Forgot your password?
typodupeerror
Government Privacy Security Apple

iTunes Flaw Allowed Spying On Dissidents 82

Posted by Soulskill
from the but-only-from-a-macbook dept.
Hugh Pickens writes writes "Democracy and free speech activists worldwide have something new to worry about — cyberwarfare via iTunes. The Telegraph reports that Gamma International sells computer hacking services to governments, offering 'zero day' security flaws that allow access to target computers 'with the ability to take control of the target systems functions to the point of capturing encrypted data and communications.' FinFisher spyware, known to be used by British agencies and offered to Egypt's feared secret police, takes advantage of an unencrypted HTTP request that is filed by iTunes when Apple Software Updater is inactive. It redirects users' web browsers to a customized web page that pretends Flash is not installed on the user's computer, then installs a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services. The latest iTunes software update, 10.5.1, released on November 14, appears to have fixed the exploit FinFisher used. A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet Apple 'waited more than 1,200 days to fix the flaw,' writes security researcher Brian Krebs."
This discussion has been archived. No new comments can be posted.

iTunes Flaw Allowed Spying On Dissidents

Comments Filter:
  • Conspiracy! (Score:5, Funny)

    by ryanmcdonough (2430374) on Friday November 25, 2011 @08:59AM (#38164994)
    An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.
    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Conspiracy? That sounds more like fact.

      • Nah... it sounds like Apple just was complacent and didn't care about patching a vulnerability that they knew about because they felt their engineer was better utilized for some other task.

        Because that's how it always is for Apple. Security when we get around to it.
    • by Chrisq (894406) on Friday November 25, 2011 @09:02AM (#38165008)

      An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.

      You are obviously a government schill who has posed this as a "Lets start a conspiracy" to throw people of the fact that this is exactly what happened.

      • by Anonymous Coward

        I can confirm that this guy is a theorist. OUR Intelligence agencies dont need to use some 1,200 day old vulnerability to make it easy to exploit the dissonant. The Nixon administration didn't even spy on the domestic. It provided survey of the activity going on during protest to the FBI to keep them on their toes in case of an emergency or domestic attempt to terrorize or get out of line. If intelligence agencies hack or penetrate anything, they penetrate their own agencies to test network and hardware vul

    • The biggest and most used names will get the most hacking and piracy.
      Being Open Source, Closes Source. Well designed or poorly designed.
      Most of the security problems that take a long time to fix are passed off as not that big of a deal. With an easy work around.
      You expect every software company to be trolling the hacking sites to see if there is a new exploit. It doesn't happen.
      Even when a hole if found the company cannot just fix it the next day. Because then they will get dinged for making a fix that d

      • The biggest and most used names will get the most hacking and piracy. Being Open Source, ...

        How does one pirate open source software?

        • By copying the software and rebranding it as their own work without releasing the source code or acknowledging the original software.

          I assumed you meant pirate as in copyright infringement and not pirate as in arghhhh.

          • by poetmatt (793785)

            that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.

            • It's stealing and you know it! Now pay up! $150,000 per byte of code!
            • by Tsingi (870990)

              that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.

              It's not just rebranding, redistributing modified apps without making the source available violates the GPL.
              It's OK to do it, but you have to make the sources available.

            • that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.

              Let's me type a little slower since you were so quick in the reply that you didn't seem to comprehend my message.

              Consider piracy to be copyright infringement which is the overwhelming view on Slashdot since we have the meme copyright infringement is not equal to theft here. Now consider what constitute copyright infringement of most open source software that is not in the public domain. If you copy the software and re

        • by Anonymous Coward

          Mawahahahaha! I've start a pirated torrent of Debian! Now anyone can have a copy ... oh wait ...

        • by arth1 (260657)

          How does one pirate open source software?

          Easily. Thousands of companies do it every day, the same way one pirates closed source software:
          By making and/or distributing copies in violation of the license.

