Submission + - iTunes Flaw Allowed Spying on Dissidents 3
Hugh Pickens writes writes: "Democracy and free speech activists worldwide have something new to worry about — cyberwarfare via iTunes — as the Telegraph reports that Gamma International sells computer hacking services to governments offering "zero day" security flaws, that allows access to target computers "with the ability to take control of the target systems functions to the point of capturing encrypted data and communications." FinFisher spyware, known to be used by British agencies and offered to Egypt’s feared secret police, takes advantage of an unencrypted HTTP request that is filed by iTunes when Apple Software Updater is inactive redirecting users' web browsers to a customized web page that pretends Flash is not installed on the user's computer then installing a sophisticated piece of spyware that sends info on a user's activities directly to foreign intelligence services. The latest iTunes software update, 10.5.1, released on November 14 appears to have fixed the exploit FinFisher used after a prominent security researcher warned Apple about this dangerous vulnerability in mid-2008, yet Apple "waited more than 1,200 days to fix the flaw,” writes security researcher Brian Krebs. "The disclosure raises questions about whether and when Apple knew about the Trojan offering, and its timing in choosing to sew up the security hole in this ubiquitous software title.""
