Apple has rectified an alarming security oversight that potentially allowed total strangers to read the personal contact details of several high-ranking Apple employees and all registered developers. The surprisingly easy technique was discovered by Apple developer Jesse Jarvi and was initially dismissed by Apple, until the well-known Apple news website 9to5mac took up the issue on his behalf.
Registered Apple developers who have access to the Developer Center website can use a program called Radar to file bug reports. The program is not generally made available to the public, but was till now downloadable using an easily shared and guessable Web link.
Anyone wishing to use Radar needs to log in using their registered developer credentials, and only those IDs in Apple's database are granted access. However, a directory search tool within the program was functional if a user's ID was rejected.
Users could thus simply search for anyone by name - including Apple employees - and were presented with their email addresses, personal phone numbers, and more.
9to5mac says it reported the issue to Apple following which the Developer Center was briefly taken offline and the problem was rectified. The website only published its knowledge of the matter after it had been fixed. Radar is also no longer available so easily. Jarvi has separately stated that he attempted to contact Apple but was rebuffed with "arrogant canned responses".