Feeds

Naughty Flash Player BURIED ALIVE in OS X Mavericks Safari sandbox

Cupertino following the lead of Google, Microsoft, and Mozilla

Protecting against web application threats using SSL

The Adobe Flash Player plugin runs in a locked-down sandbox under Safari on OS X 10.9 "Mavericks," making Apple the latest major web browser vendor to provide additional security when viewing Flash content on the web.

According to a memo posted by Adobe security strategist Peleus Uhley on Thursday, Flash Player in Mavericks is protected by an OS X App Sandbox, a security feature first introduced in OS X 10.7 "Lion" in 2011.

Apple's relationship with Flash has long been a fraught one. In his landmark "Thoughts on Flash" memo in 2010, Steve Jobs spelled out the reasons why Adobe's tech wouldn't be allowed on iOS devices, and security ranked high among his points.

"Symantec recently highlighted Flash for having one of the worst security records in 2009," Jobs wrote. "We also know first hand that Flash is the number one reason Macs crash. We have been working with Adobe to fix these problems, but they have persisted for several years now."

With Flash running in an OS X App Sandbox, the plugin is restricted to reading and writing files from only those locations on disk that are necessary for it to function properly. Its access to local device resources and inter-process communications (IPC) channels is also limited, and it has diminished network privileges.

Apple's OS X App Sandbox diagram

Apple's App Sandbox feature in OS X enforces security controls at the kernel level

Safari is not the first browser to implement such protections. Google took the lead in working with Adobe to develop sandboxing technology for Flash running in its Chrome browser in 2012, and Adobe helped to add similar capabilities to Firefox and Internet Explorer later that same year.

Not that these systems have been invulnerable to attack. Shortly after Adobe implemented its sandbox for Firefox, the security layer was attacked by hackers to escalate access permissions, forcing Adobe, Mozilla, Google, and Microsoft to issue additional patches.

Still, by adding similar sandbox protections to Safari, Apple at last has given OS X users similar protections when viewing Flash content as those already enjoyed by users on other platforms, including Windows and Linux.

The catch? The new sandboxing feature is only available on Safari 7.0, and for that you'll need to be running Mavericks. Users of OS X 10.8 "Mountain Lion" and earlier are stuck on Safari 6.1, which takes a far more liberal attitude toward the Flash Player plugin. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.