Home > OS X > Safari users still vulnerable to “carpet-bombing” attack

Safari users still vulnerable to “carpet-bombing” attack

Apple Safari carpet-bombing is a vulnerability that allows remote attacker via malicious website to silently download arbitrary files in users’ default download directory (~/Download).

This issue became serious in Windows because the default download is in users’ Desktop. Attackers can craft any file to look like a link file (.LNK) and or image file (.JPEG) to entice users into clicking it. Apple immediately address this issue in Safari for Windows 3.1.2.

However, Safari Mac OS X  users remain exposed to this vulnerability. In May 2008, Nitesh Dhanjani disclosed details about this flaw and a year later, while I was writing my paper for VB2009, I revisited this issue and found that it is still unpatched. I have contacted him and verified whether my findings is true, and unfortunately he answered “yes”.

Ok, two years later, again I am writing  and reviewing same old tricks, and found that Nitesh Dhanjani recently revisited this issue in his blog post titled “2 Years Later: Droppin’ Malware on Your OSX, Carpet Bomb Style (and Then Some!)“.

I smiled when I saw the screenshot and bonus notes, it reminds me how tricky it can get when it’s combined with other known tricks/exploits – makes it easier to get users’ click.


What is this monkey doing in my download?  Opss, carpet-bomb! That monkey is a trick, it’s not an image file.

Recommended reading:


  1. AT
    November 8, 2010 at 11:35 pm

    If the JPG launched an application, wouldn’t OSX warn you before launching an application from the web? I don’t think this is as serious a vulnerability as the one on Windows was…

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: