Apple plugs iTunes Ghost Click hole
Apple has updated its iTunes software to correct a security shortcoming that offered the potential for miscreants to mount man-in-the-middle attacks and appears to have played a central role in the infamous Ghost Click botnet scam.
iTunes 10.5.1, released on Monday, is a cross-platform update that addresses a flaw that's most acute on Windows systems. Prior to the update, hackers had the potential to intercept update queries between the iTunes client on a user's Windows machine and Apple. This might have been abused to offer a Trojaned version of iTunes, or – more likely and much easier to pull off – redirect surfers to a site punting fake anti-virus (AKA scareware) or running click-fraud scams.
The threat is most acute when Apple Software Update for Windows is not installed. In these cases, a user's default browser might be opened to a location under the control of hackers that poses as an Apple site. Apple Software Update is included with OS X so the risk is a fair bit less for Mac fans. Nonetheless Mac users also need to update.
