Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled

MediumLevel 1Automatedmacos

Description

Apple uses the Google Safe Browsing API to check for fraudulent websites and report them to the user attempting to visit one. Attackers use crafted web pages to social engineer users to load unwanted content. Warning users prior to loading the content enables better security.

How it is checked

Audit method: Shell command

shell

out=$(/usr/sbin/system_profiler SPConfigurationProfileDataType 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -E 'WarnAboutFraudulentWebsites' | /usr/bin/tr -d ' '

Expected output: WarnAboutFraudulentWebsites=1;

How it is fixed

Fix method: Guidance or infrastructure patch

Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.Safari 2. The key to include is WarnAboutFraudulentWebsites 3. The key must be set to: <true/>

Properties

Operating systems: macos-14
Tags: macossonoma
Reference: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 6.3.3 Ensure Warn When Visiting A Fraudulent Website in Safari Is Enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target macos