Security researchers have discovered that a convenient Safari feature can automatically give up a user’s personal information to a Website.
As reported by InformationWeek, WhiteHat Security founder and CTO Jeremiah Grossman described on his blog how a malicious hacker could take advantage of Safari’s AutoFill feature. Basically, a maliciously crafted Web form can cycle through letters and numbers in each text entry field until it triggers Safari’s auto-fill functionality. The form can then be automatically submitted to the hacker so the information can be be sold to spammers and otherwise exploited.
Grossman blames a flaw in WebKit, the open-source engine that powers Safari on both the Mac and iOS devices, as well as Google’s Chrome browser and other mobile devices. Fortunately, there’s an easy way to defend against the malicious exploitation of Safari’s AutoFill feature. You can simply disable the “Using info from my Address Book” option in the AutoFill preferences pane.
Post new comment