Widgets—those fun, graphic little applications that bring things like clocks and calculators to your desktop—are all plagued with lousy security and stand ready to unleash the next wave of malware onto users' systems, according to new research.
The security holes in these applications already have opened up: Microsoft's MS07-048 advisory, put out on August's Patch Tuesday, addressed a vulnerability in Vista's Feed Headlines Gadget that could have let in malicious RSS feeds or links. Apple, of Cupertino, Calif., patched its WebKit browser engine in June. WebKit serves as an engine not only for Safari but also for Dashboard—a set of widgets that delivers real-time weather, stock tickers, flight status and other information.
ADVERTISEMENT
Now Finjan is reporting that new attacks exploiting widget and gadget insecurities in all types of environments—including operating systems such as Vista, third-party applications and Web widgets—are imminent and that the only thing that will stop the mayhem is a revised security model.
