Welcome to the MacNN Forums.

CharlesS · Jan 9, 2003, 03:47 PM

When I downloaded the Safari DMG from Apple and mounted it, it automatically copied the contents of the image to the folder the DMG was in and then unmounted the DMG. When I downloaded the X11 installer, it automatically ran the install mpkg on the image after mounting the image.

How are they doing this, and does this mean that DMG's now have the option to automatically launch something or run a script on mount? If so, this seems like it could be used to do some nasty AutoStart-9805 type things...

Eug · Jan 9, 2003, 04:16 PM

And I thought it was just a feature I missed all along. I thought I was going crazy...

Art Vandelay · Jan 9, 2003, 04:20 PM

Hopefully, it's just a pref to copy the contents to the local folder, not an autorun script which can be dangerous.

DeathMan · Jan 9, 2003, 04:24 PM

I think there is a preference in safari that says to launch "safe" files after download.

Guy Incognito · Jan 9, 2003, 04:34 PM

Originally posted by DeathMan:
I think there is a preference in safari that says to launch "safe" files after download.

That's my guess too...and I'm guessing the 'Apple' DMG are all considered safe (via some means I don't quite understand).

Let's hope Apple's DMG files are all safe...I remember a certain iTunes 3 fiasco.

Millennium · Jan 9, 2003, 04:39 PM

Originally posted by DeathMan:
I think there is a preference in safari that says to launch "safe" files after download.

There is, but the Safari disk image itself also shows its behavior, and most of the people who download that aren't using Safari (that being the whole point of downloading it).

No, unfortunately this is more likely to be some kind of a auto-run mechanism embedded in the DMG's themselves. And here I hoped Apple would have learned its lesson the last time they tried that...

Developer · Jan 9, 2003, 04:42 PM

At least the Installer showed a warning before using the Safari package.

They're kind of scary though. Who knows what other secret features are hidden inside Jaguar's Disk Copy.

CharlesS · Jan 9, 2003, 04:44 PM

I really hope that Apple provides a way to disable this in the future. I would really pissed if I mounted a DMG only to have its auto-run script do an rm -rf / and delete every file I have write access to on the drive.

wataru · Jan 9, 2003, 04:46 PM

Originally posted by DeathMan:
I think there is a preference in safari that says to launch "safe" files after download.

No, that's unrelated. As Millenium mentioned, Safari itself did this. Also, the recent iCal updates and iSync 1.0 did similar things. This is definitely a new (or at least previously unused) feature of Disk Copy.

BTP · Jan 9, 2003, 04:52 PM

I'm glad you pointed this out, as I wasn't paying attention and wondered why the Safari app was on the desktop.

I'll have to pay more attention in the future.

Guy Incognito · 05:06 PM

Originally posted by CharlesS:
I really hope that Apple provides a way to disable this in the future. I would really pissed if I mounted a DMG only to have its auto-run script do an rm -rf / and delete every file I have write access to on the drive.

That's why you never run as root.

And if you're stupid enough to type in your password when prompted to install something that you don't know should be trusted...you lose.

...wait a minute...OMG, OMG, OMG a 256kb Doom3.dmg is out. I gotta install this wicked game right away!

himself · Jan 9, 2003, 05:06 PM

What happened with Safari and other DMG's (automatically unencoding, mounting, copying contents, and dismountinng the image) isn't actuallly installing , it's just copying a file automatically. If it were to install automatically, it would have to ask for authorization first, which adds some level of security. Even in the case of the iCal update, the download copied a package to the desktop, and that had to be installed on its own. I think it won't be that easy for this mechanism to be used in a malicious manner, unless you're pretty lax about the downloads and installers you grant authorization to.

Myself, I think it's a pretty cool Apple-like (meaning easy, convenient) feature.

CharlesS · Jan 9, 2003, 05:30 PM

Originally posted by Guy Incognito:
That's why you never run as root.

And if you're stupid enough to type in your password when prompted to install something that you don't know should be trusted...you lose.

...wait a minute...OMG, OMG, OMG a 256kb Doom3.dmg is out. I gotta install this wicked game right away!

