LONDON – A security researcher is asserting that Apple has made a poor security decision by allowing its Safari browser to honor requests from third-party applications to perform actions such as making a phone call without warning a user.

Safari, like other browsers, can launch other applications to handle certain URL protocols. These might be in clickable links, or in embedded iframes.

An iframe containing a URL with a telephone number, for example, will cause Safari to ask if the user wants to make a phone call to that particular number, wrote Nitesh Dhanjani, a security researcher, on the SANS Application Security Street Fighter blog. Users can tap a button to make or cancel the call.

But Dhanjani found that behavior changes in some cases. For example, if a user has Skype installed and stays logged into the application, Safari does not give an alert when it encounters a Skype URL in an iframe, and immediately starts a Skype call, he said.

“In this case, Safari throws no warning, and yanks the user into Skype which immediately initiates the call,” Dhanjani wrote. “The security implication of this is obvious, including the additional abuse case where a malicious site can make Skype.app call a Skype-id who can then uncloak the victim’s identity (by analyzing the victim’s Skype-id from the incoming call).”

Dhanjani said he contacted Apple about the issue. The company said that third-party applications should be coded to ask permission before performing a transaction. But in the current arrangement, third-party applications can only ask for authorization after a person has been “yanked” out of Safari and the application has been fully launched, Dhanjani wrote.

“A solution to this issue is for Apple to allow third-party applications an option register their URL schemes with strings for Safari to prompt and authorize prior to launching the external application,” Dhanjani wrote.

He posed the question of whether Apple — which maintains a fairly strict auditing of third-party applications — should also check the URL strings before the applications are allowed to be distributed through its App Store.

“After all, Apple is known to reject applications that pose a security or privacy risk to their users, so why not demand secure handling of transactions invoked by URL schemes as well?” Dhanjani wrote.

There are many other third-party applications that register URL schemes that pull a user out of Safari without any interaction.

It is possible to look at the URL schemes allowed by the iPhone and iPad on a device that has been jailbroken. But Dhanjani said it might be good to allow people to take a look at those URL schemes, since it “will help keep the application designers disciplined the same way the user location notification in iOS does. This will also make it easier for enterprises to figure out what third-party applications to provision on their employee devices based on any badly designed URL schemes that may place company data at risk.”

“Third party developers, including developers who create custom applications for enterprise use, need to realize their URL handlers can be invoked by a user landing upon a malicious website and not assume that the user authorized it,” Dhanjani wrote.

Apple could not be immediately reached for comment.

By Steven J. Vaughan-Nichols
June 15, 2010

By Jeremy Kirk
April 13, 2010

By Rick Broida
February 4, 2010

By Tony Bradley
January 6, 2009

SAN FRANCISCO – In the most recent Web browser market share statistics from Net Applications, Google’s Chrome Web browser sneaked past Apple’s Safari to claim third place. The ascent up the market share ladder is more impressive when you consider that Chrome has only been around a little over a year.

Chrome’s 0.7 percent jump from November to December can probably be attributed to the beta versions of the Chrome Web browser for Mac OS X and Linux finally being released. Google also gave Windows users more reason to switch to Chrome with the release of expanded features and functionality for the Windows version of Chrome.

Chrome was marching pretty steadily up the chart even before the recent releases, though. Since January of 2009, Internet Explorer’s share of the pie has dropped just over seven percent. That seven percent has been snapped up primarily by Firefox and Chrome, with Chrome making the biggest jump of them all. Chrome has increased over three percent since January, more than tripling its share of the Web browser market in under a year.

Google is virtually synonymous with Web surfing, so it stands to reason that Google should know a thing or two about how to optimize the Web surfing experience. The Chrome Web browser is not a revolutionary shift from other browsers like Internet Explorer or Firefox, but the incremental improvements are enough to make it worth taking a look at.

The one thing Chrome offers that all users want is speed. Time after time since its release Chrome has come out on top in tests that compare the speed at which the different Web browsers are able to load pages. The difference in time may be mere milliseconds, but for hardcore Web surfers those milliseconds add up, and faster page loading equates to less frustration and stress.

As with all statistics, these can be taken with a grain of salt. Finnish tech site Afterdawn.com claims that recent statistics for users that visit its sites put Firefox on top with just over 42 percent, Internet Explorer in second place just under 40 percent, and Chrome strongly in third with almost nine percent. That is a more tech-oriented site with a much smaller sampling, though, than the statistics compiled by Net Applications.

What does all of this mean to you? Well, nothing really. At nearly 63 percent of the browser market, Internet Explorer still holds a dominant position even though it has lost a significant chunk in 2009. The real battle is still between Internet Explorer and Firefox–a distant second with less than half of Internet Explorer’s stake…at least for now.

The success of Windows 7, which comes with Internet Explorer 8 pre-installed as the default browser (except within the European Union where Microsoft is providing users with a choice of browsers as part of a settlement to avoid antitrust litigation) may help curb Microsoft’s eroding share of the browser market.

As I mentioned above, though, Chrome is a rapidly rising competitor. Google’s reputation and presence on the Web will contribute to the continued growth of the Chrome Web browser, as will Google’s various endeavors, including the Chrome operating system expected to be released before the 2010 holiday shopping season.

Firefox has been climbing as well, and has five times the share of the Chrome Web browser, but Firefox has also been around for more than five years. Odds are fair that Chrome will pass Firefox and steal second place long before either of them threaten to pass Internet Explorer.

The Firefox Web browser is fast approaching its billionth download and is likely to hit that milestone some time on Friday.

Mozilla has a Web site and a Twitter feed where people can keep track of the total. On Thursday afternoon, the feed showed more than 999,180,000 downloads, with about 15 more happening each second.

Mozilla said initially that it expected to hit the billion mark some time over the weekend. An hour later, as the news trickled out and the pace of downloads increased, Mozilla revised its estimate to Friday. An enthusiast Web site with a “Firefox Download Guesstimator” predicts it will reach a billion on Friday at noon GMT.

The figure includes all versions of Firefox since the first release in 2004. If a single user downloaded multiple copies for different computers, they are each counted in the total. And if a user goes to the Web site to download an update to an existing version, instead of waiting for the automatic download, that is counted as well. Automatic updates are not included in the total.

So the figure does not mean that 1 billion people are using Firefox. Still, it’s a significant achievement for a piece of software that was unknown to most of the world just a few years ago, and one that has had to compete with Microsoft‘s Internet Explorer, which ships free with every Windows PC.

Figures from earlier this month showed Firefox having just under a third of the global browser market, at 31%. Internet Explorer led the field with 60%, while Safari, Chrome and Opera each had less than 5%, according to Statcounter.

Firefox is stronger in Europe, where it has 40% of the market to IE’s 47%. In Asia, Firefox has 23% to IE’s 72%. In Antarctica, Statcounter says, the browsers are neck and neck.

Mozilla plans to launch a Web site Monday, at www.onebillionplusyou.com, where it will provide more information on the achievement.