"Safari Automatically Executes Shell Scripts" vulnerability (zero-day exploit) [#3]: Protective methods, more

Originally posted February 23rd

We continue to provide updated information and attempt to eliminate some misconceptions about the "Safari Automatically Executes Shell Scripts" vulnerability we've been reporting on for the past few days.

To recap, this vulnerability has to do with the way Mac OS X handles its LaunchServices, and is a feat of social engineering rather than a representation of genuine security flaws in Mac OS X (not to say that Apple couldn't tighten Mac OS X's behavior to lessen the chances of malicious code executing through this method).

The vulnerability was only associated with the "Open safe files automatically" command because this is a likely vector for transfer of potentially malicious shell scripts, and could theoretically require no user interaction other than downloading a malicious file under certain circumstances.

However, even if the "Open safe files automatically" function is disabled, the file recipient can still be tricked into opening a malicious script. The problem, in essence, is that Mac OS X allows any item to carry a custom icon. So a shell script could appear to the user as a .jpg image, a movie or any other type of file. Upon double-clicking the seemingly innocuous files, a shell script is executed that can at most (without administrator privileges, which you should never have to enter when opening a document) delete local user files and wreak other account-constrained havoc.

It is also important to note that simply writing a shell script without a "shebang" line (which normally tells the Terminal which shell to use when opening a script), then giving it a false file extension such as .jpg and turning it into a zip archive will not make it execute automatically via the Terminal. The malicious file must also be given a resource fork that tells it explicitly to launch in the Terminal.

Protective method -- inspect files with Get Info As such, one of the best protective methods you can use (after turning off the option to open "safe" files automatically in Safari) is to inspect any newly obtained downloads before launching them.

Click on the newly received download once to select it, then press the Command and I keys simultaneously, or go to the "File" menu in the Finder and select "Get Info."

If the file carries the icon representation of an image or some other file, but shows a different "Kind" in the Get Info window, something isn't right. Avoid launching the file and follow up by obtaining information about the authenticity of the download source.

Apple should better define "safe" One salient point from this mostly hyperbolic "threat" is that Apple needs to better define just exactly what a "safe" file is. By focusing on closing the pores in LaunchServices, Apple can better ensure than any security lapse is due to user error rather than a blatant system-based vector.

Changing the Terminal name -- caveat We previously noted that one protective measure for this issue involves replacing the Terminal application with an automated script that asks for user permission before launching the Terminal.

As part of that measure, we noted that the Terminal itself should be renamed something like _Terminal.app. We should now note that a malicious user could simply target that name, and still gain access to the Terminal. As such, you should use random name you are comfortable with rather than the suggested _Terminal.app.

Note, however, that the automator script we linked to earlier will have to be modified to point to the Terminal name you have chosen.

Software-based protection A few new software-based protective methods have now hit the download market.

"Safe Terminal" is an input manger that disallows Terminal.app to execute any command and .term files, theoretically making it safe to use Safari "Open safe files after download" option.

The one problem with this workaround is that, after installing this utility, when opening Terminal.app, a new shell window will not automatically be opened. To create a new shell window, the user must choose "New" from the File menu or press the Command-N keyboard combination.

Saft Lite now includes a mechanism that can check a Safari download file's MIME types and in case it is executable. It can check for MIME types of image, audio, text, video and message. Upon finding a file with executable code, Saft will try to turn the executable flag off and warn you about it. Once Saft turns the executable flag of the file off, any attempts to open the file in the Finder won't trigger the file to launch in Terminal.

Feedback? Late-breakers@macfixit.com.

Previous coverage:

• Explanation, fixes for "Safari Automatically Executes Shell Scripts" vulnerability -- similar to Widget vulnerability in mid-2005

Resources