Slashdot Mirror
Users Report Foul Play In App Store Rankings, Purchases
An anonymous reader writes "Two iPhone App developers have spotted what appears to be a hacking of the App store rankings by a rogue developer. The rankings in the books category of the US iTunes store features 40 out of 50 apps by the same app developer, Thuat Nguyen. What's more concerning is that it seems individuals' iTunes accounts have been hacked to make mass purchases of that one developer's apps." Among the comments attached to the linked story is one which suggests the security problem may lie elsewhere.
Perhaps this is just another reason why I don't use iTunes. If I like an artist I download, I'll buy their CD - if not, I delete it. And makes it much easier to convert a CD to ogg or flacs than with a lot of their Apple's AAC crap.
The only fowl play I've found so far is Angry Birds.
Guys this is apple! So it's not a hack or flaw!
Apple is taking the hassle of you actually wanting to buy things. Let Apple (Or un-approved 3rd party) decide which apps you're going to buy...
Laters Sol "Have you found the secrets of the universe? Asked Zebade "I'm sure I left them here somewhere"
Last month, a user posted a forum comment stating, "I am going to tell you the truth about what has been going on with your account." The anonymous user then explained, "let’s say you are a Chinese guy or girl with an iPhone or iPad and you want to get some music, movie or app. How you do you do it? You go to http://www.taobao.com/ The (by far) largest online market in the world and type iTunes in the search bar. Immediately you will be presented with a list of more than 7,000 items.
"You want to save money, so you filter the list to show only items under RMB25.00- (US $3.60) and still you have more than 3,600 offers. So you pick some one at random like, as an example, this one: http://item.taobao.com/item.htm?id=5516054242. You open the online chat and you transfer him RMB22.00 (US $3.20). He ask you in the online chat to provide a new iTunes account name and password, and you comply: User: qiuwge3foe3333@yahoo.com Password: qwer34567
"He asks you to wait 10 minutes online. He has already a number of user accounts under surveillance, so he enters in the iTunes account of his victim, change his/her username and password to the one you provided, and come back to ask you try it and approve the transaction so Taobao.com releases his money. Even if you cant read Chinese you can see very clearly in his item description that this account will not last more than 24 hours (the time for his victim to see the charges mounting and then cancel the credit card).
"He claims that he selects 'his' accounts so you can drain at least US $250.00 from them before they get cancelled. He urges you to be fast and buy and download as fast as you can. Start immediately! Keep the download going on for the full 24 hours! There is no warranties on how long it will last! Because he already changed the username and password, the victim can’t stop you.
More details here though so far there's no explanation of how the accounts are getting hacked.
Just avoid hold it in that way.
Any bets? Sounds like there were suddenly a bunch of phished accounts that got "activated."
Refined that for you.
They're buying it wrong. They shouldn't buy it that way.
If you know how the name Nguyen is supposed to be pronounced, you'll be completely blind to the second half of this attempted joke ("attempted joke"---almost sounds like a crime, doesn't it?)
________
Entranced by anime since late summer 2001 and loving it ^_^
Other problem with iTunes, "All sales are final." ....
From Terms and conditions, security section:
"You are entirely responsible for all activities that occur on or through your Account, and you agree to immediately notify Apple of any unauthorized use of your Account or any other breach of security. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. "
That's so Steve Jobs.
Some banks / credit cards allow you to generate temporary credit card numbers with a limit that you specify. The ones I've seen in use also tie themselves to the first vendor they are used with. The temporary credit card number is effectively an alias for your real number. Personally I think these temporary numbers are far better to use online than a real credit card number.
--
Perpenso Calc for iPhone. Classic Scientific and HEX functionality plus RPN, fractions, complex numbers, 32/64-bit signed/unsigned bitwise operations, UTF-8, IEEE FP decode, and RGB decode with color preview.
Ignoring the 'X OS is more secure then Y OS' debate, nothing is immune to being hacked. It just takes times and a desire. Like every system, if someone wants to break into it enough then they will find a way. Something like this would have been a targeted attack which pretty much makes any normal security moot since the way it was done would have been unique to this system. Its a tailor-made attack and nothing short of disconnecting the iTunes server could have prevented it.
On a side note though, it was an interesting move for them to do this on a long weekend since it's the 4th of July holiday weekend in the US and since this is a US company they no doubt have a lot of their staff off so they can enjoy the holiday. Least amount of physical presences and security to watch out for such an attack. Tomorrow might be one hell of a day at the office for Apple though.
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
It does deserve to be noted as a colossal mistake to have allowed reviews by people who hadn't even downloaded a given app.
When SuperMonkeyBall was released, there were over 3,000 reviews. The average star rating was a high 4. I paid $9 for it and found out it was a horrible port with horrible controls and actually sucked. Then I read the reviews and they were mostly from iTunes users who were fans of the console version of the game and wanted to mouth off about how great it is. Few of them had actually played it on the iPhone.
$5 / month hosted VPS on linux = awesome!
After reading the article, the other linked article, and the comments posted on the linked site, I have to ask what's more likely here: that approximately 30 people out of 100+ millions of iTunes users have infected systems with key-loggers and were phished, or that the App Store has some huge security problem?
Just saying.
Apple doesn't care. Even if it was 100% their problem.
They don't care.
There are currently apps on the app store which are fake. They aren't as described. I grabbed one of them when they had a "Free" day. They're described as epic stickman fighting games. But the screenshots bear no resemblance to what the description is and feature no UI. They're filed under games, but feature no gameplay. They are all the same 4 low res stickman videos they pulled off some site.
There are several copies of this app with different names. They've all been reported multiple times but apple has not removed them, made them change the description or even categorize them appropriately.
I be some user just entered
<script>
before a comment.
Control the content you control the users, right?
We should start a new Slashdot and return control to the geeks. It actually wouldn't be that hard to get some users to
If your password is "!!Hell0Kitty77KeRt*?Captain"
HEY! Where'd you get my password?! Dammit. I knew I should have gone for Sailor Moon instead of Hello Kitty.
Canada: The US's more awesome sibling.
Ratings on the Android market place seem to be even worse than those described above for the Apple app store. I frequently see people giving apps one star because it crashed on their phone, even though their phone is often either not on the supported list (usually because it lacks the resources to handle said app), or even if the developer specifically states that it doesn't work on handset X for reasons a, b and c. Alternately I see spammers everywhere giving five stars but not because they've even used the app, just because they want to post a link to their website in the comments. I'll always use proper app review sites to determine which apps are actually worth using - the reviews on the market place are worse than useless.
In fact, the whole filtering of the market place is one of the few disappointments with my HTC - I don't know if this is because people are expected to go online to search, but there are just too few options. I can either search on top rated (which is split into paid and free, but is rubbish for the reasons I've already stated) or "just in", which I assume is ordered by timestamp, but is a mix of free and paid and seems to be useless anyway because it doesn't order by the original release date of the app, but rather by the last version update - so you end up with the position that apps are being updated several times a week, I don't know if this is a cynical move to stay at the top of the "just in" list or if these apps really are being updated for the better, but either way it has the same result on finding anything.
And don't even get me started on the millions of useless screensaver/wallpaper/soundboard/etc apps. Why release one app which allows users to select from 1,000 different wallpapers using a web service when you can just package them as 1,000 different apps each with only 1 wallpaper and flood the hell out of the market place? Ugh, indeed.