Badware Threat Changes Apple's Tune on Safari
In response to mounting criticism from security and privacy experts, Apple has changed the way its Software Update program pushes out the Safari Web browser to Windows users. But the changes may not go far enough for many people because the browser is still being disguised as a security update.
Cupertino has long used the The Apple Software Updates to deploy iTunes and QuickTime patches to Windows users. Not long ago, however, Apple also began offering Safari in the same window. This ignited a firestorm of protest from users and bloggers. Even tech policy groups jumped into the fray: Stopbadware.org -- an organization that includes tech thought leaders from Harvard, Oxford as well as sponsors like Google and Sun Microsystems - threatened last week to slap a "badware" label on Apple's updater. Stopbadware noted that not only was the practice misleading, but Apple's updater didn't even include a license agreement or privacy policy.
Apple responded by patching its updater with a new one that now includes a license agreement and privacy policy. It also slightly modified how Safari is now offered, by placing it in a box separate from security updates labeled "new software."
I have previously chided Apple for using security updates as a means to cajole users into paying for product upgrades for things like QuickTime Pro. But using applications designed for rolling out security updates to gain a foothold in the browser war strikes me as a foolhardy approach, one that is likely to discourage users from trusting Apple's update process going forward. That isn't good for Apple, and more importantly, it's a disservice to the end user.
By Brian Krebs |
April 23, 2008; 11:27 AM ET
From the Bunker
,
Misc.
,
New Patches
Previous: Obama Site Visitors Redirected to Clinton Campaign |
Next: Hannaford's Breach Tests Limits of Security Controls
Posted by: Doug Petrosky | April 23, 2008 12:17 PM
Doug, you're assuming that this was an honest mistake, not an attempt to increase their market share in the Browser Wars. I think that's a naive viewpoint, and Apple knew exactly what they were doing and what the reaction would be. The fact that they've moved it to an 'New Software' window but left it checked by default shows that the intent is still to 'trick people' into downloading Safari. I know several people who accidentally installed Safari before the hue and cry went up.
A security update program needs to be only a security update program, otherwise it's untrustworthy. Brian already pointed that out in his article. Even Microsoft knows better than to pull this sort of stunt. Safari is known to have a flaws, and is arguably one of the less secure browsers. At CanSecWest it was a flaw in the Safari browser that got the Mac Book Air compromised.
Calling this malicious might be extreme; calling it manipulative and divisive would spot on. It's just another example of a business pushing the envelope to see what they can get away with.
Martin McKeay
http://www.mckeay.net
Posted by: Martin McKeay | April 23, 2008 12:45 PM
So, uncheck it and don't download it if you don't want it. People are savvy enough to see this straightforward option. You would think this was a Florida ballot or something.
Posted by: JJIrons | April 23, 2008 12:51 PM
What a fuss! Apple should carry on with the practise, after all Safari is the fastest, most standards compliant browser in the world. Why turn down an offer of free software of that quality?
It should be on every Windows computer.. But of course the Windows Stazi ensure it won't be.
Don't pander to them Bryan.
Posted by: Jon T | April 23, 2008 1:03 PM
And by the way Martin McKeay above, a Mac was indeed recently hacked via Safari, but that is now totally irrelevant, because 1) Apple has fixed it already, and b) there simply is no culture of viruses on Macs.
To argue that Safari is less secure than Internet Explorer is the joke of the year!
Posted by: Jon T | April 23, 2008 1:09 PM
I already put off Apple updates for as long as possible due to a long history of junk like this. Every single Quicktime update always overwrites my previous settings, reinstalls crap icons all over the desktop and system tray, changes file associations, etc. It's like they intentionally make a simple update as painful as possible.
Posted by: Adam | April 23, 2008 1:20 PM
Characterizing the function of Apple Software Update as being for only "security updates" is just wrong. Security is only one of many reasons new software is offered through the utility. The separation of updates vs. new software in the interface is a good move. If Apple unchecked the new software download box by default, there would be no more basis for argument.
Posted by: Logical Extremes | April 23, 2008 1:34 PM
Now, if Apple could only make separate update categories for QuickTime and iTunes.
