Apple's FaceTime for Mac debuts with security holes
Beta puts iTunes accounts at risk
Customer Success Testimonial: Recovery is Everything
This article is being updated to note that, according to Apple Insider, this bug is no longer reproducible. Apple has provided no comment, and no update for the beta was released to effect the change.
Apple's recently released FaceTime for Mac beta allows users to make important iTunes account changes without first entering their password, a shortcoming that could create serious security issues.
The shortcoming came to light in a Macworld Germany post that found that once the beta was installed, the associated iTunes password could be changed without first reentering the old password. Other important settings, including the account's security question, could similarly be modified.
That means anyone with physical access to a Mac with the beta installed can take control of the user's iTunes account. Most programs — Apple's iTunes included — require users to reenter their password to prevent such tampering.
A separate report from Macnn.com said that if a computer is already logged into FaceTime, account settings will display all of a user's associated data, including birth date, security question, and matching answer. “This makes it trivial to hijack an account if an attacker already has access to a person's Mac,” the report stated.
The threats exist even when users click the “sign out” button that logs them out of iTunes. That's because the old password is cached, making it easy for an attacker to log back in using the “Sign in” button.
FaceTime has been available for users of the iPhone 4 and fourth generation iPod touch, but only made its debut on the Mac on Wednesday, with a beta that was released as part of Apple's Back to the Mac software refresh. It allows users to chat by video with others who have the software installed. ®
COMMENTS
try again
A beta is released to get feedback on bugs and such, not really the type of thing that is used to let the world know you goofed on a basic. ;o)
half agreement
It's a doozey, and this should be better addressed, but it is also a beta, and only an issue if someone can actually log onto your session. If you're in a public place, leave your machine without logging out, and don't have a password set for login from a screen saver (or boot), that's YOUR problem. Yes, you should not be able to change a password without a confirmation, but you should not be able to get TO this without knowing the keychain password first...
Its a lower levekl security risk than people are playing on. yes, it should be corrected anyway, it;s just bad form, but it is not an invalid practice in itself, or a bug.
sort of
...but only if they have already cracked your stronger security (got logged in as you on your machine).
Yes apple should change this. Changes to ANY passwords of local applications, especially those already tied into KeyChain, should prompt for the keychain password. However, this is a best practice, not really a security violation. They'll fix it because people went nuts, but the people don;t understand they've already lost if a hacker or thief is already at this screen...
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
