Re:Apple AirTag Bug Enables ‘Good Samaritan’ Attack
by rjmunro on Wednesday September 29, 2021 @06:14AM
(#28691953)
This isn't an Airtag bug as such. This is a bug in displaying user information on Apple's website, it just happens to be in the part that was made for Airtags to link to. It's a simple XSS vulnerability.
The fact that Apple let such a stupid bug into their web site is worrying enough. The fact that they don't acknowledge and fix it within hours, when reported to them via their bounty program means that it's not just "don't scan Airtags" you should be thinking, it's "don't visit apple.com / icloud.com / other Apple websites"
Re:Apple AirTag Bug Enables ‘Good Samaritan’ Attack
by fortran77 on Wednesday September 29, 2021 @09:39AM
(#28693468)
> The fact that Apple let such a stupid bug into their web site is worrying enough.
Those recent articles about large groups of employees pushing the company to take stands on anything but work-related matters makes me wonder if the sane, competent employees have either left or have "mentally checked out."
See: https://www.nytimes.com/2021/09/17/technology/apple-employee...
It’s on Apple to convince us that it is safe to scan Airtags. And currently their messaging is that they don’t care?
Then I ain’t scanning no Airtag.