iTunes Flaw Allowed Spying On Dissidents

Hugh Pickens writes writes "Democracy and free speech activists worldwide have something new to worry about — cyberwarfare via iTunes. The Telegraph reports that Gamma International sells computer hacking services to governments, offering 'zero day' security flaws that allow access to target computers 'with the ability to take control of the target systems functions to the point of capturing encrypted data and communications.' FinFisher spyware, known to be used by British agencies and offered to Egypt's feared secret police, takes advantage of an unencrypted HTTP request that is filed by iTunes when Apple Software Updater is inactive. It redirects users' web browsers to a customized web page that pretends Flash is not installed on the user's computer, then installs a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services. The latest iTunes software update, 10.5.1, released on November 14, appears to have fixed the exploit FinFisher used. A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet Apple 'waited more than 1,200 days to fix the flaw,' writes security researcher Brian Krebs."

Comments

Conspiracy!

[ryanmcdonough]

An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.

Re:Conspiracy!

[Chrisq]

An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.

You are obviously a government schill who has posed this as a "Lets start a conspiracy" to throw people of the fact that this is exactly what happened.

Re:Conspiracy!

[jellomizer]

The biggest and most used names will get the most hacking and piracy.
Being Open Source, Closes Source. Well designed or poorly designed.
Most of the security problems that take a long time to fix are passed off as not that big of a deal. With an easy work around.
You expect every software company to be trolling the hacking sites to see if there is a new exploit. It doesn't happen.
Even when a hole if found the company cannot just fix it the next day. Because then they will get dinged for making a fix that didn't work and broke the system and people will be less likely to update their computer again.
How many of you work for a company that will not push out patches for months because every patch needs to be tested. Because you have been screwed by a Microsoft patch in the past.
So if the company patches to soon without without a full analysis and testing period they get yelled at. If they do a full analysis that can take months or years they get yelled yet.

Re:Conspiracy!

[Bill_the_Engineer]

By copying the software and rebranding it as their own work without releasing the source code or acknowledging the original software.

I assumed you meant pirate as in copyright infringement and not pirate as in arghhhh.

Re:Conspiracy!

[Yvan256]

In America
You write haiku, in Russia
The Haiku writes YOU

Re:Conspiracy!

[arth1]

How does one pirate open source software?

Easily. Thousands of companies do it every day, the same way one pirates closed source software:
By making and/or distributing copies in violation of the license.

• Most by not honouring licenses with clauses saying that you have to distribute the source with the compiled software or otherwise make it easily available.
• Some by erasing the original author's names, when the license calls for an attribution.
• The worst are those who make modifications (including fixes) to software where the license says that the source to such modifications must become open source too. They take but are unwilling to give.

In these cases, you are in violation of the license which is all that gave you a right to distribute the software. So you don't have that right because you broke the license terms, and doing so is piracy.

Re:Conspiracy!

[Tsingi]

that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.

It's not just rebranding, redistributing modified apps without making the source available violates the GPL.
It's OK to do it, but you have to make the sources available.

Re:Conspiracy!

[Bill_the_Engineer]

that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.

Let's me type a little slower since you were so quick in the reply that you didn't seem to comprehend my message.

Consider piracy to be copyright infringement which is the overwhelming view on Slashdot since we have the meme copyright infringement is not equal to theft here. Now consider what constitute copyright infringement of most open source software that is not in the public domain. If you copy the software and rebrand it without releasing the source code then you violated the GPL which amounts to copyright infringement. If you copy the software and rebrand it without acknowledging the original software then you violated most 4 part BSD licenses out there; Again this amounts to copyright infringement.

This is why my answer to the original poster about "How does one pirate open source software?", I said "by copying the software and rebranding it without releasing the source code or acknowledging the original software" if you consider piracy to mean copyright infringement.

I'll attribute your answer to ADHD.

This is why..

[ryanmcdonough]

You should always put all your music onto a £10 mp3 player and only listen to it on there!

Re:Liability

[betterunixthanunix]

There's really only one solution: hold software makers libel for security vulnerabilities

...and thus kill the free software movement.

The real answer is that dissidents need to start being more paranoid and more technically literate. A system that is used for personal entertainment should be kept physically separated from a system that is used to communicate with fellow dissidents.

Proof

[Yvan256]

Yet another proof that Flash is dangerous! /duck

Seriously?

[Anonymous Coward]

Apple software that redirects you to a webpage where it requests to install Flash Player?

That's like Toyota's website sending you to a page about the Honda Civic.

The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.

Re:Seriously?

[GameboyRMH]

The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.

There you have it folks, if any malware exploits a vulnerability in Apple software it's not Apple's fault, it's the virus writer's fault. To say otherwise would be Apple-bashing.

Now excuse me while I make the infallible decision to leave every door on my house swinging open while I'm not at home. If any hobos or thieves enter it is not my fault, I made no mistakes.

Re:Seriously?

[Yvan256]

There's a vulnerability in iTunes but it's not that vulnerability that installs the malware. If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.

Re:Seriously?

[chrb]

There's a vulnerability in iTunes but it's not that vulnerability that installs the malware.

Yes it is. From TFA:

"Evilgrade leveraged a flaw in the updater mechanism for iTunes that could be exploited on Windows systems. Amato described the vulnerability: "The iTunes program checks that the binary is signed by Apple but we can inject content into the description as it opens a browser, with a malicious binary so that the user thinks its from Apple"

The only way you can argue that the updater isn't at fault is if you are going to blame the exploit that installs the malware? But by that definition, a manufacturer would never be assigned any blame for vulnerabilities, it would always be the person doing the exploiting. Does that make sense? Try this: "Microsoft bears no responsibility for any holes in Windows, even when it knows about them and doesn't fix them. The blame lies entirely with the exploit." Do you still agree with this logic when the manufacturer of the system is Microsoft, rather than Apple?

If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.

Bad analogy. Slashdot isn't used as part of a Software Update system by software installed on the desktops of millions of people. Your iTunes updater isn't going to prompt you to install a new update - verified as being from Apple - because of a Slashdot post.

OpenOffice has the same vulnerability

[WD]

And they haven't done anything about it for years, either.
http://blogs.oracle.com/malte/entry/evilgrade_and_openoffice_org

Re:That's funny...

[CharlyFoxtrot]

I love how people here are focussing on iTunes and not the fact that British agencies are supplying the Egyptian secret police with software to nab dissidents. Seriously, WTF ?

1,200 days?

[alexo]

Apple 'waited more than 1,200 days to fix the flaw

It's even worse than that
The waited more than a HUNDRED MILLION seconds.

I guess "more than three years" does not cut it anymore.

Re:1,200 days?

[Pope]

Article was obviously written by a new parent.

Black hats

[bill_mcgonigle]

Gamma International sells computer hacking services to governments, offering 'zero day' security flaws

These are the real blackhats - most 'hackers' don't sell their services to get people killed. Legalized blackhats, perhaps, but blackhats nonetheless.