Feeds

Naughty Flash Player BURIED ALIVE in OS X Mavericks Safari sandbox

Cupertino following the lead of Google, Microsoft, and Mozilla

Remote control for virtualized desktops

The Adobe Flash Player plugin runs in a locked-down sandbox under Safari on OS X 10.9 "Mavericks," making Apple the latest major web browser vendor to provide additional security when viewing Flash content on the web.

According to a memo posted by Adobe security strategist Peleus Uhley on Thursday, Flash Player in Mavericks is protected by an OS X App Sandbox, a security feature first introduced in OS X 10.7 "Lion" in 2011.

Apple's relationship with Flash has long been a fraught one. In his landmark "Thoughts on Flash" memo in 2010, Steve Jobs spelled out the reasons why Adobe's tech wouldn't be allowed on iOS devices, and security ranked high among his points.

"Symantec recently highlighted Flash for having one of the worst security records in 2009," Jobs wrote. "We also know first hand that Flash is the number one reason Macs crash. We have been working with Adobe to fix these problems, but they have persisted for several years now."

With Flash running in an OS X App Sandbox, the plugin is restricted to reading and writing files from only those locations on disk that are necessary for it to function properly. Its access to local device resources and inter-process communications (IPC) channels is also limited, and it has diminished network privileges.

Apple's OS X App Sandbox diagram

Apple's App Sandbox feature in OS X enforces security controls at the kernel level

Safari is not the first browser to implement such protections. Google took the lead in working with Adobe to develop sandboxing technology for Flash running in its Chrome browser in 2012, and Adobe helped to add similar capabilities to Firefox and Internet Explorer later that same year.

Not that these systems have been invulnerable to attack. Shortly after Adobe implemented its sandbox for Firefox, the security layer was attacked by hackers to escalate access permissions, forcing Adobe, Mozilla, Google, and Microsoft to issue additional patches.

Still, by adding similar sandbox protections to Safari, Apple at last has given OS X users similar protections when viewing Flash content as those already enjoyed by users on other platforms, including Windows and Linux.

The catch? The new sandboxing feature is only available on Safari 7.0, and for that you'll need to be running Mavericks. Users of OS X 10.8 "Mountain Lion" and earlier are stuck on Safari 6.1, which takes a far more liberal attitude toward the Flash Player plugin. ®

Intelligent flash storage arrays

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.