App Store, Hacked. (Updated: iTunes Accounts too.)

The Next Web ^ | July 4th, 2010 | Zee

[PugetSoundSoldier]

Two iPhone App developers have spotted what appears to be a hacking of the App store rankings by a rogue developer. The rankings in the books category of the US iTunes store features 40 out of 50 apps by the same app developer, Thuat Nguyen.

What’s more concerning is that it seems individuals iTunes accounts have been hacked to make mass purchases of that one developer’s apps.

[PugetSoundSoldier]

Not so much - who cares about when the product is downloaded? The transaction has already occurred (money gone).

By letting the thieves still benefit from their theft AFTER the fact. If you locked out downloads when the charges are disputed, then the thieves do not benefit nearly as much as thus the desire to steal accounts is reduced. You don't let the criminals keep what they take, it reduces the impetus to steal in the first place.

Exactly how is Apple to know the account was "highjacked"? I guess the author of this article is under the impression that Jobs & Co are omniscient.

The same way my HSBC and Bank of China cards operate: if suddenly there is a huge increase of activity from a given vendor or my normal spending (like a normal $5-$10 per month app store purchase rate skyrockets to $400, or an account that typically sees $0 to $50 activity per day jumps up to $100) then it's flagged and held until I authorize it.

And I'm sent an SMS for every transaction on my account, so I know immediately what's going on. I always receive the SMS even before the credit card receipt has been handed to me.

And here's the cool part: I'm sent an SMS for EVERY transaction, if it succeeds or not. If it's flagged, I can text back "OK" or "YES" and the transaction that was held is immediately released and processed. If I do not answer, it's held. That means for suspicious activity beyond my normal patterns I am asked to confirm it.

A lot more could be easily done, and it can be automated as well. I know BOC has about 400 million clients, and they are able to provide this service without an issue, so it's not the number of users that is the problem...

[for-q-clinton]

And yet I have been on line since before Earthlink, and I have never had any kind of Virus, can you say the same? Remember Genie? Something like $8.00 an hour, as I recall.

That makes two of us and I pretty much use Windows on all my systems since that time...including windows 3.11 and win9x.

Does that mean those platforms are secure since I never had a virus? Absolutely not. Just because you didn't have a virus on teh Mac doesn't mean it was secure.

[for-q-clinton]

Swordmaker,

Can you please correct BunnySlippers on her attack. Not one item in her post was constructive.

thanks

[dayglored]

>> There will always be careful people like ourselves

> The point is I am not careful, I run out of the box OS, and use no third party protection at all. I do however reject offers to get free anything.

No, you -are- careful. You don't click on the offers on "free download" or porn sites, and probably don't click on every random link that people send you in email, either. That takes care of the vast majority of infection vectors right there.

I run Windows (Win7), and Mac OS-X, and Linux, and NetBSD. All without antivirus protection except for two Win7 boxes: the one I have available at home to other family members and visitors, and my main machine at work, which runs AV because as the Director of System Admin, I feel I should do what I require our users to do. I require them to run AV because they -do- click on random and dangerous links, despite our constant warnings. *sigh*

When you say "out of the box OS", do you mean you don't apply updates and patches? I'm not sure what you mean by that phrase...

[BunnySlippers]

First of all, do you correct every “non-constructive” post on FR? No, you do not.

There is a small cadre of people on FR who so hate Apple that they have to make any post about the company a living hell. Perhaps you can right that wrong. But behind many posts on Apple threads, there is a history behind a post. I do not go on non=Apple threads and stir the post, these people do on a routine basis.

Secondly, Swordmaker is not in charge of disciplining me. I’m sure he won’t.

Now, be a good Freeper and clean up every non-constructive post on this site so that you gain some credibility. There are many.

[for-q-clinton]

I think I will focus on the threads I’m interested in especially when swordmaker promised me that post like yours never happen from the good natured mac fans.

So I’m kind of shocked to be honest that I saw such an obvious and blantant disregard of his promise. So either swordmaker was lying when he said it never happened or blind to the obvious because of his faith in Apple.

[for-q-clinton]

Exactly. For example, I have a windows homeserver on the Interent for years and not one hack or virus has attacked it. And that device truly does sit on the Internet (well sort of)...I redirect the ports I want open to it, but it is accesible from the Internet.