          • Most by not honouring licenses with clauses saying that you have to distribute the source with the compiled software or otherwise make it easily available.
          • Some by erasing the original author's names, when the license calls for an attribution.
          • The worst are those who make modifications (including fixes) to software where the license says that the sou
        • by Hentes (2461350)

          Open source and zero-cost are different things.

      • by Eraesr (1629799)
        I welcome you to my world, where patches are tested in a half-assed way because the customer is demanding that this fix is being made available RIGHT NOW!!!! (only to install it 3 weeks later...)
        • If you're having to release patches which are serious enough to have the customer demanding a fix RIGHT NOW!!1one then your coding was probably half-assed to begin with.

          Trololol! ~
        • by macs4all (973270)

          I welcome you to my world, where patches are tested in a half-assed way because the customer is demanding that this fix is being made available RIGHT NOW!!!! (only to install it 3 weeks later...)

          My world has similar features...

    • Bug? Who says it was a bug? The *real* conspiracy theorists would say that it was a feature intentionally designed in for exactly this sort of use.
    • You probably mean a conspiracy THEORY?
  • by Anonymous Coward

    Why didn't he warn the rest of the world as well?
    A company may have a problem closing a hole that is used by governments may be a thing that governments do not like.

    • They call it "responsible" disclosure.

      • by AHuxley (892839)
        Re: The ability to warn the rest of the world?
        Based on what happened to Italian telecommunications security expert and Adamo Bove, Greek telecommunications expert Costas Tsalikidis....
        Bove used mobile phone logs to map more than two dozen American agents. He also uncovered undetectable illegal telco wiretaps and talked about what he found in open court.
        Costas Tsalikidis found very advanced spyware in his company's mobile phone network. The Greek Prime Minister, Greek military officers, anti-war activi
  • You should always put all your music onto a £10 mp3 player and only listen to it on there!
  • I thought iTunes itself was the spyware?
    • Re:That's funny... (Score:5, Insightful)

      by CharlyFoxtrot (1607527) on Friday November 25, 2011 @10:49AM (#38165770)

      I love how people here are focussing on iTunes and not the fact that British agencies are supplying the Egyptian secret police with software to nab dissidents. Seriously, WTF ?

      • by Anonymous Coward

        or you could read the FS. It's _used_ by the British and was offered to the Egyptians. Never says offered by the British. I'm guessing it was offered by FinFisher. You going to get all arsey that the US uses the same OS that is used in Iran as well?

      • --never provide personal information that is not otherwise readily available
        --never speak of anything illegal that you may have ever done
        --never speak of anything illegal that others you know may have done
        --do not get into speculative gossip e.g. about who does drugs or not
        --do not leave personal papers lying around or unattended in public
        --do not have strangers as overnight guests. They are poised to search your files
        --do not write an email or a letter that you wouldn't publish in the New York Times
        --do no

  • There's really only one solution: hold software makers libel for security vulnerabilities. Until every exploit hits the vendor in the pocketbook, we'll never see real management attention paid to information security.
    • Re:Liability (Score:5, Insightful)

      by betterunixthanunix (980855) on Friday November 25, 2011 @09:26AM (#38165114)

      There's really only one solution: hold software makers libel for security vulnerabilities

      ...and thus kill the free software movement.

      The real answer is that dissidents need to start being more paranoid and more technically literate. A system that is used for personal entertainment should be kept physically separated from a system that is used to communicate with fellow dissidents.

      • The real answer is that dissidents need to start being more paranoid and more technically literate. A system that is used for personal entertainment should be kept physically separated from a system that is used to communicate with fellow dissidents.

        Face it - against a determined powerful watcher even that is not enough:

        Agent X: Drat, our target "Dissident-Man" is using a "throw-away" cell phone - we don't know who they are - and they never use it for personal things, so even if we continue to track it, it won't do any good!

        Agent Y: Hey, did you notice in our records that it is almost always used by the same cell tower as the phone of "Pat Civilian"? Often just before or just after? Maybe we should have a "talk" with this "Pat"?

        que scary music:
        dun-dun-

      • by Fished (574624)
        OP.

