full-disclosure - Mac OSX 10.4 Dashboard Authentication Hijacking Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu May 19 13:47:17 2005
From: ph0enix at justonemorething.org (ph0enix)
Subject: Mac OSX 10.4 Dashboard Authentication Hijacking
	Vulnerability

> [..] And they run a lot of them. They're not likely to assume that  
> widgets can contain trojans or be cautious of what they download  
> like they are regular applications.

well, that is true. Because Dashboard widgets are looking 'cool and  
sweet', most of the users will not realize that they could contain  
arbitrary code and so some of them are easy victims. Dashboard is  
really a cool thing, but Apple also opened Pandora's box with it.

www.osvdb.org -- everything is vulnerable.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050519/ba10eded/attachment.html