Apple Safari 15 bug can leak your browsing activity, personal data

41

San Francisco, Jan 17 | A software bug in Apple browser Safari 15 may let any website track your internet activity and even reveal your identity via macOS, iOS and iPadOS 15, according to a new report. The bug could also expose your Google User ID to other websites.

In this case, private mode viewing in Safari 15 browser is also suspected to be affected by the vulnerability.

FingerprintJS, a browser fingerprinting and fraud detection service, found that the bug stems from an issue with Apple’s implementation of IndexedDB, an application programming interface (API) that stores data on your browser.

“IndexedDB is a browser API for client-side storage designed to hold significant amounts of data. It’s supported in all major browsers and is very commonly used,” FingerprintJS said in a statement.

The report said that more than 30 websites interact with indexed databases directly on their homepage, without any additional user interaction or the need to authenticate.

“We suspect this number to be significantly higher in real-world scenarios as websites can interact with databases on subpages, after specific user actions, or on authenticated parts of the page,” said the FingerprintJS team.

Like most modern web browser technologies, IndexedDB is following the same-origin policy.

The same-origin policy is a fundamental security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from other origins.

For example, if you open your email account in one tab and then open a malicious webpage in another, the same-origin policy prevents the malicious page from infecting your email.

“In Safari 15 on macOS, and in all browsers on iOS and iPadOS 15, the IndexedDB API is violating the same-origin policy,” FingerprintJS said.

Every time a website interacts with a database, a new (empty) database with the same name is created in all other active frames, tabs, and windows within the same browser session.

Windows and tabs usually share the same session, unless you switch to a different profile, in Chrome for example, or open a private window.

This means other websites can see the name of other databases created on other sites, which could contain details specific to your identity.

FingerprintJS reported the leak but there hasn’t been an update to Safari yet.

“The fact that database names leak across different origins is an obvious privacy violation. It lets arbitrary websites learn what websites the user visits in different tabs or windows,” they said.

Source: IANS

Next Story

Share Market Closing Bell: Market ends marginally lower amid volatility

Share Market Closing Bell: Market ends marginally lower amid volatility

Dalal Street witnessed tug of war between bulls and bears as Sensex settled at 54208.53 losing 109 points or 0.20 percent and Nifty ended at 16240.30 with loss of 19 points. Bank nifty closed the session at 34163.70 levels with loss of 138 point after erasing early session gain.

BSE Midcap and BSE Small cap indices turned flat after rising around half a percent each. On the sectorial front, Nifty Pharma and FMCG have contributed a percent each on a closing basis. On the flip side Nifty Realty, Nifty PSE ended with losses of 1.75 percent and 1.73 respectively. In Nifty stocks, TATACONSUM, CIPLA and ADANI PORT were the top gainers while POWERGRID, BPCL and TECHM were the prime laggards.

In the daily chart Nifty has ended with a bearish candle. However 16200 levels are protected throughout the day. Index might face high volatility on weekly expiry day. Riding against the trend may not be beneficial for short term traders. According to volume profile 16100 and 16000 may act as immediate support.

Indicators such as MACD and RSI are still struggling to overcome from oversold zone in the daily time frame. From the time cycle prospect Index would remain highly volatile till 27th May of this month. Bollinger band indicates 16650 would remain strong resistance in coming days. On the other hand, Bank nifty has support at 33400 levels while resistance at 35000 levels.

Om Mehra
Research Associate
Choice Broking

Source: Choice India

LEAVE A REPLY

Please enter your comment!
Please enter your name here