Slashdot Mirror
Users Report Foul Play In App Store Rankings, Purchases
An anonymous reader writes "Two iPhone App developers have spotted what appears to be a hacking of the App store rankings by a rogue developer. The rankings in the books category of the US iTunes store features 40 out of 50 apps by the same app developer, Thuat Nguyen. What's more concerning is that it seems individuals' iTunes accounts have been hacked to make mass purchases of that one developer's apps." Among the comments attached to the linked story is one which suggests the security problem may lie elsewhere.
Perhaps this is just another reason why I don't use iTunes. If I like an artist I download, I'll buy their CD - if not, I delete it. And makes it much easier to convert a CD to ogg or flacs than with a lot of their Apple's AAC crap.
The only fowl play I've found so far is Angry Birds.
Guys this is apple! So it's not a hack or flaw!
Apple is taking the hassle of you actually wanting to buy things. Let Apple (Or un-approved 3rd party) decide which apps you're going to buy...
Laters Sol "Have you found the secrets of the universe? Asked Zebade "I'm sure I left them here somewhere"
Amazing that this only breaks into the news over a long weekend?
Banks and CC companies will expect some purchases "out of the ordinary" on long weekends, and you won't be getting the first-line staff when you complain to Apple, etc.
Last month, a user posted a forum comment stating, "I am going to tell you the truth about what has been going on with your account." The anonymous user then explained, "let’s say you are a Chinese guy or girl with an iPhone or iPad and you want to get some music, movie or app. How you do you do it? You go to http://www.taobao.com/ The (by far) largest online market in the world and type iTunes in the search bar. Immediately you will be presented with a list of more than 7,000 items.
"You want to save money, so you filter the list to show only items under RMB25.00- (US $3.60) and still you have more than 3,600 offers. So you pick some one at random like, as an example, this one: http://item.taobao.com/item.htm?id=5516054242. You open the online chat and you transfer him RMB22.00 (US $3.20). He ask you in the online chat to provide a new iTunes account name and password, and you comply: User: qiuwge3foe3333@yahoo.com Password: qwer34567
"He asks you to wait 10 minutes online. He has already a number of user accounts under surveillance, so he enters in the iTunes account of his victim, change his/her username and password to the one you provided, and come back to ask you try it and approve the transaction so Taobao.com releases his money. Even if you cant read Chinese you can see very clearly in his item description that this account will not last more than 24 hours (the time for his victim to see the charges mounting and then cancel the credit card).
"He claims that he selects 'his' accounts so you can drain at least US $250.00 from them before they get cancelled. He urges you to be fast and buy and download as fast as you can. Start immediately! Keep the download going on for the full 24 hours! There is no warranties on how long it will last! Because he already changed the username and password, the victim can’t stop you.
More details here though so far there's no explanation of how the accounts are getting hacked.
Just avoid hold it in that way.
Any bets? Sounds like there were suddenly a bunch of phished accounts that got "activated."
This is a Problem In Chair Not In Computer problem. If users are stupid enough to respond to the iTunes phishing scams that circulate then they shouldn't be surprised when someone uses their details.
My suggestions:
1. Report any fraudulent transactions to your credit card company/bank so the transactions are stopped. And get your card cancelled.
2. Login and choose a secure password morons
They're buying it wrong. They shouldn't buy it that way.
Thuat chance of these rankings being legit. Nguyen piss off if you believe they are.
Faster this appspam is removed faster we can Wok on Bai. Sheesh.
Other problem with iTunes, "All sales are final." ....
From Terms and conditions, security section:
"You are entirely responsible for all activities that occur on or through your Account, and you agree to immediately notify Apple of any unauthorized use of your Account or any other breach of security. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. "
That's so Steve Jobs.
Some banks / credit cards allow you to generate temporary credit card numbers with a limit that you specify. The ones I've seen in use also tie themselves to the first vendor they are used with. The temporary credit card number is effectively an alias for your real number. Personally I think these temporary numbers are far better to use online than a real credit card number.
--
Perpenso Calc for iPhone. Classic Scientific and HEX functionality plus RPN, fractions, complex numbers, 32/64-bit signed/unsigned bitwise operations, UTF-8, IEEE FP decode, and RGB decode with color preview.
The exact same thing used to happen (and possibly still does) with PalmOS apps and the associated online stores. Certain developers, mostly asian-based, would create very basic, sometimes useless apps, and list them on stores like Handango for low, low prices. Then they'd suddenly skyrocket in the listings. If you grabbed a demo version, you could see that a lot of these applications were complete duplicates with just the name changed. They'd bank on some legit sales once the app was ranked, but boost their own sales with stolen credit cards/accounts. Every now and then, someone would get delisted. I'm surprised, given that its been years since I did anything on the PalmOS (had a few apps myself, only I just created them out of boredom and could care less about sales), that this wasn't foreseen by Apple. It's a pretty basic scam.
It is not phishing, it is something worse. Some Apple guy told a friend "change your password immediately" when he contacted them regarding 4-5 apps he didn't actually buy showing up on his order history.
It really sounded like some "password stolen" issue to me but I really doubt it is phishing as I know the guy, not a type who will be a phishing victim.
Note that it is a theory only, I don't have the actual data nor I am an iPhone customer.
