iTunes Flaw Allowed Spying On Dissidents 82
Hugh Pickens writes writes "Democracy and free speech activists worldwide have something new to worry about — cyberwarfare via iTunes. The Telegraph reports that Gamma International sells computer hacking services to governments, offering 'zero day' security flaws that allow access to target computers 'with the ability to take control of the target systems functions to the point of capturing encrypted data and communications.' FinFisher spyware, known to be used by British agencies and offered to Egypt's feared secret police, takes advantage of an unencrypted HTTP request that is filed by iTunes when Apple Software Updater is inactive. It redirects users' web browsers to a customized web page that pretends Flash is not installed on the user's computer, then installs a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services. The latest iTunes software update, 10.5.1, released on November 14, appears to have fixed the exploit FinFisher used. A prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet Apple 'waited more than 1,200 days to fix the flaw,' writes security researcher Brian Krebs."
Conspiracy! (Score:5, Funny)
Re: (Score:1, Insightful)
Conspiracy? That sounds more like fact.
Re: (Score:1)
Because that's how it always is for Apple. Security when we get around to it.
Re:Conspiracy! (Score:5, Funny)
An amazing way to exploit software that is ubiquitous on many computers. Let's start the conspiracy now that Apple are told by governments not to fix a bug until they find a better 0Day to exploit.
You are obviously a government schill who has posed this as a "Lets start a conspiracy" to throw people of the fact that this is exactly what happened.
Re: (Score:1)
I can confirm that this guy is a theorist. OUR Intelligence agencies dont need to use some 1,200 day old vulnerability to make it easy to exploit the dissonant. The Nixon administration didn't even spy on the domestic. It provided survey of the activity going on during protest to the FBI to keep them on their toes in case of an emergency or domestic attempt to terrorize or get out of line. If intelligence agencies hack or penetrate anything, they penetrate their own agencies to test network and hardware vul
Re: (Score:3)
The biggest and most used names will get the most hacking and piracy.
Being Open Source, Closes Source. Well designed or poorly designed.
Most of the security problems that take a long time to fix are passed off as not that big of a deal. With an easy work around.
You expect every software company to be trolling the hacking sites to see if there is a new exploit. It doesn't happen.
Even when a hole if found the company cannot just fix it the next day. Because then they will get dinged for making a fix that d
Re: (Score:2)
The biggest and most used names will get the most hacking and piracy. Being Open Source, ...
How does one pirate open source software?
Re: (Score:3)
By copying the software and rebranding it as their own work without releasing the source code or acknowledging the original software.
I assumed you meant pirate as in copyright infringement and not pirate as in arghhhh.
Re: (Score:2)
that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.
Re: (Score:1)
Re: (Score:3)
that's not piracy, that's just rebranding, as the poster you are replying to acknowledged.
It's not just rebranding, redistributing modified apps without making the source available violates the GPL.
It's OK to do it, but you have to make the sources available.
Re: (Score:3)
Let's me type a little slower since you were so quick in the reply that you didn't seem to comprehend my message.
Consider piracy to be copyright infringement which is the overwhelming view on Slashdot since we have the meme copyright infringement is not equal to theft here. Now consider what constitute copyright infringement of most open source software that is not in the public domain. If you copy the software and re
Re: (Score:1)
Mawahahahaha! I've start a pirated torrent of Debian! Now anyone can have a copy ... oh wait ...
Re: (Score:2)
what? no one WANTS a copy?
Re: (Score:3)
How does one pirate open source software?
Easily. Thousands of companies do it every day, the same way one pirates closed source software:
By making and/or distributing copies in violation of the license.
Re: (Score:2)
Open source and zero-cost are different things.
Re:Conspiracy! (Score:5, Funny)
In America
You write haiku, in Russia
The Haiku writes YOU
Re: (Score:2)
Re: (Score:2)
Trololol! ~
Re: (Score:2)
It happens.
Re: (Score:2)
I welcome you to my world, where patches are tested in a half-assed way because the customer is demanding that this fix is being made available RIGHT NOW!!!! (only to install it 3 weeks later...)
My world has similar features...
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Why didn't the security researcher (Score:1)
Why didn't he warn the rest of the world as well?
A company may have a problem closing a hole that is used by governments may be a thing that governments do not like.
Re: (Score:2)
They call it "responsible" disclosure.
Re: (Score:2)
Based on what happened to Italian telecommunications security expert and Adamo Bove, Greek telecommunications expert Costas Tsalikidis....
