Feeds

Naughty Flash Player BURIED ALIVE in OS X Mavericks Safari sandbox

Cupertino following the lead of Google, Microsoft, and Mozilla

Next gen security for virtualised datacentres

The Adobe Flash Player plugin runs in a locked-down sandbox under Safari on OS X 10.9 "Mavericks," making Apple the latest major web browser vendor to provide additional security when viewing Flash content on the web.

According to a memo posted by Adobe security strategist Peleus Uhley on Thursday, Flash Player in Mavericks is protected by an OS X App Sandbox, a security feature first introduced in OS X 10.7 "Lion" in 2011.

Apple's relationship with Flash has long been a fraught one. In his landmark "Thoughts on Flash" memo in 2010, Steve Jobs spelled out the reasons why Adobe's tech wouldn't be allowed on iOS devices, and security ranked high among his points.

"Symantec recently highlighted Flash for having one of the worst security records in 2009," Jobs wrote. "We also know first hand that Flash is the number one reason Macs crash. We have been working with Adobe to fix these problems, but they have persisted for several years now."

With Flash running in an OS X App Sandbox, the plugin is restricted to reading and writing files from only those locations on disk that are necessary for it to function properly. Its access to local device resources and inter-process communications (IPC) channels is also limited, and it has diminished network privileges.

Apple's OS X App Sandbox diagram

Apple's App Sandbox feature in OS X enforces security controls at the kernel level

Safari is not the first browser to implement such protections. Google took the lead in working with Adobe to develop sandboxing technology for Flash running in its Chrome browser in 2012, and Adobe helped to add similar capabilities to Firefox and Internet Explorer later that same year.

Not that these systems have been invulnerable to attack. Shortly after Adobe implemented its sandbox for Firefox, the security layer was attacked by hackers to escalate access permissions, forcing Adobe, Mozilla, Google, and Microsoft to issue additional patches.

Still, by adding similar sandbox protections to Safari, Apple at last has given OS X users similar protections when viewing Flash content as those already enjoyed by users on other platforms, including Windows and Linux.

The catch? The new sandboxing feature is only available on Safari 7.0, and for that you'll need to be running Mavericks. Users of OS X 10.8 "Mountain Lion" and earlier are stuck on Safari 6.1, which takes a far more liberal attitude toward the Flash Player plugin. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.