Ignoring the 'X OS is more secure then Y OS' debate, nothing is immune to being hacked. It just takes times and a desire. Like every system, if someone wants to break into it enough then they will find a way. Something like this would have been a targeted attack which pretty much makes any normal security moot since the way it was done would have been unique to this system. Its a tailor-made attack and nothing short of disconnecting the iTunes server could have prevented it.
On a side note though, it was an interesting move for them to do this on a long weekend since it's the 4th of July holiday weekend in the US and since this is a US company they no doubt have a lot of their staff off so they can enjoy the holiday. Least amount of physical presences and security to watch out for such an attack. Tomorrow might be one hell of a day at the office for Apple though.
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
It does deserve to be noted as a colossal mistake to have allowed reviews by people who hadn't even downloaded a given app.
When SuperMonkeyBall was released, there were over 3,000 reviews. The average star rating was a high 4. I paid $9 for it and found out it was a horrible port with horrible controls and actually sucked. Then I read the reviews and they were mostly from iTunes users who were fans of the console version of the game and wanted to mouth off about how great it is. Few of them had actually played it on the iPhone.
$5 / month hosted VPS on linux = awesome!
A lot of these people seem to come across as "tech savvy". So - why do they have their primary credit card accounts linked to the app store? I have one debit card that I use online. Guess what? It's almost always EMPTY. Balance of zero. No cash onhand. DEBIT cards can't be used to make mass purchases when there is no balance on them. Each week, when I get my pay, I pretty much know what I want to purchase online - I just deposit enough to cover those purchases, and a dollar or two more.
Hey hackers - good luck trying to rip me off!!
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
After reading the article, the other linked article, and the comments posted on the linked site, I have to ask what's more likely here: that approximately 30 people out of 100+ millions of iTunes users have infected systems with key-loggers and were phished, or that the App Store has some huge security problem?
Just saying.
Apple doesn't care. Even if it was 100% their problem.
They don't care.
There are currently apps on the app store which are fake. They aren't as described. I grabbed one of them when they had a "Free" day. They're described as epic stickman fighting games. But the screenshots bear no resemblance to what the description is and feature no UI. They're filed under games, but feature no gameplay. They are all the same 4 low res stickman videos they pulled off some site.
There are several copies of this app with different names. They've all been reported multiple times but apple has not removed them, made them change the description or even categorize them appropriately.
I be some user just entered
<script>
before a comment.
Control the content you control the users, right?
We should start a new Slashdot and return control to the geeks. It actually wouldn't be that hard to get some users to
Out of interest (and because you seem like a rational debater), could you enlighten me on the subject of the Apple app store's rating system? I'm an Android user myself, and I don't know how things are in Apple land. In the Android Market, you can rate apps with 1-5 stars (1 being 'poor', 3 being 'average', and 5 being 'excellent').
You see, I would like to investigate if app stores could be better compared on quality rather than quantity. It seems to me that it would be better to have one thousand apps with a high average rating, than a million apps with an appalling average rating.
There are some Android Market ratings available, although I'm sure more detailed ones can be gotten hold of. I do note that only one fifth of all rated apps have a single star, and two fifth have the highest rating. This is based on nearly 900.000 ratings, but I do not know the ratio of rated vs. unrated apps.
"Good news, everyone!"
Shit. I just got told. I need to go to the ER to make sure I wasn't also served. Last time this happened Apple went Intel. Hopefully it isn't that bad. Oh god it hurts so much. :(
Non impediti ratione cogitationus.
I agree that it's probably phishing
It's most likely that the app itself is asking for the iTunes username and password. This could nominally be for an in-game purchase, or it could be prompting claiming it was for some other reason, such as "activating the application", where people are willing to put in the information because they've already thrown money at the application. Or it could just be asking for them with no reason given.
It's really hard to avoid this kind of trojaning, if it's either time activated, or activated by the nefarious application checking for an activation token on a remote web site.
One thing that could be helped is if the request is for the nominal in-application purchase; however, the fix lacks a little convenience for the user, which would in turn be likely to reduce the number of in-application purchases: queue the request, and handle the actual purchase through an Apple-supplied application that goes through the queue and has you OK or abort the purchase on a case-by-case basis. This would also have to deal with the enqueued request records not being accessible to the enqueueing application, once enqueued, to prevent rewriting of data in other enqueued requests by a nefarious application to appear to be the request requested, but to actually contain a different payment target as payload.
Most attacks, however, will probably just pop up a request dialog and trust that most users will just be foolish and enter the information requested, and so would not be mitigated by such a (complicated for the user) prevention scheme.
-- Terry
Let's make sure I understand the problem:
1. Rogue developer writes crap app and gets in App Store
2. Rogue developer hacks iTunes account and purchases his own app with it
3. Apple charges hacked account and transfers funds to rogue developer
4. Hackee finds out he's been ripped off and has to fight with Apple for refund
Solution: Replace step 3 with: Apple transfers funds for untrusted developers to an escrow account for 30 days before paying out. A developer can become trusted after a set amount of sales or time, whichever comes last.
4. Apple cheerfully refunds money because it never left its pocket. Minus a handling fee if Steve is feeling evil.
Never let a lack of data get in the way of a good rant.