Safari 3.1 For Windows Vulnerable To Hacks

[szc]

it is even more vulnerable on Windows than on OS X

It is equally vulnerable on any system that's using Safari 3.1
The vulnerability exists in the browser.

You don't even need Safari to compromise Windows OS, it is vulnerable and easy to compromise by its nature. Of course it is widely used so hackers are attacking it like crazy, but that's not excuse. No one can assure me that there are no hackers out there who would at least try to hack OS X just to prove something, but yet... we don't have any serious system attacks registered, and even less successful ones.

[Lisandro]

I wish someday Windows and Mac users love each other 

[szc]

But Tech, that's already happening. I have both, so I am Mac and PC user in the same time. I don't have anything against either side of me, but when one of my sides work on PC, all I get most of the time is headache. I didn't like that, so I went out and bought one of these beauties. Mac really allows me to focus on my creativity, rather than spending so much time on checking up on latest versions of security software, and installing a bunch of it of course.

You love Linux, so I am 100% sure you would be unbelievable happy using OS X.

[Lisandro]

You love Linux, so I am 100% sure you would be unbelievable happy using OS X.

I'll use when I have a budget to give it to myself as a gift
Well... I'm learning Linux, but it's not intuitive as Windows (at least for me), I was born in Windows environment.

[szc]

Well, when talking about budget... I didn't have any when I first came here. Didn't have any friends, don't have any relatives... but I worked like a moron, all kind of jobs, regardless if it was day or night, sunny day or rainy day. After few years, I can say I can afford it now.

Windows = intuitive, Linux = perfect but not easy to use... OS X is your answer, everything that Linux has and more, and even easier to use than Windows.

[bob3160]

it is even more vulnerable on Windows than on OS X

It is equally vulnerable on any system that's using Safari 3.1
The vulnerability exists in the browser.

You don't even need Safari to compromise Windows OS, it is vulnerable and easy to compromise by its nature. Of course it is widely used so hackers are attacking it like crazy, but that's not excuse. No one can assure me that there are no hackers out there who would at least try to hack OS X just to prove something, but yet... we don't have any serious system attacks registered, and even less successful ones.

Sasha,
The title of this thread is "Safari 3.1 For Windows Vulnerable To Hacks"
this is all I pointed out.
All operating systems can, have been and will again be compromised.
As long as there are hackers, there will be compromises.
By nature, the most popular system will always be the most compromised.

Say hi to 2 of my favorite girls. 

[szc]

..
...
All operating systems can, have been and will again be compromised.
As long as there are hackers, there will be compromises.
By nature, the most popular system will always be the most compromised.

Say hi to 2 of my favorite girls. 

Yes, that's correct... but still, some will be more compromised and some less.

They are sending HIs back to you too guys! 

[FreewheelinFrank]

Apple okay with Safari 'carpet bombing' vuln for now

Next time you get nagged to install Apple's Safari browser keep this in mind: The company's security team has dismissed research that shows a simple way for miscreants to use the browser to litter an end user's machine with malicious files.

According to researcher Nitesh Dhanjani, Safari doesn't bother to ask for user permission before downloading resources from websites. When encountering malicious iframes and other scripts, the browser obediently does what the website tells it to do, including downloading a file as many times as html scripts order.

When informed of this "carpet bombing" vulnerability (as researcher Billy (BK) Rios has dubbed it), Apple agreed that it might be good if Safari actually checked with the user before downloading potentially vicious files, but signaled that kind of addition wasn't much of a priority.

"Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads," someone from Apple's security team told Dhanjani. "We want to set your expectations that this could take quite a while, if it ever gets incorporated."

This is unfortunate because the vulnerability allows miscreants to dump hundreds of malicious files into a user's default download location (in Windows it's the desktop and in OS X it's the download folder). As Nate McFeters at the Zero Day Blog sees it, it wouldn't be hard for a rogue site to load up a desktop with dozens of booby-trapped "My Computer" icons that look like the real Windows icon and wait for a confused user to accidentally click on them.

http://www.theregister.co.uk/2008/05/15/apple_safari_carpet_bombing_vuln/

[DavidR]

I would have thought that Secunia would consider this a security vulnerability as they did with the same issue with other browsers, which those browsers patched.

[bob3160]

I would have thought that Secunia would consider this a security vulnerability as they did with the same issue with other browsers, which those browsers patched.

I guess since it's an Apple product, it's considered in a different league. 

[.: Mac :.]

Well one could always update the Safari engine yourself without waiting for apple. Safari uses Webkit which is Open Source  and most issues are patched in the open source version before they are fixed in the Official Apple Release

The webkit site has prebuilt binaries for both Mac OS X and Windows of the latest version:
http://webkit.org/

Also if you choose about Safari you can see what version of webkit apple is using, the webkit version is beside the safari version
Example: Version 3.1.1 (5525.18)

when you install webkit it launches using the Safari front end using the updated engine (you have to have Safari installed).