Feeds

Old Apple Safaris leave IDs and passwords for scavengers to peck

Keep Calm And Don't Reopen All Windows from Last Session, says Kaspersky

Intelligent flash storage arrays

The fun folks at Kaspersky Labs' Securelist blog have found something nasty in Apple's Safari Browser, which they say lists user IDs and passwords in plaintext.

Detailed here, the problem derives from Safari's retention of browser history as applied in the “Reopen All Windows from Last Session” feature that enables users to quickly revisit the sites they opened during a previous Safari session.

Sadly, however, Kaspersky has found that the document Safari creates to allow such restoration is in plaintext and contains user IDs and passwords. The file is hidden, but isn't hard to find once you know what you are looking for.

As Kaspersky's post helpfully points out, “You can just imagine what would happen if cybercriminals or a malicious program got access to the LastSession.plist file on a system where the user logs in to Facebook, Twitter, LinkedIn or their online bank account.”

We can indeed.

Kaspersky's been kind enough to point out the problem to Apple, and also says it is not aware of any malware targeting the flaw. But the blog post was made last Friday, so perhaps some naughty malware-writers spent the weekend preparing just such a tool.

Apple's Security feed is silent on the matter, but panic seems premature: Kaspersky says the problem only affects OSX10.8.5 running Safari 6.0.5 (8536.30.1) and OSX10.7.5 with Safari 6.0.5 (7536.30.1). ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.