        I too worried about the free software movement when I wrote that. I think maybe if you set some sort of damage cap at "how much profit provider earns from software, directly or indirectly." Granted, in cases like iTunes or Internet Explorer, which are given away as "premiums" (kind of like banks used to give away toasters) this could be hard to calculate, but surely large company's have some sort of accounting basis for justifying how much they spend on these packages?

        The point is that, in my observati
      • by Hentes (2461350)

        ...and thus kill the free software movement.

        How would you sue a software developed by hundreds of anonymous people?

        • By unmasking the anonymous users and taking the shirt off their back.

          1. Free software is not developed by anonymous people. In theory it could be, but in practice people use their real names and someone is responsible for the servers and infrastructure used to manage the project.
          2. Even if there were hundreds of anonymous people, there would be a few key contributors; tracking them down and suing them off the face of the Earth would be sufficient to kill a project.
    • this would make software extremely expensive to develop. isn't there just too many permutations of events in software to KNOW that its "100% done"? and will NEVER have an error/bug? not to mention the area of users themselves being the vulnerabilities...
  • Proof (Score:5, Funny)

    by Yvan256 (722131) on Friday November 25, 2011 @09:30AM (#38165142) Homepage Journal

    Yet another proof that Flash is dangerous! /duck

  • Nice, I'm so glad I use Rhythmbox :-)
  • Seriously? (Score:3, Funny)

    by Anonymous Coward on Friday November 25, 2011 @10:24AM (#38165500)

    Apple software that redirects you to a webpage where it requests to install Flash Player?

    That's like Toyota's website sending you to a page about the Honda Civic.

    The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.

    • The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.

      There you have it folks, if any malware exploits a vulnerability in Apple software it's not Apple's fault, it's the virus writer's fault. To say otherwise would be Apple-bashing.

      Now excuse me while I make the infallible decision to leave every door on my house swinging open while I'm not at home. If any hobos or thieves enter it is not my fault, I made no mistakes.

      • by Yvan256 (722131)

        There's a vulnerability in iTunes but it's not that vulnerability that installs the malware. If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.

        • It relies on the user to install the malware, but the malware link wouldn't appear at all if iTunes used an HTTPS connection to check for updates

        • Re:Seriously? (Score:4, Informative)

          by chrb (1083577) on Friday November 25, 2011 @11:15AM (#38166020)

          There's a vulnerability in iTunes but it's not that vulnerability that installs the malware.

          Yes it is. From TFA:

          "Evilgrade leveraged a flaw in the updater mechanism for iTunes that could be exploited on Windows systems. Amato described the vulnerability: "The iTunes program checks that the binary is signed by Apple but we can inject content into the description as it opens a browser, with a malicious binary so that the user thinks its from Apple"

          The only way you can argue that the updater isn't at fault is if you are going to blame the exploit that installs the malware? But by that definition, a manufacturer would never be assigned any blame for vulnerabilities, it would always be the person doing the exploiting. Does that make sense? Try this: "Microsoft bears no responsibility for any holes in Windows, even when it knows about them and doesn't fix them. The blame lies entirely with the exploit." Do you still agree with this logic when the manufacturer of the system is Microsoft, rather than Apple?

          If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.

          Bad analogy. Slashdot isn't used as part of a Software Update system by software installed on the desktops of millions of people. Your iTunes updater isn't going to prompt you to install a new update - verified as being from Apple - because of a Slashdot post.

          • by TheSpoom (715771)

            The only way you can argue that the updater isn't at fault is if you are going to blame the exploit that installs the malware? But by that definition, a manufacturer would never be assigned any blame for vulnerabilities, it would always be the person doing the exploiting. Does that make sense? Try this: "Microsoft bears no responsibility for any holes in Windows, even when it knows about them and doesn't fix them. The blame lies entirely with the exploit." Do you still agree with this logic when the manufacturer of the system is Microsoft, rather than Apple?