Bove used mobile phone logs to map more than two dozen American agents. He also uncovered undetectable illegal telco wiretaps and talked about what he found in open court.
Costas Tsalikidis found very advanced spyware in his company's mobile phone network. The Greek Prime Minister, Greek military officers, anti-war activi
This is why.. (Score:2)
That's funny... (Score:1)
Re:That's funny... (Score:5, Insightful)
I love how people here are focussing on iTunes and not the fact that British agencies are supplying the Egyptian secret police with software to nab dissidents. Seriously, WTF ?
Re: (Score:1)
or you could read the FS. It's _used_ by the British and was offered to the Egyptians. Never says offered by the British. I'm guessing it was offered by FinFisher. You going to get all arsey that the US uses the same OS that is used in Iran as well?
Taken from 1215.org I found Dissident guidlines (Score:1)
--never provide personal information that is not otherwise readily available
--never speak of anything illegal that you may have ever done
--never speak of anything illegal that others you know may have done
--do not get into speculative gossip e.g. about who does drugs or not
--do not leave personal papers lying around or unattended in public
--do not have strangers as overnight guests. They are poised to search your files
--do not write an email or a letter that you wouldn't publish in the New York Times
--do no
Liability (Score:2)
Re:Liability (Score:5, Insightful)
There's really only one solution: hold software makers libel for security vulnerabilities
The real answer is that dissidents need to start being more paranoid and more technically literate. A system that is used for personal entertainment should be kept physically separated from a system that is used to communicate with fellow dissidents.
we're all screwed... (Score:2)
The real answer is that dissidents need to start being more paranoid and more technically literate. A system that is used for personal entertainment should be kept physically separated from a system that is used to communicate with fellow dissidents.
Face it - against a determined powerful watcher even that is not enough:
Agent X: Drat, our target "Dissident-Man" is using a "throw-away" cell phone - we don't know who they are - and they never use it for personal things, so even if we continue to track it, it won't do any good!
Agent Y: Hey, did you notice in our records that it is almost always used by the same cell tower as the phone of "Pat Civilian"? Often just before or just after? Maybe we should have a "talk" with this "Pat"?
que scary music:
dun-dun-
Re: (Score:2)
My point was really about governments that spy on dissident groups' communication, as in this case from Vietnam:
http://www.eweek.com/c/a/Security/Google-Malware-Attacks-Target-Vietnam-Dissidents-498247/ [eweek.com]
Re: (Score:2)
I too worried about the free software movement when I wrote that. I think maybe if you set some sort of damage cap at "how much profit provider earns from software, directly or indirectly." Granted, in cases like iTunes or Internet Explorer, which are given away as "premiums" (kind of like banks used to give away toasters) this could be hard to calculate, but surely large company's have some sort of accounting basis for justifying how much they spend on these packages?
The point is that, in my observati
Re: (Score:2)
...and thus kill the free software movement.
How would you sue a software developed by hundreds of anonymous people?
Re: (Score:2)
By unmasking the anonymous users and taking the shirt off their back.
Re: (Score:2)
Re: (Score:1)
Proof (Score:5, Funny)
Yet another proof that Flash is dangerous! /duck
Re: (Score:2)
Why the fuck was Pope modded troll? It's a totally valid comment in this case.
OH NO!!!!! (Score:1)
Seriously? (Score:3, Funny)
Apple software that redirects you to a webpage where it requests to install Flash Player?
That's like Toyota's website sending you to a page about the Honda Civic.
The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.
Re: (Score:3)
The flaw may be with iTunes but the spying is done by trojan spyware that passes itself as Flash player. The title of this thing is obviously anti-Apple bashing at its finest.
There you have it folks, if any malware exploits a vulnerability in Apple software it's not Apple's fault, it's the virus writer's fault. To say otherwise would be Apple-bashing.
Now excuse me while I make the infallible decision to leave every door on my house swinging open while I'm not at home. If any hobos or thieves enter it is not my fault, I made no mistakes.
Re: (Score:3)
There's a vulnerability in iTunes but it's not that vulnerability that installs the malware. If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.
Re: (Score:2)
It relies on the user to install the malware, but the malware link wouldn't appear at all if iTunes used an HTTPS connection to check for updates
Re:Seriously? (Score:4, Informative)
There's a vulnerability in iTunes but it's not that vulnerability that installs the malware.
