Click image to embiggen.

Security researcher Jeremiah Grossman discovered a security vulnerability that could give any website the ability to steal user information from Safari's AutoFill feature that grabs user information from Address Book on the Mac. Apple countered Grossman by releasing Safari 5.0.1 that supposedly corrected the issue, but Grossman has found another potentially dangerous way to grab user information from Apple's flagship web browser.

To get the user information, Grossman setup a "game" whereby the user needed to type a "U" to jump. When the user typed the U, the text was placed in the country field, telling Safari to go ahead and automatically fill out the entire form with personal user information, including first name, last name, city, state, email, phone, street, country, and the zip (or postal) code.

"To perform our attack requires tiny bit of end-user trickery. Two button presses to be precise. A malicious website detects (ie: IP address) the country the victim is from. For our purposes here we'll assume the "US." The attacker invisibly (CSS transparency) sets up the aforementioned form and forces the keystroke focus into the country element. Notice how this is done in the video on the right side of the screen, which only visible for demonstration purposes. Next the attacker entices the victim to type "U" (first character of "US") and then press "TAB." And BAM! That's it! Data stolen," says Grossman on his blog.

Grossman also posted a video showing the exploit in progress, which you can find on his post.

Apple has yet to address this potential exploit, but with any vulnerability like this, you can always combat the problem by turning off the affected feature. By disabling the AutoFill feature in Safari, you are essentially killing this hack. You can disable AutoFill by navigating to Safari > Preferences > AutoFill and unchecking the box labeled "Using info from my Address Book card."

via MacRumors

Follow this article's author, Cory Bohon on Twitter.