Feeds

Apple code of secrecy imperils Aunt Mildred

Critical patches released (sort of)

SANS - Survey on application security programs

Those who use Apple's iTunes or QuickTime on either a Mac or Windows machine, or who own an iPod touch, will want to install newly released updates that fix a raft of serious security bugs. Not that Apple is going out of its way to warn of the risks, mind you.

The most serious of the batch seem to be updates for QuickTime, which plug holes that could allow attackers to hijack a Mac or PC simply by tricking a user into viewing a maliciously crafted video or picture. (And given the presence of millions of recently compromised websites, how hard can that be?)

Screenshot of Apple Software Update

Other flaws reside in iTunes that lead to misleading firewall dialog messages and, on Windows machines, the ability to escalate system privileges. Apple also exorcised several Windows-specific demons from Bonjour, an iTunes component that allows computers to locate and connect to other devices on a local network. Those bugs make it possible for remote miscreants to spoof DNS responses, among other things.

Apple also updated software for the iPod touch. Among the security bugs that were squashed was a flaw that allowed one application to read the files used by a separate application. Other vulnerabilities reside in an application known as FreeType that could allow the execution of arbitrary code when accessing maliciously crafted font data.

Sadly, when we fired up iTunes, QuickTime and the Apple Software Update applications on our Windows XP machine, we were hard pressed to find any mention of a security bug. Instead (as the screenshot to the right illustrates), what we got was a lot of fluff about Genius and other new bells and whistles added to iTunes. That may be of little consequence to hard-core techies who read El Reg, but for Aunt Mildrid using her brand-new MacBook Pro, that lack of a clear warning is dangerous.

Apple's diligence in stamping out bugs is commendable. But its Howard Hughesian obsession with secrecy and marketing imperils their considerable number of users, and that's a pity. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.