Slashdot Mirror

← Back to Stories (view on slashdot.org)

iTunes Music Store Hole Discovered, Patched

Posted by pudge on from the mmmmm-free-music dept.

prockcore writes "A vulnerability has been found in Apple's iTunes Music Store. The flaw enabled hackers to hijack other people's accounts by knowing only their email address, and download music with it. Apple has patched the hole."

13 of 26 comments (clear)

  1. Good thing by Anonymous Coward · · Score: 3, Insightful

    I'm glad to hear that the Canadian Researcher didn't exploit the hole and no one (so far) has been bit in the ass by the error. This is how to handle vulnerabilities IMHO.

  2. Well by aphex2000 · · Score: 4, Funny

    Now we know where those huge amounts of downloads are coming from :)

    1. Re:Well by lanej0 · · Score: 3, Funny

      Your mom?

      Just kidding. It was Steve J. Anyone else see how many songs he was downloading at the launch? ;-)

    2. Re:Well by ionyka · · Score: 3, Interesting

      I doubt that this could have affected it enough to make the estimates of the number of downloads significantly different. But atleast they found it fast enough and fixed it so it didnt get out of hand.

    3. Re:Well by Anonymous Coward · · Score: 2, Funny

      I've been trying for days to guess the password to the steve@mac.com account. So far no success. :-(

  3. worm? by rumpledstiltskin · · Score: 3, Funny

    maybe they should have used a worm to penetrate the apple..

  4. MSTunes by jolshefsky · · Score: 5, Funny

    Just wait until Microsoft copies this service.

    --
    --- Jason Olshefsky

    Karma: Poser (mostly affected by adding this line long after everyone else did)

    1. Re:MSTunes by cpeterso · · Score: 2, Interesting


      free music! hmm, if the RIAA can sue Napster for enabling users to download free music, can the RIAA sue Apple or Microsoft if security holes in their music services enable users to download free music?

      --
      cpeterso
    2. Re:MSTunes by sweet+reason · · Score: 2, Insightful

      can the RIAA sue Apple or Microsoft if security holes...

      does the RIAA care _who_ pays for the download, so long as _someone_ does?

      --
      Everything should be made as simple as possible, but not simpler. -- A.E.
  5. Stupid error. by BoomerSooner · · Score: 4, Insightful

    How does something as simple as not passing authentication objects/info to the browser get past Apple's QA? Session Objects, Cookies and Hidden form fields are never secure from the user. Amazing this still happens.

    Ah, it feels like 1996 again.

    1. Re:Stupid error. by 2sleep2type · · Score: 5, Interesting
      I agree this is a really stupid mistake.

      However in my experience of developing applications for a lot of 'big name' organisations. The QA, testing and other checking people have no idea of the issues let alone an understanding of how to really 'break' an application.

      My general experience is if I don't QA my own work, as long as it's functionally correct no one else will question it.

      It's scary, one of the many reasons I'm very careful when I check my credit card bill

    2. Re:Stupid error. by MobyDisk · · Score: 4, Insightful

      I've never seen an organization that had QA done by technical persons. But this type of stuff is out of the realm of QA. QA did there job by verifying that the functionality worked as described. But this wasn't a QC mistake, this was a design flaw. The design describes where the data comes from and where it is stored.

  6. Go work in banking, the military or any other high by BoomerSooner · · Score: 4, Insightful

    risk area, where if you and QA don't catch something like this, you're fired.

    It makes you code better knowing screwing up could cost you your job. Although in situations like that you usually get more realistic development schedules compared to the corporate schedule of get it done now. (Or at least that's what I've experienced.)