One of the more notorious problems you might run into when using a computer is a browser hijacking attack, where stumbling upon a maliciously crafted Web site will result in an alert being repeatedly displayed, regardless of how many times you try to close it. While you might resort to force-quitting Safari to overcome this problem, with Apple’s “Resume” feature in OS X, when you re-launch the browser your Web pages will load again, resulting in the same frustrating behavior.
The classic approach to fixing this issue is to remove the saved window state of Safari, which can be done by manually trashing the saved application state folder for Safari from your user library, or by launching Safari with the Shift key held down. The problem with this is that the rest of your workflow will be closed, which can be frustrating if you had many windows and tabs open. Granted you can use options in the History menu to re-open windows from the last session, but this may open the malicious Web page and have you back where you started.
Until recently, there has not been much anyone could do to avoid these Web-based attacks, and since they cannot do much harm besides being annoying, there has been some level of resignation to their existence and recommendation to use good computing practices. These include avoiding clicking unsolicited e-mail links, popup ads, and accepting other obvious spam offerings.
At its core, this issue comes from how browsers have classically handled Javascript alerts–a feature intended for brief use to notify a user of a problem or quick result, and then be dismissed. Unfortunately, Javascript alerts demand user feedback (clicking an OK button, or otherwise) before they will close, and in the mean time all other browser functions become inaccessible. By simply looping a Javascript alert, you can cause this problem to occur, and it can be done with essentially beginner knowledge of the Javascript language.
Sequential alerts from the same Web page will show this option, to dismiss any additional alerts and thereby save your browser from a Javascript hijack attack.
Despite this setback that has affected most browsers, in the latest versions of Safari, Apple has included an easy solution to this problem. With a small tweak to the Javascript runtime in Safari, if a page displays Javascript alerts in rapid succession, the alerts will include a checkbox that offers the option to stop showing alerts from the current page. This will effectively kill the hack, and allow you to close the offending page.
Note that there is a caveat to this, which requires you also have Safari’s option to block popup windows enabled (toggled in its Security preferences). Without this feature enabled, a Javascript alert attack could trigger Safari to open the current page in a new window, resulting in another instance of the page triggering the same error, so by clicking the “OK” button to dismiss the problem, you will be flooded with new windows and alert boxes. Even with the option to prevent additional alerts from these pages, you may still find that a crafty page could continue to burden you in this manner, but by disabling popup windows, and by installing the latest versions of Safari on your Mac, you will effectively shut down this frustrating Javascript hack.
Be sure this option in Safari’s Security preferences is checked, to prevent pages from issuing the same Javascript error.
As of this writing, the latest version of Safari is version 9.0, which is available as a public beta version for testing. This can be obtained by enabling pre-release software in the App Store system preferences, and then checking for updates in the App Store. Overall, simply keeping Safari and OS X up to date should make these options available to you.
If you care to test your current browser, clicking the following button will load two alerts from this page, the second of which will have the checkbox to prevent additional alerts if your version of Safari supports this feature. If not, then consider looking into updating Safari.
