Researchers at Kaspersky Lab discovered Apple Safari browser stores previous secure session data unencrypted in a hidden folder.
Apple’s Safari browser stores session information including authentication credentials used in previous HTTPS sessions to implement the feature “Reopen All Windows from Last Session”. Safari stores in a plain text XML file called Property list, or plist, all the above information posing serious risk for user’s privacy.
The function is implemented in the following versions of Mac OS X and Safari:
OSX10.8.5, Safari 6.0.5 (8536.30.1)
OSX10.7.5, Safari 6.0.5 (7536.30.1)
Yes this week I decide to evaluate how private firms like Facebook and Apple manage user’s privacy on technical and legal perspective, yesterday in fact I’ve written about the way Facebook analyzes everything users type and not publish (self-censorship content) not considering it a privacy violation.
The concering discovery was made public by researcher Vyacheslav Zakorzhevsky on the Securelist blog, the plist files are stored in a hidden folder, but in plain text and it is not a good implementation ;-).
Safari doesn’t encrypt previous sessions and stores all data in a standard plist file that is freely accessible, it is a serious security flaw, considrer that an attacker could easily find a user’s login credentials as shown in the below image.
“The complete authorized session on the site is saved in the plist file in full view despite the use of https. The file itself is located in a hidden folder, but is available for anyone to read. The system can easily open a plist file. It stores information about the saved session – including http requests encrypted using a simple Base64 encoding algorithm – in a structured format. ” wrote Zakorzhevsky in his post. “
It easy to predict the effect of a malicious exploit that accesses to LastSession.plist file on victim’PC stealing sensitive information including user logs in to Facebook, Twitter, LinkedIn or their online bank account.
Fortunately in time I’m writing there aren’t news of any active exploits targeting the information stored in a plist file, but it could be a question of time.
“We’re ready to bet that it won’t be long before it appears,” Zakorzhevsky said.
Kaspersky Lab has already notified Apple of the Safari vulnerability.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.