iTunes Security Flaw allowed Hacking for 3+ Years

[Quietlyawesome94]

An unpatched security flaw in Apple’s iTunes software allowed intelligence agencies and police to hack into users’ computers for more than three years, it’s claimed.

A British company called Gamma International marketed hacking software to governments that exploited the vulnerability via a bogus update to iTunes, Apple's media player, which is installed on more than 250 million machines worldwide.


The hacking software, FinFisher, is used to spy on intelligence targets’ computers. It is known to be used by British agencies and earlier this year records were discovered in abandoned offices of that showed it had been offered to Egypt’s feared secret police.


Apple was informed about the relevant flaw in iTunes in 2008, according to Brian Krebs, a security writer, but did not patch the software until earlier this month, a delay of more than three years.


"A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet the company waited more than 1,200 days to fix the flaw,” he said in a blog post.


"The disclosure raises questions about whether and when Apple knew about the Trojan offering, and its timing in choosing to sew up the security hole in this ubiquitous software title."

http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html

 

[purechaos996]

I always hated Itunes..I still have to use it for my ipod but I always hated it lol.

 

[Tom Bombadildo]

I always hated Itunes..I still have to use it for my ipod but I always hated it lol.

You don't have to use it.

Figures, Apple is bad at everything else, why should security be any different?

 

[Deleted-236924]

I always hated Itunes..I still have to use it for my ipod but I always hated it lol.

Copytrans, manager.

 

[Helpful Corn]

Itunes or not the government can always get into your PC

 

[Foxi4]

Itunes or not the government can always get into your PC

Challenge accepted.

*Pulls Ze Magic Internet Cable out, starts using a USB stick to copy data over from "clean" computers onto the "Le Dirty" one.*

Hack-proof, baby.

 

[DarkStriker]

Plug out the internet cable. Done

 

[triassic911]

Itunes or not the government can always get into your PC

Challenge accepted.

*Pulls Ze Magic Internet Cable out, starts using a USB stick to copy data over from "clean" computers onto the "Le Dirty" one.*

Hack-proof, baby.

 

[DinohScene]

Uhoh.......

Great job Apple.
Yet another failure.

 

[chrisrlink]

what if apple allowed this sneeky government

 

[jamesaa]

Sounds similar to evilgrade, iTunes was not the only software with this flaw, there was a whole list - most patched the problem quickly, usually through signing updates and using encrypted connections for update checks/downloading, obviously it seems Apple didn't bother.

EDIT:

Itunes or not the government can always get into your PC

Challenge accepted.

*Pulls Ze Magic Internet Cable out, starts using a USB stick to copy data over from "clean" computers onto the "Le Dirty" one.*

Hack-proof, baby.

lol, i hope you seriously don't think that makes you hack proof? It may hinder online attacks, but it certainly won't stop physical access or programs that can transfer their payload from your "clean" computer to your USB drive.