Companies struggle as Safari pops up on networks

Network administrators are complaining that Apple's recent decision to offer users its Safari Web browser as part of an iTunes and QuickTime update has made their lives harder as they struggle to remove the software from PCs on their networks.

For Cody Wilson, the trouble began a few weeks ago, when he noticed that Safari had popped up as a download option with his Apple Software Update, the program that is used to update iTunes and QuickTime.

Wilson, a network administrator with Soy Capital Bank and Trust in Decatur, Illinois, soon found out that many of the users on his network had installed the software without realizing it. "I went into work the next day and I scanned my network, and my inventory software said I have Safari on 30 PCs," he said.

Because of the way Apple had configured the update, anyone who clicked OK automatically installed the company's Web browser. Most users thought that Safari was simply a component of the Apple software they'd already installed, Wilson said.

"This is not good; this is a security risk," he said. "We're a bank."

Wilson said it has taken him the better part of a week to remove Safari from his network and prevent it from being reinstalled.

Susan Bradley agreed that the updates are creating a problem for administrators and making users less secure. "It impacts all of us when more potential attack surface is installed in a group of folks that are vulnerable enough as it is," said Bradley, who is CTO with Tamiyasu, Smith, Horn and Braun, Accountancy Corp.

On Friday, patch management vendor Shavlik Technologies announced that it had updated its Shavlik NetChk Protect software to detect and remove Safari.

Administrators may see more support calls from users who have installed Safari without realizing it, said Eric Schultze, chief technology officer with Shavlik. "I could see administrators saying, 'I approved a standard desktop image, now [Safari is] showing up. I need to remove it.'"

One poster to the Patchmanagement discussion list described the situation more bluntly.

"What's the difference between a malware spreading across a corporate environment and a nagging system tray icon that installs another insecure default browser," wrote the poster, who identified himself as Emin.