Picture of Jürgen Kreileder

Posts Tagged ‘Apple’

OS X Applications Insecurely Installing World-Writable Files

Files, directories, and devices that are writable by any user (“world-writable”) on a multi-user system can be dangerous locally exploitable security holes. There are very few legitimate reasons for having world-writable files and directories on a system.

Many UNIX and Linux systems actually have cron jobs that check for world-writable files. On Apple’s OS X there is no such safeguard and many vendors do not seem to care about file permissions much at all. Several well-known applications are either installed with world-writable files or create them when used:

World-writable files in system directories

The following applications install world-writable files in shared directories (/Applications, /Library, …):

  • Adobe CS 4, CS 5: Some uninstallers + several files and directories in /Library/Application Support + various stuff in other locations
  • Adobe Media Player: directory + some files in Contents/Resources
  • Adobe Flash Player: directories (including AddIns und AddIns/airappinstaller)
  • Amazon MP3 Downloader: some directories
  • EPSON (Scan, TWAIN data source, Easy Photo Print, …): pretty much everything, including executables
  • Eye-One Match 3: complete app, including executable
  • eMusic Download Manager: complete app, including executable and JavaScript (the application is based on Mozilla)
  • Telltale games: complete apps including executable and libraries
  • Apple OS X: some plist and cache files, including at least one LaunchDaemon plist file
  • Google+Growl Utility (not a Google product): whole app including executable
  • HP Scan Pro (plus supporting files): everything including executables
  • DivX Converter: resource files
  • Apple Remote Desktop: some plist files
  • Apple GarageBand: several plist and data files
  • Apple ColorSync: some profiles
  • Microsoft Office 2011: directory in /Library Application Support
  • Elgato EyeTV: several plist files
  • ABBYY FineReader Sprint 8.0: several data files
  • ArcSoft (Connect Suite, MediaImpression 2): all files, including executables
  • Extensis Suitcase Fusion 2: all files, including executables

World-writable files in user directories

The following applications install world-writable files in user directories (/Users/$USER):

  • GoogleGrowl.plugin: whole plugin including executable
  • 3rd-party extensions for Apple Safari: some extensions (e.g. AdBlock) install world-writable files
  • Apple iPhoto: the whole library seems to be world-writable
  • Adium add-ons: several add-ons install world-writable files
  • eMusic Download Manager:some preferences files are world-writable
  • Adobe (CS 4, CS5, Flash, …): several preferences files
  • Apple MobileDevice: crash logs are world-writable

The lists have been compiled by inspecting my own systems and those of several friends by running

sudo sh -c \
  "find / -xdev -perm +o=w ! \( -type d -perm +o=t \) ! -type l -print0 | \
   xargs -0 ls -dl 2>&1 | \
   tee world-writable-files.txt"

and analyzing the output.

Note that running Disk Utility‘s “Repair Disk Permissions” does not have any influence on the issues described here.

Most OS X installations are probably single-user systems in reality but the situation is still somewhat ugly.

Thoughts on Apple’s Magic Mouse

A few random thoughts on Apple’s new multi-touch Magic Mouse:

  • Apple killed the third mouse button! I am conditioned to open tabs in browsers with the a middle click, so this is quite some problem for me. (I still hoped for an Open-in-a-New-Tab gesture for Apple’s touch pads but I guess it is unlikely now.)
  • You have to press down the entire mouse to generate a click. Not really new but on this mouse I instinctively try to use Tap-to-Click like on a touch pad. It just does not work that way. Bummer.
  • Right click still requires you to lift your left finger like with the Mighty Mouse. This requires some time to get used to and also means that it is impossible to press both “buttons” at the same time.
  • Scrolling with one finger works fine but touch pad conditioning kicks in again here: I tend to try scrolling with two fingers.
  • There are no gestures for Exposé and Spaces. Would have been nice.

And it is flat. Almost too flat for my hands.
My conclusion is that Apple can always come up with interesting mouse concepts but still fails at actually building usable mice.

Contact Album Plug-In for Adium

Something for the Mac users this time. I have written a little plug-in for Adium recently.
It can be downloaded and installed from the Adium Xtras site.

The plug-in, called Contact Album, stores all the icons that your contacts use over time and comes with a viewer for the icons.

The Contact Album Viewer (click for larger view)

click for larger view

After installation of the plug-in, the album will slowly fill with icons as your contacts change them. You can open the album viewer with the Contact Album entry in Adium’s Window menu and with the View Album entry in the context menu for contacts.
Currently the plug-in comes with English, Dutch, Finnish, French, German, Portuguese, and Swedish localizations. Further translations are welcome.

Install the plug-in: Contact Album
Please note that the plug-in requires Adium 1.3 or newer and Mac OS X 10.5 Leopard.

Get the source code. It’s available under the GNU General Public License, version 2.

Apple Praise

Here is a quick follow-up to my recent rant about Apple: After a few more emails and phone calls, I will be the proud owner of a MacBook Pro with a US keyboard soon.

I still don’t understand why it is so problematic to get a US keyboard from Apple as a German customer. Anyway, I am happy now!

Apple Rant

I want one of those new MacBook Pros.

I want one with a US keyboard!

Unfortunately Apple seems to be unable to provide US keyboards to European customers : (

The German webstore offers an International-English keyboard but that is different from US style keyboards: narrow Return key, additional key between left Shift and Z.

Several phone calls and emails didn’t help: No US keyboards for German users!

I never had this problem with other notebook manufacturers like Dell, Toshiba, and IBM. It can’t be that hard to put a different keyboard on that thingie when assembling it.

June 14th, 2007: Also read the follow-up to this post: Apple Praise : )