Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I know your name, where you work, and live (Safari v4 & v5)

jeremiahgrossman.blogspot.com

Post reply on HN
Print view View original

11–20 of 61 posts

Re: I know your name, where you work, and live (Safari v4 & v5)

#11

Post by jvdh »

tptacek wrote: post #2

(Title sic ). Short summary: Safari autocompletes forms from your private address book, and can be tricked into doing that by Javascript events on form fields named in ways Safari would want to autocomplete; worse, once autocompleted, that data can be read out of the form by the same JS that triggered the event. Long story short, if you browse to a site with Safari and you have autocomplete on, that site can slurp so…

    that site can slurp some stuff out of your address book.
More specifically, it can slurp some stuff from your personal address card that you've set in AddressBook.app This hack does not allow you to get the address of someone's mother-in-law.

Re: I know your name, where you work, and live (Safari v4 & v5)

#12

Post by maxjg »

tuxychandru wrote: post #4
macrael wrote: post #3

What do other browsers do differently to prevent this from being a problem?

They do not use your system's address book to fill forms online.

Understand that it's fetching the data from the system's address book, but obviously this is going to be the same data it would remember if you entered it elsewhere. Keep in mind that this is a feature of Safari being exploited, it's not like this is an vulnerability in the address book gives you unlimited access to all the user's contacts.

Re: I know your name, where you work, and live (Safari v4 & v5)

#13

Post by jey »

tuxychandru wrote: post #4
macrael wrote: post #3

What do other browsers do differently to prevent this from being a problem?

They do not use your system's address book to fill forms online.

Er, the problem seems to be more that Javascript-initiated keyboard events can trigger AutoComplete. Only KB events from the system should be allowed to do that.

Re: I know your name, where you work, and live (Safari v4 & v5)

#15

Post by loewenskind »

natmaster wrote: post #10
macrael wrote: post #6

Earlier quoted context omitted.

Doesn't firefox autofill forms? I didn't realize that was a safari only feature.

Autocomplete by other browsers works by remembering things you entered in forms previously (maybe restricted to domain?). One distinction is that you already decided you wanted to expose that information. The most important distinction though, is that you have to still select to fill that out manually. Of course logins are another story - those are automatically filled in. But those are restricted to the page you alr…

Couldn't you still use a variation of this hack to steal the info from Firefox?

Steps:

1. Go to a popular site that makes one fill out the information you want to steal.

2. Record the name they use for all their fields (afaik this is how FF determines what value to supply)

3. Use the hack to make a form with those fields

4. Profit

On step 3, it may be that you have to enter the field and type something to get the auto-complete to kick in, but that's easy: you only need to try 26 letters and 10 numbers to get a hit.

Re: I know your name, where you work, and live (Safari v4 & v5)

#16

Post by loewenskind »

Since this is a problem in the JS handling (as mention in another comment in this thread, Safari isn't differentiating between keyboard entries that were generated from JS from ones that actually came from a keyboard), that's probably in Webkit itself and therefor fixable by the community, no?

Re: I know your name, where you work, and live (Safari v4 & v5)

#17

Post by retube »

> These fields are AutoFill’ed using data from the users personal record in the local operating system address book.

Sorry, maybe a stupid question, but can someone explain this? I had no idea my OS had an address book. Why does it have this? If it does, how do I put stuff in it? Or delete stuff in it? Is this just on mac, or windows and linux too?

Re: I know your name, where you work, and live (Safari v4 & v5)

#18

Post by confuzatron »

macrael wrote: post #3

What do other browsers do differently to prevent this from being a problem?

I have only tested this with Chrome, but what I see is that Chrome does not autocomplete the form field (i.e. insert your name/etc into the text field). In Chrome, the decision to add previously-entered text into the field is left to the user, through selection from a dropdown that Chrome displays below the text field. Presumably Safari just sticks the text in the field as soon as the prefix added to the field using fake keypresses matches up with your addressbook info.

I havent used the autofill feature (have never trusted it), but in Chrome apparently it is site-specific, and requires user intervention for it to work. I'd be interested in how FF handles it.

Re: I know your name, where you work, and live (Safari v4 & v5)

#19

Post by confuzatron »

loewenskind wrote: post #15
natmaster wrote: post #10

Earlier quoted context omitted.

Autocomplete by other browsers works by remembering things you entered in forms previously (maybe restricted to domain?). One distinction is that you already decided you wanted to expose that information. The most important distinction though, is that you have to still select to fill that out manually. Of course logins are another story - those are automatically filled in. But those are restricted to the page you alr…

Couldn't you still use a variation of this hack to steal the info from Firefox? Steps: 1. Go to a popular site that makes one fill out the information you want to steal. 2. Record the name they use for all their fields (afaik this is how FF determines what value to supply) 3. Use the hack to make a form with those fields 4. Profit On step 3, it may be that you have to enter the field and type something to get the aut…

If you're right, the test page should work in FF. You could try it.

Step 1 and 2 aren't required - the field names are 'standard'.

Step 3 is what the test page does already.

Edit: It looks like the javascript used to generate keypresses isn't supported by Firefox:

https://developer.mozilla.org/en/DOM/document.createEvent

    var event = document.createEvent('TextEvent');
    event.initTextEvent('textInput', true, true, null, char);

    input.value = "";
    input.selectionStart = 0;
    input.selectionEnd = 0;
    input.focus();
    input.dispatchEvent(event);

Re: I know your name, where you work, and live (Safari v4 & v5)

#20

Post by Robin_Message »

macrael wrote: post #3

What do other browsers do differently to prevent this from being a problem?

I don't have Safari to test, but it looks like it does two things differently to other browsers. The first has been mentioned — slurping data from the local address book and feeding it to any site.

The second I can't test, but looking at the screenshot, it appears that Safari actually fills in the text field with the contents of the auto-fill, before you actually choose that auto-fill, and it highlights that text so typing something overwrites it, which is a standard way of doing autofill. However, using script to ask the textbox for its contents then exposes sensitive data. In contrast, other browsers display the sensitive data in (inaccessible to script) browser chrome, so no data is exposed.

  Safari:    R|*obin Message* (in the textbox itself)
  Firefox:   R|
             Robin Message (in a popup, push down to get to it)
Post reply on HN