Posted by: umm.huh | April 23, 2008 2:23 PM
Let's face it - if it winds up on your machine and you didn't want it, it's crapware regardless of who makes it and how good it is. Brian's right. When you visit the Windows Update website you can see exactly how much crap you DON'T get from Redmond because they've touched this stove enough to learn that this is a bad practice. As much as I like them, Apple should back-off.
Posted by: OhioMC | April 23, 2008 2:39 PM
Oh wait, I'm sorry! How the "F" is this different than Google, AOL, Yahoo, Adobe, etc., etc., etc., that dupe people into installing 5,000 toolbars in IE and MS office? PLEASE tell me. Oh, wait I know, it's APPLE! I get it! Please. grow up. I get more of this stuff than I can count on my work PC and it's a pain to get rid of. At least with Safari I NEVER need to open it. This other stuff suddenly appears in my browser or Office toolbar and I need to work to get rid of it. You want something to whine about?!?! Go after these guys that insert little things as part of a download for something else that if you're not careful and click through get more than you bargained for.
Oh wait, why bother, it's not Apple and won't give you the page counts!
What was I thinking!
Posted by: Jeffsters | April 23, 2008 3:16 PM
And let's not forget the sneaky way Microsoft used to get people to install Windows Genuine Advantage, a euphamism for anti-piracy software meant only to enhance their bottom line. What on earth did WGA have to do with the so-called serious security enhancements line that MS used to trick everyone???
Posted by: RidgeP | April 23, 2008 3:18 PM
Got tired of it, wiped Quicktime and the Apple Updater off my system. No more problems here with worrying about keeping the latest Quicktime Exploit from being an issue. Despite the fact I have a Mac sitting on the desk next to this machine and use it for a lot of stuff, I will get flack from Apple apologists for the following.
Sorry, Safari due to security flaws is not ready for the real world on Windows systems. It may be ok for the BSD Unix variant that Apple uses for OS-X, but it has not been tested out enough to make it safe on the Microsoft Windows environment.
Posted by: Sean | April 23, 2008 3:41 PM
All of you Windoze fanbois like Krebs and Maynard, etc... ad nauseum, are simply freaking out over nothing. Well, not nothing, you are freaking out that Apple is taking your marketshare and your reputation as wintards and tossing it in the toilet. This is not even a drop in the bucket compared to the bundling practices of your beloved (and beleagured) Microsloth. Get over it, indeed.
Find a way to write something constructive about Microsoft, they could use a little help about now.
Posted by: Brian | April 23, 2008 4:35 PM
For those pointing a finger at Microsoft, two wrongs do not make a right. Pointing to past bad behavior does not excuse current bad behavior. You're only displaying your own hypocrisy.
Apple is doing things that Microsoft used to do. And they (Microsoft) took serious heat for it, learned from it and made the required changes. So it's rather amusing to watch Apple follow those same missteps. I've said it before, Apple is where Microsoft used to be years ago. But that's ok, apparently there is no such thing as a bad Apple!
Even those at SANS believe this is bad form by Apple.
http://isc.sans.org/diary.html?storyid=4313
Posted by: TJ | April 23, 2008 5:24 PM
You have to be really stupid if you can't read what is said "New Software". If your that stupid then too bad.
Microsoft has had you all bent over taking it with a wire brush for decades and you just keep running the virus malware worm operating system. If you had a brain you'd already be running a Mac. Only the stupid qualify for the level of abuse Microsoft constantly inflicts on their victims.
Posted by: Gwen Strakly | April 23, 2008 7:00 PM
1. safari isn't most standard compliant browser in the world, that would be opera.
2. apple didn't back off, sneaking a browser to users, still, cosmic changes does not cover the malicious practice
3. "stupid users logic" is itself stupid, if you can take care of users, then get out the way, safari doesn't even have a anti-phishing measure
Apple fanboys here are getting out of control.
Posted by: cris | April 23, 2008 10:19 PM
This is no different than Microsoft did with IE7. I had to uninstall IE7 after Windows Automatic Updates installed it for me. I didn't really look closely at the updates being provided.