Yes it is. From TFA:
"Evilgrade leveraged a flaw in the updater mechanism for iTunes that could be exploited on Windows systems. Amato described the vulnerability: "The iTunes program checks that the binary is signed by Apple but we can inject content into the description as it opens a browser, with a malicious binary so that the user thinks its from Apple"
The only way you can argue that the updater isn't at fault is if you are going to blame the exploit that installs the malware? But by that definition, a manufacturer would never be assigned any blame for vulnerabilities, it would always be the person doing the exploiting. Does that make sense? Try this: "Microsoft bears no responsibility for any holes in Windows, even when it knows about them and doesn't fix them. The blame lies entirely with the exploit." Do you still agree with this logic when the manufacturer of the system is Microsoft, rather than Apple?
If I post the link to that particular website right here on Slashdot, by your logic that would mean Slashdot is now infested with spyware too.
Bad analogy. Slashdot isn't used as part of a Software Update system by software installed on the desktops of millions of people. Your iTunes updater isn't going to prompt you to install a new update - verified as being from Apple - because of a Slashdot post.
Re: (Score:2)
The only way you can argue that the updater isn't at fault is if you are going to blame the exploit that installs the malware? But by that definition, a manufacturer would never be assigned any blame for vulnerabilities, it would always be the person doing the exploiting. Does that make sense? Try this: "Microsoft bears no responsibility for any holes in Windows, even when it knows about them and doesn't fix them. The blame lies entirely with the exploit." Do you still agree with this logic when the manufacturer of the system is Microsoft, rather than Apple?
Windows 7 Ultimate EULA [microsoft.com]
26. LIMITATION ON AND EXCLUSION OF DAMAGES. You can recover from Microsoft and its suppliers only direct damages up to the amount you paid for the software. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.
This limitation applies to
- anything related to the software, services, content (including code) on third party Internet sites, or third party programs; and
- claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.
It also applies even if
- repair, replacement or a refund for the software does not fully compensate you for any losses; or
- Microsoft knew or should have known about the possibility of the damages.
Emphasis added.
Re: (Score:1)
Re: (Score:1)
how does it feel to constantly be Apple's bitch?
OpenOffice has the same vulnerability (Score:5, Informative)
And they haven't done anything about it for years, either.
http://blogs.oracle.com/malte/entry/evilgrade_and_openoffice_org [oracle.com]
Re: (Score:2)
I wonder if it's been fixed in LibreOffice?
Re: (Score:2)
I tested 3.4.4 and 3.3.4 (Latest on website now) and I couldn't even find auto-update functionality. Though I can see update functionality mentioned in the documentation:
http://help.libreoffice.org/Common/Online_Update [libreoffice.org]
So either they've pulled the functionality, or I'm looking in the wrong place.
Re: (Score:2)
Re: (Score:2)
It really is coming to something when Microsoft have been doing it right for over a decade but others who should know better still screw it up. Since the Windows 98 days Windows Update has used an IP address rather than DNS lookup and it also bypasses the hosts redirect file and any other stuff that attaches to the TCP/IP stack, and then the web site and updates themselves and cryptographically verified. Since 1998.
1,200 days? (Score:5, Funny)
Apple 'waited more than 1,200 days to fix the flaw
It's even worse than that
The waited more than a HUNDRED MILLION seconds.
I guess "more than three years" does not cut it anymore.
Re: (Score:3)
Article was obviously written by a new parent.
Re: (Score:2)
It is a simple question of scale. I could tell you my car's speed in decimetres per fought night but for ease of comparison km/h or mp/h might be easier. They don't call these things zero-day exploits for nothing; typically the value of the exploit rapidly decreases as news of it spreads and people take defensive action.
Unfortunately Apple failed to act, and it isn't an isolated incident. Nothing particular against Apple, any other company that produced a popular and in fact necessary bit of software that m
Oh well ... (Score:2)
OS X, Linux & *BSD are not affected.
Whoever uses Windows by it's own will it's asking for it.
Black hats (Score:4, Insightful)
Gamma International sells computer hacking services to governments, offering 'zero day' security flaws
These are the real blackhats - most 'hackers' don't sell their services to get people killed. Legalized blackhats, perhaps, but blackhats nonetheless.
foreign intelligence? Ha! (Score:2)
"installs a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services"
Nothing "foreign" about it!
How do you tell the difference? (Score:2)
Seriously, if I'm a software company, how do I tell the difference between
1) a prominent security researcher
2) a garden-variety hacker
Consider that the incoming notification will probably go to one of several public addresses, but probably to support, feedback, publicity or bugs. Now, do each of those people need to be trained to recognize certain names (which leads us back to original question). Or do they need to be trained to recognize a crank letter from a real letter (no objective means of doing so). O