it have this? If it does, how do I put stuff in it? Or delete stuff in it? Is this just on mac, or windows and linux too?

roryokane2• 16 years ago

On Mac, there is an application called Address Book in the Applications folder. It comes with the OS so as to allow apps to integrate with it. Such apps include Safari, as we have seen, and Mail (the email program). Adding and editing contacts should be obvious from the interface – click a + at the bottom to add a new contact or contact group. I don’t know if Windows or Linux have address books.

moxiemk1• 16 years ago

I'm quite sure that Windows has a system-wide address book service managed by the Address Book application as well, or at least does in recent versions.

roryokane2• 16 years ago

The demo doesn’t work for me – it can’t detect my information at all. I’m using Safari Version 5.0 (6533.16), have the red-circled autofill setting enabled (and no other autofill settings), and have information about myself in my address book card.

mike-cardwell3• 16 years ago

Didn't work for me until I went into the address book, selected my contact and then clicked "Make this my card". I'm using the same version of Safari as you.

jsz0• 16 years ago

The upside is OSX doesn't make any card your default until you do something that requires it. Certain things in Mail and iCal will bring up a dialog box with instructions on how to "Make this my card" (such as creating a meeting invite in iCal)

cubicle67• 16 years ago

completely unrelated - didtrade http://news.ycombinator.com/user?id=didtrade has been spamming HN for 21 days now, but they're still not banned?

jey2• 16 years ago

All his posts appear "dead" to me. That's how most HN bans work.

bkrausz• 16 years ago

I was trying to think of how to ask that myself. I guess just auto-deleting whatever they post (if that's actually what's happening) is better than banning them, since a ban would alert them and they can just make a new account. This lets them continue spamming nobody (except showdead folk).

mike-cardwell3• 16 years ago

Has anyone actually confirmed this works yet? It doesn't look like it to me...

mike-cardwell3• 16 years ago

Scratch that. I had to go into my address book, select my contact and then click "Make this my card". Then the exploit worked.

orph• 16 years ago

TL;DR. I use Chrome these days.

mishmash7• 16 years ago

While this exploit sounds like trouble, what's more disconcerting to me is that in mid-2010 Apple still doesn't have a functioning system in place to handle responsible disclosure.

jonknee2• 16 years ago

Email product-security@apple.com or go the extra mile and encrypt it: https://www.apple.com/support/security/pgp/

mishmash7• 16 years ago

Apparently, he did:

> I figured Apple might appreciate a vulnerability disclosure prior to public discussion, which I did on June 17, 2010 complete with technical detail. A gleeful auto-response came shortly after, to which I replied asking if Apple was already aware of the issue. I received no response after that, human or robot.

tptacek6• 16 years ago

That's not fair; hundreds of people report vulnerabilities to Apple every year. We've done it, many times. They're not lightning fast, but they aren't blowing people off either.

mishmash7• 16 years ago

You might be right. I should have written "a fail proof" system instead.

And really, I don't think it's that unreasonable to expect a fail proof level of response on security vulnerabilities from the world's most valuable computer company.

SeriousGuy2• 16 years ago

Wow Ilove this stuf, I can already see Apple apologist lining up to show how this is "Just Works" or "magical Design" and how Chrome is evil since google is transffering data over their seceret wi-fi internet which fills the whole world.

I also see an idiot commenting about his mother in law, sadly theses people never understand concerns for privacy since being apple fanboi they already have hardly anything to hide.

SeriousGuy2• 16 years ago

I also see an idiot commenting about his mother in law, sadly theses people never understand concerns for privacy.

I know your name, where you work, and live (Safari v4 & v5)

Related Stories