Ensure Automatic Opening of Safe Files in Safari Is Disabled

СреднийУровень 1Автоматическаяmacos

Описание

Safari will automatically run or execute what it considers safe files. This can include installers and other files that execute on the operating system. Safari evaluates file safety by using a list of filetypes maintained by Apple. The list of files include text, image, video and archive formats that would be run in the context of the OS rather than the browser. Hackers have taken advantage of this setting via drive-by attacks. These attacks occur when a user visits a legitimate website that has been corrupted. The user unknowingly downloads a malicious file either by closing an infected pop-up or hovering over a malicious banner. An attacker can create a malicious file that will fall within Safari's safe file list that will download and execute without user input.

Как проверяется

Метод проверки: Команда оболочки

shell

out=$(/usr/sbin/system_profiler SPConfigurationProfileDataType 2>/dev/null) || exit 1
printf '%s\n' "$out" | /usr/bin/grep -E 'AutoOpenSafeDownloads' | /usr/bin/tr -d ' '

Ожидаемый вывод: AutoOpenSafeDownloads=0;

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Profile Method: Create or edit a configuration profile with the following information: 1. The PayloadType string is com.apple.Safari 2. The key to include is AutoOpenSafeDownloads 3. The key must be set to: <false/>

Свойства

Операционные системы: macos-14
Теги: macossonoma
Источник: CIS Apple macOS 14.0 Sonoma Benchmark v3.1.0 - 6.3.1 Ensure Automatic Opening of Safe Files in Safari Is Disabled

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target macos