6.3 Disable the automatic run of safe files in Safari

Information

Safari will automatically run or execute what it considers safe files. This can include installers and other files that execute on the operating system. Safari bases file safety by using a list of filetypes maintained by Apple. The list of files include text, image, video and archive formats that would be run in the context of the OS rather than the browser.

Rationale:

Hackers have taken advantage of this setting via drive-by attacks. These attacks occur when a user visits a legitimate website that has been corrupted. The user unknowingly downloads a malicious file either by closing an infected pop-up or hovering over a malicious banner. An attacker can create a malicious file that will fall within Safari's safe file list that will download and execute without user input.

Impact:

Apple considers many files that the operating system itself auto-executes as 'safe files.' Many of these files could be malicious and could execute locally without the user even knowing that a file of a specific type had been download.

Solution

Perform the following to implement the prescribed state:

Open Safari

Select Safari from the menu bar

Select Preferences

Select General

Uncheck Open 'safe' files after downloading

Alternatively run the following command in Terminal:

defaults write com.apple.Safari AutoOpenSafeDownloads -boolean no

See Also

https://workbench.cisecurity.org/files/3092

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(3)

Plugin: Unix

Control ID: fcd7eb79ed449cf4be53c94c72d9087b94a17fa7c3267e20f4bfc33023b7c29f