We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
Apple developer website vulnerability plugged

Apple developer website vulnerability plugged

Phishing flaw closed after two months

Article comments

A vulnerability that could have led to phishing attacks against Mac OS X, iPad and iPad developers has finally been closed, according to the hacker group that flagged up the hole on an Apple development website two months ago.

YGN told Apple about the Arbitrary URL Redirect vulnerability and cross-site scripting issue on April 25, warning it could lead to phishing attacks on developers using the website. Apple acknowledged YGN's information on April 27, but didn't fix the hole. That frustrated YGN, which let news reporters know it would go public with the information in a short period of time even if Apple didn't correct the problem. One day after news reports on the situation, Apple fixed the problem.

"As Apple has replied that they have fixed the issue, we've released the information at our blog," the YGN Ethical Hacker Group wrote in an email today to ComputerworldUK's sister title Network World.

The tactics of the YGN Ethical Hacker Group are controversial because under U.S. law, an unauthorized scan is considered an attack or even a break-in. However YGN, which earlier this year identified security holes in the websites of McAfee and Oracle as well, counters that websites should not be full of known vulnerabilities, especially those in high-profile public view.

Share:

Comments

Advertisement
Advertisement
Send to a friend

Email this article to a friend or colleague:


PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.


ComputerworldUK Knowledge Vault

ComputerworldUK
Share
x
Open
* *