You can set items in WinAutoUpdate to ignore so that they won't keep coming up. I found the same thing in the Apple Updater.
How more even can you get?
Posted by: Windows Techie | April 23, 2008 10:55 PM
Cris,
Check your facts before spouting off things your not up to date on. Safari and Opera are neck and neck in the Acid 3 standards test, with the nod to safari for having released code.
From slashdot
"Apple's Safari web browser and Opera have been duking it out in a race to pass the ACID 3 browser stress test. Both browsers have recently emerged with builds that reportedly pass the test.
The ACID 3 test is a test case designed by the Web Standards Project to give manufacturers a reference point and to help identify flaws in browsers. They simply create an extremely difficult test case with the idea that, if a browser can render the test, it should be able to handle almost any other page.
Where ACID 2 was designed to challenge a browser's page rendering skills, ACID 3 is aimed more at how a browser renders the DOM and handles Javascript.
According a post on the Opera weblog internal builds of Opera now pass ACID 3. As they say, "code or it didn't happen," and to that end the Opera teams says that a technical preview version will be available on labs.opera.com within the next week or so.
Safari 3 on the other hand does have Mac and Windows builds available that reportedly render ACID 3 correctly
While the race is very close, we have to give it to Safari since the code is available. But the point isn't who's first, the point is that both browsers are setting a very high bar with some impressive turnaround times. Both IE and Firefox have some catch-up work ahead of them."
Posted by: Safari Bests Opera | April 24, 2008 2:34 AM
Look, its called "Apple Software Update". People clicking on it who want to make sure their machines are up to date generally don't want to install new software. I think the fact that Apple have backtracked and moved the Safari installer to "New Software" is good. But it would be even better if -ONLY- those updates were ticked that actually install updates for software already on your system.
The iTunes + Quicktime update is very misleading. To update quicktime you never have to select this one, if there is actually an update for your version of quicktime there will be a separate update just solely for quicktime.
@cris ditto
Posted by: Stern | April 24, 2008 6:28 AM
I'm not an Apple fanboy. Far from it. Still, I feel compelled to point out that the argument laid out in this article is predicated entirely on the notion that the Apple Software Update tool is only for security updates. This is incorrect, and the author almost certainly knows it.
This, then, is the ultimate irony: by writing an article accusing Apple of malfeasance based on this false supposition, the author is guilty of the same dishonesty that he (erroneously) accuses Apple of.
Which is worse? Two wrongs don't make a right, but in this case only one party is actually being dishonest.
Posted by: notafanboi | April 24, 2008 11:01 AM
Nice linkbait!
Nowhere on the Apple SOFTWARE Update application does the app state its purpose is for security updates. SOME of the updates are for security. MANY are to patch the DRM.
Posted by: Pecos Bill | April 24, 2008 1:00 PM
Won't affect me a bit. I won't touch any of Apple's garbage
Posted by: Keith Warner | April 24, 2008 3:25 PM
All the Apple fan boys need to chill out. Sure I love my iPod but I hate their practice. First, I wish Quicktime was not bundled with iTunes and it's update. Secondly Firefox is hands down the best web browser and I have no need for Safari so it should not be included in a security update alert.
Posted by: Mike | April 25, 2008 2:05 AM
@Mike
Quicktime is not bundled with itunes. Not when downloading, not when updating. Apple just pretends it is in the updater.
If there is a quicktime update, it will be a separate item in apple software update and won't be bundled with itunes.
Posted by: Stern | April 25, 2008 9:30 AM
I don't think anyone cried "fowl", unless they were giving us "the bird".
Posted by: W Madden | April 25, 2008 4:19 PM
Doug:
It appears that you and the Cupertino gang ... have forgotten WHOSE computer it is.
Let me refresh your memory: I BOUGHT It! I PAID for It! I OWN It!
And I haven't granted anyone the license to make changes to it at will.
As G.W.Bush is wont to say: I AM the ULTIMATE DECIDER!
Understand ?
