iTunes Music Store Hole Discovered, Patched

prockcore writes "A vulnerability has been found in Apple's iTunes Music Store. The flaw enabled hackers to hijack other people's accounts by knowing only their email address, and download music with it. Apple has patched the hole."

Good thing

[Anonymous Coward]

I'm glad to hear that the Canadian Researcher didn't exploit the hole and no one (so far) has been bit in the ass by the error. This is how to handle vulnerabilities IMHO.

Well

[aphex2000]

Now we know where those huge amounts of downloads are coming from :)

Re:Well

[lanej0]

Your mom?

Just kidding. It was Steve J. Anyone else see how many songs he was downloading at the launch? ;-)

Re:Well

[Anonymous Coward]

I've been trying for days to guess the password to the [e-mail] account. So far no success. :-(

Re:Well

[ionyka]

I doubt that this could have affected it enough to make the estimates of the number of downloads significantly different. But atleast they found it fast enough and fixed it so it didnt get out of hand.

worm?

[rumpledstiltskin]

maybe they should have used a worm to penetrate the apple..

MSTunes

[jolshefsky]

Just wait until Microsoft copies this service.

Re:MSTunes

[cpeterso]

free music! hmm, if the RIAA can sue Napster for enabling users to download free music, can the RIAA sue Apple or Microsoft if security holes in their music services enable users to download free music?

Re:

[account_deleted]

Comment removed based on user account deletion

Re:MSTunes

[sweet reason]

can the RIAA sue Apple or Microsoft if security holes...

does the RIAA care _who_ pays for the download, so long as _someone_ does?

Stupid error.

[BoomerSooner]

How does something as simple as not passing authentication objects/info to the browser get past Apple's QA? Session Objects, Cookies and Hidden form fields are never secure from the user. Amazing this still happens.

Ah, it feels like 1996 again.

Re:Stupid error.

[2sleep2type]

I agree this is a really stupid mistake.

However in my experience of developing applications for a lot of 'big name' organisations. The QA, testing and other checking people have no idea of the issues let alone an understanding of how to really 'break' an application.

My general experience is if I don't QA my own work, as long as it's functionally correct no one else will question it.

It's scary, one of the many reasons I'm very careful when I check my credit card bill

Re:Stupid error.

[MobyDisk]

I've never seen an organization that had QA done by technical persons. But this type of stuff is out of the realm of QA. QA did there job by verifying that the functionality worked as described. But this wasn't a QC mistake, this was a design flaw. The design describes where the data comes from and where it is stored.

Go work in banking, the military or any other high

[BoomerSooner]

risk area, where if you and QA don't catch something like this, you're fired.

It makes you code better knowing screwing up could cost you your job. Although in situations like that you usually get more realistic development schedules compared to the corporate schedule of get it done now. (Or at least that's what I've experienced.)

Re:Stupid error.

[sco08y]

The only reason it's so painful is that it's so incredibly easy to spot w/ HTML.

At least when all this stuff was binary you had an excuse!

On the other hand, part of the reason is that HTML and HTTP don't encourage you to separate authentication from content and presentation.

The whole thing is one meaningless "tree" pasted on to what are basically email headers.

There's a reason no other network protocols were ever designed that way.

Hackers?

[bluephone]

s/hackers/jackasses who think it's cool to defraud and steal, and make the rest of real hackerdom look bad.

Re:is it fixed?

[Finque]

Apple representatives said the company corrected the problem Friday, but declined to provide details of the fix.

semi-offtopic

[Magius_AR]

I find it very funny that there's only been like 23 posts on this topic. If it was Windows or IIS or something, there'd be like 500 minimum.