Apple’s Safari browser stores session information including authentication credentials used in previous HTTPS sessions to implement the feature “Reopen All Windows from Last Session”. Safari stores in a plain text XML file called Property list, or plist, all the above information posing serious risk for user’s privacy.
The function is implemented in the following versions of Mac OS X and Safari:
Yes this week I decide to evaluate how private firms like Facebook and Apple manage user’s privacy on technical and legal perspective, yesterday in fact I’ve written about the way Facebook analyzes everything users type and not publish (self-censorship content) not considering it a privacy violation.
The concering discovery was made public by researcher Vyacheslav Zakorzhevsky on the Securelist blog, the plist files are stored in a hidden folder, but in plain text and it is not a good implementation ;-).
Safari doesn’t encrypt previous sessions and stores all data in a standard plist file that is freely accessible, it is a serious security flaw, considrer that an attacker could easily find a user’s login credentials as shown in the below image.
“The complete authorized session on the site is saved in the plist file in full view despite the use of https. The file itself is located in a hidden folder, but is available for anyone to read. The system can easily open a plist file. It stores information about the saved session – including http requests encrypted using a simple Base64 encoding algorithm – in a structured format. ” wrote Zakorzhevsky in his post. “
It easy to predict the effect of a malicious exploit that accesses to LastSession.plist file on victim’PC stealing sensitive information including user logs in to Facebook, Twitter, LinkedIn or their online bank account.
Fortunately in time I’m writing there aren’t news of any active exploits targeting the information stored in a plist file, but it could be a question of time.
“We’re ready to bet that it won’t be long before it appears,” Zakorzhevsky said.
Kaspersky Lab has already notified Apple of the Safari vulnerability.
(Security Affairs – Safary, browser vulnerability)
China-linked threat actors are preparing cyber attacks against U.S. critical infrastructure warned FBI Director Christopher…
The United Nations Development Programme (UNDP) has initiated an investigation into an alleged ransomware attack…
BlackBerry reported that the financially motivated group FIN7 targeted the IT department of a large…
An international law enforcement operation led to the disruption of the prominent phishing-as-a-service platform LabHost.…
Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since…
Cisco has addressed a high-severity vulnerability in its Integrated Management Controller (IMC) for which publicly…
This website uses cookies.