Feeds

Apple's FaceTime for Mac debuts with security holes

Beta puts iTunes accounts at risk

  • alert
  • submit to reddit

Intelligent flash storage arrays

This article is being updated to note that, according to Apple Insider, this bug is no longer reproducible. Apple has provided no comment, and no update for the beta was released to effect the change.

Apple's recently released FaceTime for Mac beta allows users to make important iTunes account changes without first entering their password, a shortcoming that could create serious security issues.

The shortcoming came to light in a Macworld Germany post that found that once the beta was installed, the associated iTunes password could be changed without first reentering the old password. Other important settings, including the account's security question, could similarly be modified.

That means anyone with physical access to a Mac with the beta installed can take control of the user's iTunes account. Most programs — Apple's iTunes included — require users to reenter their password to prevent such tampering.

A separate report from Macnn.com said that if a computer is already logged into FaceTime, account settings will display all of a user's associated data, including birth date, security question, and matching answer. “This makes it trivial to hijack an account if an attacker already has access to a person's Mac,” the report stated.

The threats exist even when users click the “sign out” button that logs them out of iTunes. That's because the old password is cached, making it easy for an attacker to log back in using the “Sign in” button.

FaceTime has been available for users of the iPhone 4 and fourth generation iPod touch, but only made its debut on the Mac on Wednesday, with a beta that was released as part of Apple's Back to the Mac software refresh. It allows users to chat by video with others who have the software installed. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.