Feeds

Apple's FaceTime for Mac debuts with security holes

Beta puts iTunes accounts at risk

  • alert
  • submit to reddit

Security for virtualized datacentres

This article is being updated to note that, according to Apple Insider, this bug is no longer reproducible. Apple has provided no comment, and no update for the beta was released to effect the change.

Apple's recently released FaceTime for Mac beta allows users to make important iTunes account changes without first entering their password, a shortcoming that could create serious security issues.

The shortcoming came to light in a Macworld Germany post that found that once the beta was installed, the associated iTunes password could be changed without first reentering the old password. Other important settings, including the account's security question, could similarly be modified.

That means anyone with physical access to a Mac with the beta installed can take control of the user's iTunes account. Most programs — Apple's iTunes included — require users to reenter their password to prevent such tampering.

A separate report from Macnn.com said that if a computer is already logged into FaceTime, account settings will display all of a user's associated data, including birth date, security question, and matching answer. “This makes it trivial to hijack an account if an attacker already has access to a person's Mac,” the report stated.

The threats exist even when users click the “sign out” button that logs them out of iTunes. That's because the old password is cached, making it easy for an attacker to log back in using the “Sign in” button.

FaceTime has been available for users of the iPhone 4 and fourth generation iPod touch, but only made its debut on the Mac on Wednesday, with a beta that was released as part of Apple's Back to the Mac software refresh. It allows users to chat by video with others who have the software installed. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.