BlackHat presentation demo vids: MobileMe

This write-up demonstrates weaknesses in Apple’s MobileMe service: a password-reset flow that can be abused using easily obtainable personal data (birthdate and secret-question answers) and an XSS vulnerability via an iPhone device name. The authors show how these flaws could enable account takeover and persistent access to mail, calendar, location and embedded JavaScript, illustrating the risk with a targeted demonstration against Steve Wozniak; the XSS was later patched by Apple.