            Windows 7 Ultimate EULA [microsoft.com]

            26. LIMITATION ON AND EXCLUSION OF DAMAGES. You can recover from Microsoft and its suppliers only direct damages up to the amount you paid for the software. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.
            This limitation applies to
            - anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and
            - claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.
            It also applies even if
            - repair, replacement or a refund for the software does not fully compensate you for any losses; or
            - Microsoft knew or should have known about the possibility of the damages.

            Emphasis added.

    • by Daerath (625570)
      And I'm sure you're just as forgiving whenever Microsoft has a security bug that gets exploited via 3rd party software (e.g. quicktime, flash, acrobat reader, etc.). or when there is no bug and it's purely a 3rd party vuln that allows access.
    • how does it feel to constantly be Apple's bitch?

  • by WD (96061) on Friday November 25, 2011 @10:32AM (#38165588)

    And they haven't done anything about it for years, either.
    http://blogs.oracle.com/malte/entry/evilgrade_and_openoffice_org [oracle.com]

    • I wonder if it's been fixed in LibreOffice?

      • by WD (96061)

        I tested 3.4.4 and 3.3.4 (Latest on website now) and I couldn't even find auto-update functionality. Though I can see update functionality mentioned in the documentation:
        http://help.libreoffice.org/Common/Online_Update [libreoffice.org]

        So either they've pulled the functionality, or I'm looking in the wrong place.

        • by chrb (1083577)
          Some Linux distributions nobble in-app auto-updaters, because the application is installed via their standard apt/yum package repositories. There is no need to treat one application as a special case, that requires a special updater, when you have proper package management.
    • by AmiMoJo (196126)

      It really is coming to something when Microsoft have been doing it right for over a decade but others who should know better still screw it up. Since the Windows 98 days Windows Update has used an IP address rather than DNS lookup and it also bypasses the hosts redirect file and any other stuff that attaches to the TCP/IP stack, and then the web site and updates themselves and cryptographically verified. Since 1998.

  • 1,200 days? (Score:5, Funny)

    by alexo (9335) on Friday November 25, 2011 @10:54AM (#38165824) Journal

    Apple 'waited more than 1,200 days to fix the flaw

    It's even worse than that
    The waited more than a HUNDRED MILLION seconds.

    I guess "more than three years" does not cut it anymore.

    • by Pope (17780)

      Article was obviously written by a new parent.

    • by AmiMoJo (196126)

      It is a simple question of scale. I could tell you my car's speed in decimetres per fought night but for ease of comparison km/h or mp/h might be easier. They don't call these things zero-day exploits for nothing; typically the value of the exploit rapidly decreases as news of it spreads and people take defensive action.

      Unfortunately Apple failed to act, and it isn't an isolated incident. Nothing particular against Apple, any other company that produced a popular and in fact necessary bit of software that m

  • OS X, Linux & *BSD are not affected.
    Whoever uses Windows by it's own will it's asking for it.

  • Black hats (Score:4, Insightful)

    by bill_mcgonigle (4333) * on Friday November 25, 2011 @11:50AM (#38166418) Homepage Journal

    Gamma International sells computer hacking services to governments, offering 'zero day' security flaws

    These are the real blackhats - most 'hackers' don't sell their services to get people killed. Legalized blackhats, perhaps, but blackhats nonetheless.

  • "installs a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services"

    Nothing "foreign" about it!

  • Seriously, if I'm a software company, how do I tell the difference between
    1) a prominent security researcher
    2) a garden-variety hacker

    Consider that the incoming notification will probably go to one of several public addresses, but probably to support, feedback, publicity or bugs. Now, do each of those people need to be trained to recognize certain names (which leads us back to original question). Or do they need to be trained to recognize a crank letter from a real letter (no objective means of doing so). O

Moneyliness is next to Godliness. -- Andries van Dam

Working...