Security researchers at Morphisec have discovered a new security flaw in iTunes. They found this vulnerability in iTunes zero-day, which was actively exploited by hackers. In their blog post, researchers explained that in the latest updater of iTunes for Windows, exists an unquoted path vulnerability.
What is the Latest Updater?
Although this latest updater, bonjour, was well researched. However, this unquoted path went under the radar and ended up appearing in iTunes. Bonjour is an updater that is packaged with iTunes. So, when you install iTunes, it gets installed. But when you uninstall iTunes, it doesn’t get deleted. It stays even after iTunes.
Apple included Bonjour because it helps Apple to deliver future updates, including the unquoted paths. It is installed under its own name in the software section and has a scheduled task to execute its process.
How Does this Bug Affect the Phone?
This is a very dangerous bug and threatens a lot of devices. Hackers abused Bonjour to gain control of its execution path and then point it to BitPaymer ransomware. Although it won’t receive admin control of your phone, it can evade antivirus under the legitimacy of Bonjour. In other terms, if a legitimate process signed by a verified vendor executes a borderline child process, the alert will have a low confidence score if the verified vendor does not sign the parent.
Apple release patch for Bonjour bug
Once Apple discovered the vulnerabilities through the researchers, they have patched the flaw with the released of iTunes 12.10.1 for Windows. However, iCloud also fall prey to this Bonjour bug, and the latest version of iCloud for Windows 7.14 was released shortly.
Attackers always find a way to exploit things, but this was different as Apple went through extreme lengths to test bonjour, but it didn’t come out full proof.
