socialmedian: Apple's iTunes Affiliates site briefly subjected to image swaps

Add News Flash

User-submitted headlines for this story

Clips

Apple's iTunes Affiliates site briefly subjected to image swaps

Source: The Unofficial Apple Weblog

Nov 04, 2009

Summary

Filed under: Hacks, iTunes, Apple

Our friends over at OS X Daily passed along their story noting that Apple's site for iTunes Affiliates was vulnerable to a cross-site URL trick, letting you substitute your own images for the ones normally displayed on the page. Since the site is intended to let websites display a custom top banner, this was 'as designed' -- at least until jokesters began taking advantage.

The trick works (or at least, it did) by taking the default URL from the web browser and replacing a few things like the artist name, album name, album thumbnail source and the image link.

The Internet moves pretty fast, though. As I was typing this, Apple removed the top banner altogether, preventing the customized image display. No more pranks for us.

In any case, OS X Daily pointed out that the image issue could allow malicious folks to redirect would-be Apple visitors to malware sites or other bad destinations. Even an innocent image viewer that appears within an iframe on a branded page can cause problems; that's what the folks at Wired found out last Janu ...Read the full article

Comments (0)

Add Your Comment