That being said, I decide what updates are loaded on to MY computer, and BY WHOM and WHEN!
If you or anyone else wants to install something on my computer, have the 'guts' and integrity to ASK me first if its OK.
I think your position on this issue, is born of laziness (on your part) and cowardice.
True, I don't know you; so I have to rely upon your words and deeds to reveal your character or lack thereof.
As for myself, I am a firm believer that if you don't stand up for your rights, you can kiss them goodbye.
The Cupertino gang can only get away with that which people (such as yourself) allow them to.
Posted by: T R Decklemyer | April 25, 2008 4:38 PM
Steve Jobs ought to have his head examined. His annoying downloader business should be tarred and feathered. They simply have to stop their absurd attempts to take over the known universe with half-baked software that fails to perform time after time and then fails at flailing.
Posted by: A. Puhl | April 26, 2008 7:59 AM
Interesting range of comments here! Especially got a laugh from all the "Apple is God" camp. I no longer have problems with Apple Updater. I don't use iTunes anyway, and I just replaced Quicktime with Quicktime Alternative. But to be fair to Apple, look at updates from Adobe, Java, et. al. and see how much junk is being pushed at you.
Posted by: slgrieb | April 27, 2008 12:10 PM
It is especially humorous to hear from people who can't read "software update" or "new software" or who complain that a POTENTIAL download is "pre-checked". If you don't want to download something, you do have TOTAL COMPLETE ABSOLUTE control over your own computer! Why would you download anything without fully understanding what you are doing? With the Apple updater, when you highlight a selection, it tells you specifically what you are about to download, or where to go for more details - take some responsibility for your own actions folks! On the Windows side, I have to guess that you are overly sensitive because of the crap that MSFT has eternally forced on you, and their pervasive security problems. When you grow up with an OS and software where you've had to make compromises on quality and security your entire life, I guess you can be cynical. It comes from living on the dark side... Don't knock a company who truly innovates, and who is overcoming insurmountable odds to provide users with better designed, easier to use, more powerful, more secure and clearly superior products.
Posted by: FreeRange | April 27, 2008 2:46 PM
Wait a minute. Microsoft has for years allowed it's operating system to be loaded with crapware with no user intervention needed and now Apple gets criticized about this?
To steal a phrase from a previous poster:
Windows ineptness won't bother be a bit. I won't touch any of Microsoft's garbage.
Posted by: John Thomas | April 27, 2008 6:45 PM
"I have previously chided Apple for using security updates as a means to cajole users into paying for product upgrades for things like QuickTime Pro."
I have been a Mac user since 1984 and have never seen anything of this nature. I always run updates.
As far as the person who had QT updates wiping out his prefs, you have a unique problem. Why share your, or your system's, shortcomings with the rest of us? The first time it happened should have told you something.
Credibility = 0.
Posted by: Ray | April 30, 2008 9:13 AM
If Steve Job and Apple ever decide to turn to the dark side and become a cult, the world is in trouble. Reading comments from their supporters defending Apple's "two wrongs don't make a right" sneaky approach to distributing Safari makes me wonder what would happen if Steve Job declare tomorrow that drinking Anti-Freeze fluid is the best thing for your health!
As people (mostly Apple cult fanboys since they are the only one that will drink the Kool-Aid) are rushed to the hospital to get their stomachs pump, I guarantee you that some of their supporters would complain that it's not fair to blame Apple since other cults had done similar things in the past...lol
Posted by: YourOSisNotYourReligion | May 9, 2008 12:21 AM
The comments to this entry are closed.










Get over it! This is like some politician making an unintended gaff and everyone making much more of it than it was. Apple views it's software update application as a way to distribute software, not as a security tool. Apple had some valuable software to distribute that was going greatly unnoticed and saw this as a way to get more people to download it.
You and everyone else crying fowl know that virtually nobody who actually was "tricked" into downloading the software will ever use the software. So it was not Apple's intent to "trick" people.
Now they have made it even more obvious but are still using the popularity of iTunes to advertise Safari and make it easy to load. As long as they don't get annoying with this I think it is a great idea!