Is it a guarantee it won’t be hacked....no but so far it hasn’t failed me. That doesn’t mean I can say it’s impossible to hack though and that’s where the macbots really drive me crazy when they claim or imply that macs can’t be hacked.

[BunnySlippers]

You should cc Swordmaker when alluding to him.

You give Conservatives a bad name by berating others for using their OS or phone of choice. I like to buy items that work, are well designed and deliver what they promise. Apple comes through in every product I have bought from them.

If someone else likes another platform, that is fine by me. I assume they have made an informed choice and know what is best for them.

What gives you pleasure about going on Apple threads and insulting people who have made the choice to use Apples is baffling.

[blu]

Dude, we know you hate Apple. I've had it with you. How about you just come to every Apple thread (which you already do) and just post "Kilroy was here" instead of all your other blatherings? That way, we'll know that you've yet again expressed your disdain for a company THAT MANY OF THE PEOPLE WHO POST ON THE APPLE THREADS LIKE.

Unless, of course, you just do this to get your jollies.....

Back on topic, I just buy iTune gift cards...keeps me cheap, and an unlikely target.

[PugetSoundSoldier]

Hi blu,

Who started this thread? Who gave the heads up about the security breach? Who was thanked by Swordmaker for the thread?

You’re welcome.

[for-q-clinton]

You should cc Swordmaker when alluding to him.

I did. If you look at the post above he was clearly sent the initial post. It's up to him to follow it from there.

Seriously though do you have anything constructive to say about these issues with apple or are you just hear to confuse everyone so they won't pay attention to the big issues coming out of apple lately?

[blu]

Who started this thread? Who gave the heads up about the security breach? Who was thanked by Swordmaker for the thread?

Who loves to stir the pot?

No, really, YOU'RE welcome!

[for-q-clinton]

What gives you pleasure about going on Apple threads and insulting people who have made the choice to use Apples is baffling.

I believe it was you calling people names in this very thread thread.

And when I called you out for that diruptive behavior you are tyring to obfuscate by making it look like I'm the disruptor. I'm hear to talk about the issues not the people.

[PugetSoundSoldier]

One man’s heads-up is another man’s stirred pot, evidently.

You know, each thread says who started it and what it’s about. If I’m such a bad person in your eyes, you can choose to ignore my threads...

[for-q-clinton]

Attacking the messenger won’t make these issues go away.

[BunnySlippers]

I must admit that I have taken to emulating the behavior of the un-named Trolls.

[aMorePerfectUnion]

This happened to me.

I learned about it because my iPhone would no longer update applications - even though showing updates were availabl

I went to my American Express online account and saw things
I hadn’t purchases. I called them and they handled the
fraud. I contacted Apple. They gave me back control of my
account (the scammer had changed my password and email).

All is well. Keep an eye open.

ampu

[PugetSoundSoldier]

Thanks for the information. You’re far from alone among FReepers - there are many here who had the same problem, and because right now there is all the reward and none of the failure for those who steal your money to buy apps (because Apple allows the new account - which used a closed credit card - to download those apps well into the future), it will continue to happen in the future.

[aMorePerfectUnion]

PSS,
I accept the fact that when you use your credit card
online, you run risks. Amex and Apple came through
and handled everything well, for which I am appreciative.

If there are solutions, let’s hope they implement
and strengthen them.

On the other hand, I had a great story to tell my
kids and tell them why you never use your bank atm
card online.

iPhone is the greatest electronic gadget I’ve ever
owned - far better than my 12 windows boxes of varying
kinds over the years, far better than my palm pilots
(many), and an incredible implementation of so many
contributing technologies originally created by many
other companies.

Just the fact that the Android has modeled its look
and feel after Apple and launched an app store says
it all - and Google isn’t alone in copying Apple.

Competition is a great thing for us all. Solutions
come from problems and stronger competition. We’ll all
come out ahead.

Fortunately, I no longer have to be a Microsoft slave -
donating my time continually to keeping one of their
systems running. This week I switch my wife over to a
Mac and I’m out of the Microsoft unpaid worker status!
Can’t wait.

ampu

[PugetSoundSoldier]

I’d say that Apple and Android are copying HTC TouchFLO (which predates both in the cell phone market), so you can thank HTC for having the great inspiration and affect on cell phone interfaces.

Of course, I fully expect this post to be attacked as FUD and lies because it points out the truth, rather than what some would like to be perceived as true...