Apple Took 3+ Years to Fix Fin Fisher Trojan Hole
Summary: Security researcher Francisco Amato warned Apple on July 11, 2008 that the iTunes update mechanism could be abused to push malicious software, and Apple waited more than 1,200 days to fix the flaw, contacting him only on Oct. 28, 2011 to confirm credit for the iTunes 10.5.1 patch. The hole was the one FinFisher, a remote spying Trojan marketed to governments including Egypt and Germany, advertised it could exploit by disguising itself as an iTunes update.
Why it matters: Apple's own earlier patch study averaged 91 days across four dozen flaws, with a worst case of 245 days - this one ran past 1,200, and the researcher said it should have been trivial to correct. The updater trusted a binary it never verified came from Apple, so a user on a hostile network could approve what looked like an Apple update and never know code had run.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026