Safari browser stores in plaintext previous secure session data

Researchers at Kaspersky Lab discovered Apple Safari browser stores previous secure session data unencrypted in a hidden folder.

Apple’s Safari browser stores session information including authentication credentials used in previous HTTPS sessions to implement the feature “Reopen All Windows from Last Session”. Safari stores in a plain text XML file called  Property list, or plist, all the above information posing serious risk for user’s privacy.

The function is implemented in the following versions of Mac OS X and Safari:

• OSX10.8.5, Safari 6.0.5 (8536.30.1)
• OSX10.7.5, Safari 6.0.5 (7536.30.1)

Yes this week I decide to evaluate how private firms like Facebook and Apple manage user’s privacy on technical and legal perspective, yesterday in fact I’ve written about the way Facebook analyzes everything users type and not publish (self-censorship content) not considering it a privacy violation.

The concering discovery was made public by researcher Vyacheslav Zakorzhevsky on the Securelist blog, the plist files are stored in a hidden folder, but in plain text and it is not a good implementation ;-).

Safari doesn’t encrypt previous sessions and stores all data in a standard plist file that is freely accessible, it is a serious security flaw, considrer that an attacker could easily find a user’s login credentials as shown in the below image.

 

“The complete authorized session on the site is saved in the plist file in full view despite the use of https. The file itself is located in a hidden folder, but is available for anyone to read. The system can easily open a plist file. It stores information about the saved session – including http requests encrypted using a simple Base64 encoding algorithm – in a structured format. ” wrote Zakorzhevsky in his post. “

It easy to predict the effect of a malicious exploit that accesses to LastSession.plist file on victim’PC stealing sensitive information including user logs in to Facebook, Twitter, LinkedIn or their online bank account.

Fortunately in time I’m writing there aren’t news of any active exploits targeting the information stored in a plist file, but it could be a question of time.

“We’re ready to bet that it won’t be long before it appears,” Zakorzhevsky said.

Kaspersky Lab has already notified Apple of the Safari vulnerability.

Pierluigi Paganini

(Security Affairs –  Safary, browser vulnerability)