Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Safari Autofill Security Issue Permits Access to Personal Information

chris.robison said:
Couldn't you get all this without having autofill enabled anyhow?

Example:
I order some stuffs at some site, my browser remembers the form fields and text I put into the inputs.

Now something fishes for this and autofills. It may not matter if I have autofill from Address Book enabled. Right?
Click to expand...

If autofill isn't enabled, then your browser wont remember what you have entered into a form filed.
 
Stella said:
Because some sites still don't work well with Safari. Having choice of browsers is a good thing. Whats wrong with updates? Firefox updates for you automatically.
Click to expand...

My banking site does not work fully with either FF or Safari. Unfortunately, when I saved files of the transactions using Windows XP, that was not satisfactory either. Screenshots while using either FF or Safari on my Mac are my safeguards, although I will not be able to copy text as with a pdf. As far as I know, XP does not do screenshots or pdf. If anyone knows alternatives, post them please.

My Address Book has only 2 cards, Apple Inc. and my own info. When I first set up this Mac while it was yet new, I had a keyboard protective skin in place. Keys require a more forceful push to be selected, and a double L turned out to be single. The first time autofill completed my info in an on-line purchase, my address was incorrect due to that single L. It was corrected right away, and having autofill is extremely helpful. Some sites require my entering the first character in a field before the field is completed.

I have not received any spam addressed to me. I have received e-mail / spam addressed to my daughter even though her personal info is not in my Address Book.
 
Is there anyone with whome that proof of concept thingy does not work?
It works on my girlfriend's MBP, but not on my iMac, and I'm curious as to why *-)
 
Melle said:
Actually, I did a quick test with the PoC-code, and found two things:
1. It can't be sped up. Apparently the autofill has a half a second delay, meaning the keystroke also needs half a second per letter;
2. If the form-field is hidden by css, autofill doesn't work. Autofill seems to ONLY fill visible fields.

Knowing this… seems like quite a non-issue, to be honest. Only way this can be used is by having it visible on the page, and executing for quite a while before it finds the good stuff...
Click to expand...
Are you sure that there are no ways to hide the textfields? Can't you have some pop-over animation or can't you set the text colour to white?
 
Old news, I've been using this exploit to con my friends for ages now. I first figured it out when safari would autofill information in places where it shouldn't have been autofilled.

Is this really the first time that anyone realized this could be done?
 
I always turned that feature off anyway because I assumed it might be an attack vector. :p
 
manu chao said:
Are you sure that there are no ways to hide the textfields? Can't you have some pop-over animation or can't you set the text colour to white?
Click to expand...

Touché. I just tested and there are indeed there are alternative ways to hide the fields and still (ab)use this functionality. So that only leaves the speed; half a second per letter to find the right answer (so people whose email-address starts with an A are more vulnerable than those starting with an X :)).
 
manu chao said:
Have you set an address card as yourself?
Click to expand...
Yeah, both my iMac and my MBP are synced with Google, and are otherwise configured exactly the same (unless I'm missing something). But on my MBP it also seems to work, but not on my iMac.
I wonder if this is some bizarre fluke, or that this means there's a way around this "hack" with disabling auto-fill.
 
AppleMojo said:
As an information security analyst... this is extremely old skewl and not a very complete post. I and others I know have used this technique for probably 7 or more years and I am sure we weren't the first to think of it either.

Also, he failed to realize that you can use hidden fields as well as mask fields to achieve the same goal.

Keep in mind, email addresses are not the true objective of this type of attack.

Having dozens of fields with the following names all hidden or masked is guaranteed to grab the data you are looking for as well as anything else you can think of.

cc
ccn
credit_card
cc1
ccnum
creditcard

security
code
secret

ssn
socialsecuritynumber
ssnumber
Click to expand...

You have that in your address book?

Furthermore numbers don't work.
 
cmaier said:
Safari, QuickTime and iTunes are not "third-party software."
Click to expand...

True. They are first-party software. The third-party reference should probably have been clarified as referring to software from vendors like Adobe and Sun who were mentioned later. Of course, if you know what third-party means, you can probably figure that out for yourself.

cmaier said:
And they are not "not in its operating system" -
Click to expand...

False. Safari, QuickTime, and iTunes are not in the operating system. They are software packages like any other. Just like Final Cut Pro, or any number of other pieces of software produced by Apple and others.

cmaier said:
they ship with the OS.
Click to expand...

True. However, the fact that software ships on the same disc as the OS doesn't make that software part of the OS. XCode, for example, is certainly not part of the OS. Neither are Safari, QuickTime, or iTunes.

All in all, I'll give you 2 out of 3, but I'm afraid I'll have to round down because you clearly don't understand what distinguishes an operating system from an application. Better luck next time.:D
 
Long as Jobs denies it..
it doesnt exist. Typical Apple.
Congratulations, Apple! You made me stay on FireFox forever!:D
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back