You don't need to run as root for that command to be able to delete:

your Applications folder
your root-level Library folder
your User folder
anything else you've put on your hard drive as your current user

You know, that's kind of why I said it would delete every file I had write access to rather than every file on the drive.

BTW, thanks for calling me stupid.

BlackGriffen · Jan 9, 2003, 05:33 PM

I'd still like to be able to turn it off...

Seeing as how I cannot right now, a feedbacking I will go!

BlackGriffen

BlackGriffen · Jan 9, 2003, 05:42 PM

Also, did anyone else notice how iCal.dmg was erased after mounting? I certainly hope that the mount scripts are only permitting to erase the .dmg file, and not arbitrary files...

BG

Rickster · Jan 9, 2003, 06:02 PM

Dissection of some of these new DMGs hasn't been very enlightening thus far. But Apple alluded to these features at WWDC last spring, and it sounds like they're conscious of the security issues. The way they presented it, it sounds like DMG auto-actions can only be some very specific things -- copy this to there, or open this package in Installer, trash the DMG afterward, etc. -- which is much better than being able to auto-run any script or executable on the DMG.

Guy Incognito · Jan 9, 2003, 06:04 PM

Originally posted by CharlesS:
BTW, thanks for calling me stupid.

I didn't...I was making a generalization. Maybe I should have written "One would be stupid..."...I guess you're a touchy guy.

trusted_content · Jan 9, 2003, 06:13 PM

So what happened with the iTunes 3 DMG? sounds like an interesting story!

DeathMan · Jan 9, 2003, 07:02 PM

iTunes had a nasty habit of erasing your hard drive if it didn't like the way it was named. Doh.

Look up "iTunes erase" in the search here, or on google.

I knew that I didn't know what I was talking about, when I wrote my previous comment. I did notice that safari was just all of a sudden on my desktop. I was wondering about that. that could be nasty, if someone got creative about it.

Art Vandelay · Jan 9, 2003, 07:03 PM

Originally posted by Rickster:
Dissection of some of these new DMGs hasn't been very enlightening thus far. But Apple alluded to these features at WWDC last spring, and it sounds like they're conscious of the security issues. The way they presented it, it sounds like DMG auto-actions can only be some very specific things -- copy this to there, or open this package in Installer, trash the DMG afterward, etc. -- which is much better than being able to auto-run any script or executable on the DMG.

It looks like my guess was right.

Hopefully, it's just a pref to copy the contents to the local folder, not an autorun script which can be dangerous.

Art Vandelay · Jan 9, 2003, 07:05 PM

Originally posted by trusted_content:
So what happened with the iTunes 3 DMG? sounds like an interesting story!

That was iTunes 2, IIRC. Also, it was the .pkg installer, not the .dmg.

Art Vandelay · Jan 10, 2003, 03:40 AM

If you watch the "Power of X" presentation stream available at Apple, they mention these new images (at about 52:00). They are Internet Disk Images. It is a new image format available in Disk Copy 10.2.3 in OS X 10.2.3. It definitely sounds like all they do is copy their contents to the local directory and unmount.

I didn't see this new option in Disk Copy, but it is probably available from the command line tools.

clebin · Jan 10, 2003, 06:36 AM

Originally posted by Guy Incognito:
I didn't...I was making a generalization. Maybe I should have written "One would be stupid..."...I guess you're a touchy guy.

Why don't you just apologise and be done with it?

OwlBoy · Jan 10, 2003, 07:04 AM

Originally posted by Art Vandelay:
If you watch the "Power of X" presentation stream available at Apple, they mention these new images (at about 52:00). They are Internet Disk Images. It is a new image format available in Disk Copy 10.2.3 in OS X 10.2.3. It definitely sounds like all they do is copy their contents to the local directory and unmount.

I didn't see this new option in Disk Copy, but it is probably available from the command line tools.

Yes thats what happens.

-Owl

undotwa · Jan 10, 2003, 08:52 AM

Originally posted by Guy Incognito:
I didn't...I was making a generalization. Maybe I should have written "One would be stupid..."...I guess you're a touchy guy.

