Slashdot Mirror

← Back to Stories (view on slashdot.org)

iTunes Music Store Hole Discovered, Patched

Posted by pudge on from the mmmmm-free-music dept.

prockcore writes "A vulnerability has been found in Apple's iTunes Music Store. The flaw enabled hackers to hijack other people's accounts by knowing only their email address, and download music with it. Apple has patched the hole."

5 of 26 comments (clear)

  1. Good thing by Anonymous Coward · · Score: 3, Insightful

    I'm glad to hear that the Canadian Researcher didn't exploit the hole and no one (so far) has been bit in the ass by the error. This is how to handle vulnerabilities IMHO.

  2. Stupid error. by BoomerSooner · · Score: 4, Insightful

    How does something as simple as not passing authentication objects/info to the browser get past Apple's QA? Session Objects, Cookies and Hidden form fields are never secure from the user. Amazing this still happens.

    Ah, it feels like 1996 again.

    1. Re:Stupid error. by MobyDisk · · Score: 4, Insightful

      I've never seen an organization that had QA done by technical persons. But this type of stuff is out of the realm of QA. QA did there job by verifying that the functionality worked as described. But this wasn't a QC mistake, this was a design flaw. The design describes where the data comes from and where it is stored.

  3. Go work in banking, the military or any other high by BoomerSooner · · Score: 4, Insightful

    risk area, where if you and QA don't catch something like this, you're fired.

    It makes you code better knowing screwing up could cost you your job. Although in situations like that you usually get more realistic development schedules compared to the corporate schedule of get it done now. (Or at least that's what I've experienced.)

  4. Re:MSTunes by sweet+reason · · Score: 2, Insightful

    can the RIAA sue Apple or Microsoft if security holes...

    does the RIAA care _who_ pays for the download, so long as _someone_ does?

    --
    Everything should be made as simple as possible, but not simpler. -- A.E.