Skip to Content

Windows Safari bugs and exploits "popping up like hotcakes"



Safari has been available on Windows for less than 24 hours, and already the hacker community is apparently tearing it to shreds. The Errata Security blog has been keeping track of a few announcements across the web, including a fully disclosed 0-day exploit that Thor Larholm apparently found yesterday within two hours of the software's release (and says more are "popping up like hotcakes"). And just to be clear on the use of 0-day exploit: it means Larholm found a way to execute any piece of code on a Windows box when Safari visits a properly crafted site to successfully exploit a vulnerability on the day the vulnerability was found.

What will this mean for Safari's reputation and traction in the Windows market? I'm not really sure yet. There are any number of reasons behind Apple's decision to develop Safari for Windows, and even though a healthy pool of tech-savvy users are already tinkering with it (for better and for worse), the real results will be seen once it reaches much more of the mainstream market. One of the primary reasons (besides making it easy for Windows-based web developers to write web apps for the iPhone, of course) for SafariWin, as some are calling it, is because that tiny little search box in the upper right of a browser has become quite a revenue generator if the browser does decently in the market. When users search through that box, the browser manufacturer makes some money off the resulting ads that are displayed along with that search. Firefox reportedly made around $50-75 million last year for Mozilla because of that little search box (not bad for an open source product, eh?). You don't have to be Internet Explorer to bring home at least some bacon for your company; heck, I would bet that Opera is still in business largely due to their search box as well.

But none of these reasons will mean anything, and Safari won't generate nearly as much revenue for Apple, if it doesn't gain at least a respectable share of Windows users who are actually firing up Safari to search, browse the web, view and click on ads. But If Safari keeps getting torn apart like this within 24 hours of a release, it could gain a terrible reputation before it ever hits the radar of a crucial portion of the general public. In this new web browsing and computing world where security is everything when you talk about a browser, Safari needs to plug these exploit holes ASAP if it plans to get any farther than the fleeting front page of digg.

Safari has been available on Windows for less than 24 hours, and already the hacker community is apparently tearing it to shreds. The...
 

Add a Comment

*0 / 3000 Character Maximum

35 Comments

Filter by:
Tez

Sorry rogersmj, Emor8t is right, it is "another" browser. It does render differently to Safari Mac. I had originally thought great, I dont need to fire up my Mac to see if safari renders my page...However I have a web app with valid HTML and CSS that renders Identically in IE6, IE7, FF2, Safari Mac and Opera 9 (yes I put a lot of effort into it) And yet the input boxes render with an incorrect alignment in Safari PC. Also I have some page loading javascript which fades out the existing page and places a loading message on the screen. It runs fine on all browsers except Safari PC which fades out the page, but does not display the loading message.

June 28 2007 at 8:53 AM Report abuse rate up rate down Reply
emor8t

@rogersmj:

In theory, yeah. But seeing as it only works for 25% of windows users as it is, assuming it renders the same as the Mac would be a logical fallacy at this point.

June 13 2007 at 9:55 AM Report abuse rate up rate down Reply
Hank

Alex: "PUBLIC BETA"


Exactly!

June 12 2007 at 5:14 PM Report abuse rate up rate down Reply
mike

Yeah, so by the time iPhone is out, all these bugs will have been discovered/worked out.
Oops, that makes Apple look smart.

Doh!

June 12 2007 at 4:36 PM Report abuse rate up rate down Reply
David Chartier

#34: In this post with the words "any number of reasons," I already linked to a thorough post over at Download Squad that elaborates on why Apple brought Safari to Windows. I highly recommend reading it, but to summarize:

1) Safari on Windows means that web developers can make apps for the iPhone without needing to buy a Mac or an iPhone. More apps for the iPhone = a good thing.

2) Believe it or not, the search box in the top right of browsers these days has become an immense revenue generating tool for companies. Firefox made about $75 million in 2006 from that search box alone.

3) The more popular WebKit (the rendering engine that powers Safari, many other Mac OS X browsers, the iPhone's Safari and Windows Safari) becomes, the more likely that websites will ensure their design and services work on Safari. I.E. - the more people that use Safari across the Mac, PC and iPhone, the nicer the internet will become to Safari.

June 12 2007 at 4:30 PM Report abuse rate up rate down Reply
ggolinsky

Well, how secure can anything be on windows anyway?

June 12 2007 at 4:16 PM Report abuse rate up rate down Reply
Liquidmark

" We all know this is the way they work, so we'd better start preparing our devastatingly reality-based counter-arguments right now."


I already got a whole rolodex of arguments ready. ^^

June 12 2007 at 2:35 PM Report abuse rate up rate down Reply
mike

Actually, I think Steve blew it by not letting developers see this beforehand. This is not a stroke of genius, this is Apple's hubris coming out again. They should have let Windows developers kick it around a bit and give feedback--an open public beta without real security testing...irresponsible, there's no other way to put it.

And to delete the original Safari? Who thinks it's okay to replace final software with beta software? That's just lame.

Apple's looking kinda silly right now, in my opinion. Safari for Windows should have been released when it was ready, stable and secure.


June 12 2007 at 2:24 PM Report abuse rate up rate down Reply
Mo

Miso: I've been running Safari 3 on Windows (Server 2003, to be exact, which technically isn't even a supported platform—but then it isn't for iTunes or QuickTime either), and there have been zero issues with it.

Part and parcel of it being buggy beta is that it'll work fine for some folk and horribly for others. Same happens with vast amounts of other software on a daily basis.

Dave: Security holes are just bugs that happen to have security implications. Safari, the WebKit Windows port, and it's supporting code, are all expected to have bugs. That's rather the point. In an ideal world, one might say “well, everything except the UI is bug-free as far as we can tell, so test the hell out of that”, but that's not what Apple did. If a piece of network client software has crashing bugs that can be triggered by badly or specially-crafted packets [which obviously includes files being served by a remote web server], then you—as a user of that software—must assume that it's potentially remotely exploitable. This applies as much to the command-line FTP client as it does to Safari. The fact it's an unfinished product, newly ported to a platform, means you have to _assume_ it will have bugs, and those bugs could crop up anywhere. This is common sense.

June 12 2007 at 1:59 PM Report abuse rate up rate down Reply
Gman

So I am wondering if anyone will read this comment as I type it...too late...WHY WOULD APPLE RELEASE SAFARI FOR WINDOWS! So stupid Apple, don't ge me wrong I love you, but, WTF? Do you honestly think a browser will bring people to the mac, a browser who's default setting is to have tabs turned off? What a waste of programmers time, they should be improving the functionality of iTV! More movies, what happened to games? You could release a whole series of retro Nintendo games. Youtube, sweet, but is it really "that" cool...nope. Here's another one how can I get bittorrent on an Apple TV?
God I should be working for Apple!

June 12 2007 at 1:58 PM Report abuse rate up rate down Reply
Buy an ad here

Hot Apps on TUAW

Tweets

© 2012 AOL Inc. All Rights Reserved.