No I think you're a bastard. Don't say things unless you're sure about them.

And your comment was clearly directed at him.

Guy Incognito · Jan 10, 2003, 09:14 AM

Originally posted by undotwa:

And your comment was clearly directed at him.

No...but here's a comment that *is* clearly directed at you...

"Eat sh!t!"

Guy Incognito · Jan 10, 2003, 09:14 AM

Originally posted by clebin:
Why don't you just apologise and be done with it?

How about...no!

diamondsw · Jan 10, 2003, 10:25 AM

Originally posted by Millennium:
There is, but the Safari disk image itself also shows its behavior, and most of the people who download that aren't using Safari (that being the whole point of downloading it).

No, unfortunately this is more likely to be some kind of a auto-run mechanism embedded in the DMG's themselves. And here I hoped Apple would have learned its lesson the last time they tried that...

This "feature" showed up in 10.2.3 I believe, and one of the iCal updaters (I think 1.0.1) exhibited it. Freaked me out at first.

I don't know what triggers it, but it worries me.

diamondsw · Jan 10, 2003, 10:29 AM

Originally posted by Guy Incognito:
How about...no!

Thank you for increasing your post count by ruining yet another thread.

Art Vandelay · Jan 10, 2003, 01:54 PM

Originally posted by diamondsw:
This "feature" showed up in 10.2.3 I believe, and one of the iCal updaters (I think 1.0.1) exhibited it. Freaked me out at first.

I don't know what triggers it, but it worries me.

Read my post above. It is the new Internet Disk Image format. Until someone who knows can confirm this, it appears that all it does is have Disk Copy copy the contents to the local folder. There isn't an autorun script. So, there shouldn't be any worries of someone attaching a malicious script to these.

Graymalkin · Jan 10, 2003, 02:33 PM

If you want to strip the internet-enable functionality of a DMG you can use hdiutil to do so. Internet-enable is just a plug-in for DC.

To strip the internet-enable functionality from a DMG enter this into the command line:

hdiutil internet-enable image name -no

You can check DMGs for internet-enable with:

hdiutil internet-enable image name -query

Replace the -no flag with a -yes flag to obviously turn a DMG into an internet-enabled one, you can also use -srcimagekey, -encrytpion, -passphrase, -verbose, and -quiet flags to work with images.

JB72 · Jan 10, 2003, 03:55 PM

Well for some reason I can't mount the iCal 1.02 image I just d/l'd. I wonder if it's related to the changes made. Arggg.

Guy Incognito · Jan 10, 2003, 04:37 PM

Originally posted by diamondsw:
Thank you for increasing your post count by ruining yet another thread.

And thank you for doing the same.

CharlesS · Jan 10, 2003, 05:25 PM

*ignoring Guy Incognito*

Originally posted by Graymalkin:
If you want to strip the internet-enable functionality of a DMG you can use hdiutil to do so. Internet-enable is just a plug-in for DC.

To strip the internet-enable functionality from a DMG enter this into the command line:

hdiutil internet-enable image name -no

You can check DMGs for internet-enable with:

hdiutil internet-enable image name -query

Replace the -no flag with a -yes flag to obviously turn a DMG into an internet-enabled one, you can also use -srcimagekey, -encrytpion, -passphrase, -verbose, and -quiet flags to work with images.

Thank you! This is exactly what I wanted to know. Using these commands I have turned a normal DMG into an Internet-enabled DMG and verified that it is indeed a simple file copy and not an auto-run script, and I feel much better about this now. Thanks!

Now, to figure out why the X11 download launches the installer automatically. I notice that it only happens when I download the file with Safari, and that it doesn't seem to occur when I download it with Chimera or when I mount the disk image manually, so it appears to be a Safari feature. Is this feature limited to launching package installers, or can it launch any arbitrary file on the image? If the latter, is there any way to turn it off? Disabling the 'open "safe" files after downloading' stops the behavior, but it also stops mounting of the image entirely.