Apple's FaceTime for Mac debuts with security holes
Beta puts iTunes accounts at risk
This article is being updated to note that, according to Apple Insider, this bug is no longer reproducible. Apple has provided no comment, and no update for the beta was released to effect the change.
Apple's recently released FaceTime for Mac beta allows users to make important iTunes account changes without first entering their password, a shortcoming that could create serious security issues.
The shortcoming came to light in a Macworld Germany post that found that once the beta was installed, the associated iTunes password could be changed without first reentering the old password. Other important settings, including the account's security question, could similarly be modified.
That means anyone with physical access to a Mac with the beta installed can take control of the user's iTunes account. Most programs — Apple's iTunes included — require users to reenter their password to prevent such tampering.
A separate report from Macnn.com said that if a computer is already logged into FaceTime, account settings will display all of a user's associated data, including birth date, security question, and matching answer. “This makes it trivial to hijack an account if an attacker already has access to a person's Mac,” the report stated.
The threats exist even when users click the “sign out” button that logs them out of iTunes. That's because the old password is cached, making it easy for an attacker to log back in using the “Sign in” button.
FaceTime has been available for users of the iPhone 4 and fourth generation iPod touch, but only made its debut on the Mac on Wednesday, with a beta that was released as part of Apple's Back to the Mac software refresh. It allows users to chat by video with others who have the software installed. ®