Two days ago Apple introduced Apple News+, an addition to their Apple News app which offered access to 300 magazines and subscription newspapers like the Wall Street Journal for $9.99 per month, something Apple said was worth $8000 per year.
It turns out Apple has not exactly protected that value very well. Well-known iPhone hacker Steve Troughton-Smith has already broken the rather flimsy security around the premium content.
He found the service does not protect the content with DRM, and that the content is available for anyone to download as long as you know the right URL.
In addition, the app also offers up all the URLs neatly to all Apple News users in the manifest of the app, allowing anyone to download a full magazine for free.
A likely reason for the flimsy security is that the Apple News desktop app is a port of the iPhone app, where the operating system was expected to provide much of the security. Even this, however, seems poor performance for a company Apple’s size, though of course, the feature is really just a minor upgrade from Texture app which Apple purchased and clearly integrated cheaply.
Apple will presumably fix the feature, but until then intrepid hackers will enjoy reading about Iran’s Intrepid Nomads for free.
source
