iTunes Flaw Allowed Spying On Dissidents

Hugh Pickens writes writes "Democracy and free speech activists worldwide have something new to worry about — cyberwarfare via iTunes. The Telegraph reports that Gamma International sells computer hacking services to governments, offering 'zero day' security flaws that allow access to target computers 'with the ability to take control of the target systems functions to the point of capturing encrypted data and communications.' FinFisher spyware, known to be used by British agencies and offered to Egypt's feared secret police, takes advantage of an unencrypted HTTP request that is filed by iTunes when Apple Software Updater is inactive. It redirects users' web browsers to a customized web page that pretends Flash is not installed on the user's computer, then installs a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services. The latest iTunes software update, 10.5.1, released on November 14, appears to have fixed the exploit FinFisher used. A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet Apple 'waited more than 1,200 days to fix the flaw,' writes security researcher Brian Krebs."

Comments

Conspiracy!

[ryanmcdonough]

An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.

Re:Conspiracy!

[Chrisq]

An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.

You are obviously a government schill who has posed this as a "Lets start a conspiracy" to throw people of the fact that this is exactly what happened.

Re:Conspiracy!

[Yvan256]

In America
You write haiku, in Russia
The Haiku writes YOU

Re:Liability

[betterunixthanunix]

There's really only one solution: hold software makers libel for security vulnerabilities

...and thus kill the free software movement.

The real answer is that dissidents need to start being more paranoid and more technically literate. A system that is used for personal entertainment should be kept physically separated from a system that is used to communicate with fellow dissidents.

Proof

[Yvan256]

Yet another proof that Flash is dangerous! /duck

Seriously?

[Anonymous Coward]

Apple software that redirects you to a webpage where it requests to install Flash Player?

That's like Toyota's website sending you to a page about the Honda Civic.

The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.

Re:Seriously?

[chrb]

There's a vulnerability in iTunes but it's not that vulnerability that installs the malware.

Yes it is. From TFA:

"Evilgrade leveraged a flaw in the updater mechanism for iTunes that could be exploited on Windows systems. Amato described the vulnerability: "The iTunes program checks that the binary is signed by Apple but we can inject content into the description as it opens a browser, with a malicious binary so that the user thinks its from Apple"

The only way you can argue that the updater isn't at fault is if you are going to blame the exploit that installs the malware? But by that definition, a manufacturer would never be assigned any blame for vulnerabilities, it would always be the person doing the exploiting. Does that make sense? Try this: "Microsoft bears no responsibility for any holes in Windows, even when it knows about them and doesn't fix them. The blame lies entirely with the exploit." Do you still agree with this logic when the manufacturer of the system is Microsoft, rather than Apple?

If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.

Bad analogy. Slashdot isn't used as part of a Software Update system by software installed on the desktops of millions of people. Your iTunes updater isn't going to prompt you to install a new update - verified as being from Apple - because of a Slashdot post.

OpenOffice has the same vulnerability

[WD]

And they haven't done anything about it for years, either.
http://blogs.oracle.com/malte/entry/evilgrade_and_openoffice_org

Re:That's funny...

[CharlyFoxtrot]

I love how people here are focussing on iTunes and not the fact that British agencies are supplying the Egyptian secret police with software to nab dissidents. Seriously, WTF ?

1,200 days?

[alexo]

Apple 'waited more than 1,200 days to fix the flaw

It's even worse than that
The waited more than a HUNDRED MILLION seconds.

I guess "more than three years" does not cut it anymore.

Black hats

[bill_mcgonigle]

Gamma International sells computer hacking services to governments, offering 'zero day' security flaws

These are the real blackhats - most 'hackers' don't sell their services to get people killed. Legalized blackhats, perhaps, but blackhats nonetheless.