I recently bought Little Snitch because it was on sale, and just found something strange…
I launched iTunes to download an app that’s currently available for free (ok, so I am a cheapskate… ;-)), and when the actual download was about to start Little Snitch asked for confirmation to allow iTunes to connect to phobos.apple.com on port 80, meaning that the download is not protected by SSL…
IMHO this is a big security risk since it allows attackers to manipulate your download and replace the original app by another one (e. g. one that contains malicious code).
I can’t see any reason why Apple would intentionally not protect downloads by SSL — it just seems to be very bad, careless design… 🙁
What do you think?
I thought about it again, and I found that I did not take into account that Apple eventually protects the downloads by other means, e. g. by signing the downloads cryptographically. I sincerely hope they’re doing this…
If I find the time I will perform a network trace on a complete iTunes download session, maybe that gives a clue…