Feeds

Apple's FaceTime for Mac debuts with security holes

Beta puts iTunes accounts at risk

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

This article is being updated to note that, according to Apple Insider, this bug is no longer reproducible. Apple has provided no comment, and no update for the beta was released to effect the change.

Apple's recently released FaceTime for Mac beta allows users to make important iTunes account changes without first entering their password, a shortcoming that could create serious security issues.

The shortcoming came to light in a Macworld Germany post that found that once the beta was installed, the associated iTunes password could be changed without first reentering the old password. Other important settings, including the account's security question, could similarly be modified.

That means anyone with physical access to a Mac with the beta installed can take control of the user's iTunes account. Most programs — Apple's iTunes included — require users to reenter their password to prevent such tampering.

A separate report from Macnn.com said that if a computer is already logged into FaceTime, account settings will display all of a user's associated data, including birth date, security question, and matching answer. “This makes it trivial to hijack an account if an attacker already has access to a person's Mac,” the report stated.

The threats exist even when users click the “sign out” button that logs them out of iTunes. That's because the old password is cached, making it easy for an attacker to log back in using the “Sign in” button.

FaceTime has been available for users of the iPhone 4 and fourth generation iPod touch, but only made its debut on the Mac on Wednesday, with a beta that was released as part of Apple's Back to the Mac software refresh. It allows users to chat by video with others who have the software installed. ®

Beginner's guide to SSL certificates

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.