Researcher: Array of Apple Apps Vulnerable to "Gotofail" Attack

If you stopped using the Safari browser while patiently awaiting Apple’s OS X patch for the “Gotofail” security vulnerability publicized over the weekend, that’s smart.

Now strongly consider giving up Apple’s Calendar, FaceTime, Keynote, iBooks and Mail apps, as well as the Twitter Mac desktop client.

According to respected security researcher Ashkan Soltani, all of those products appear vulnerable to the same avenue of attack.

Here are some of the apps which rely on the vulnerable Apple #gotofail SSL library beyond Safari /cc @a_greenberg pic.twitter.com/ombDOOa01A

— ashkan soltani (@ashk4n) February 23, 2014

This is not a minor bug, as other reporters and security researchers have stressed.

I’m not going to talk details about the Apple bug except to say the following. It is seriously exploitable and not yet under control.

— Matthew Green (@matthew_d_green) February 21, 2014

An attacker could exploit the flaw to bypass the standard “SSL/TLS” security verification between devices and servers, enabling what’s known as a “man-in-the-middle attack.” Using this approach, a lurker can intercept the data flowing between your computer and a network connection, notably including a Wi-Fi signal in your neighborhood coffee shop.

Apple fixed the Gotofail fail for its mobile operating system on Friday, but has yet to issue an update for its desktop software. The company said Saturday that another patch would come “very soon,” but as of late afternoon Sunday it had yet to arrive.

This article originally appeared on Recode.net.

Will you support Vox’s explanatory journalism?

Most news outlets make their money through advertising or subscriptions. But when it comes to what we’re trying to do at Vox, there are a couple of big issues with relying on ads and subscriptions to keep the lights on:

First, advertising dollars go up and down with the economy. We often only know a few months out what our advertising revenue will be, which makes it hard to plan ahead.

Second, we’re not in the subscriptions business. Vox is here to help everyone understand the complex issues shaping the world — not just the people who can afford to pay for a subscription. We believe that’s an important part of building a more equal society. And we can’t do that if we have a paywall.

So even though advertising is still our biggest source of revenue, we also seek grants and reader support. (And no matter how our work is funded, we have strict guidelines on editorial independence.)

If you also believe that everyone deserves access to trusted high-quality information, will you make a gift to Vox today? Any amount helps.

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via