gmailsteal_remote.scpt.txt

-- This script can be used to steal gmail's keychained password by injecting -- Javascripts into Safari. When executed it opens gmail's login page, reads -- saved password and sends it to a logging server by creating an hidden iframe -- into gmail's page. It can be easly modified to steal other...

Apple Safari on MacOSX may reveal user's saved passwords

hello, Apple Safari on Macosx may reveal user's saved passwords. A local user with legitimate access to the system is able to steal keychained password by injecting javascripts into a loaded webpage via applescript. It seems that safari fails to validate the source of injected code, however apple...