Slashdot Mirror
More Trouble In Apple's App Store
quickOnTheUptake writes in to update the story of foul play in Apple's App Store, which we talked over on Sunday. The Next Web, which broke the story, now provides evidence of rampant App Farms used for theft in the store. Here is a summary of the problems TNW has seen, which includes large-scale break-ins of the App Store accounts of users worldwide. Apple has responded to the initial reports, has disabled the account of the initially fingered rogue developer, and has called on those whose accounts were misused to change their password and credit card. Both TNW and Engadget, at least, believe the problems go far deeper than Apple is admitting.
The title bar was red!
...oh, like the antenna issue?!
Wait, wasn't this the whole reason Apple wanted to approve apps - so they could keep the garbage out?!
Problems or not, these apple stories are starting to feel like the slashdot version of Orwell's two minutes of hate.
What happened there?
They won't allow flash or 'widgety' apps yet allow apps that do noting but get the developer points.
A developer with almost 5,000 apps?
So much for that 200,000 apps in the apple store.... perhaps half are fake?
I know someone who works in the fraud prevention business and they allege that iTunes purchases and credit card fraud are strongly correlated. Their story goes like this: an iTunes purchase is made for an unknown app, and within minutes a very high value (basically max-out) charge is placed on the same card. The catch is that the max-out charge is placed with an *actual* card (presumably a cloned card) and since it is incredibly unlikely that every case is fraud abuse (a made up 'theft' story by the cardholder) there is something that iTunes is either doing directly or indirectly that is enabling this activity.
Now the question for the armchair detectives is: is the iTunes purchase the moment of the leak of the card info (through some sort of hacked app), or is the iTunes purchase a test mechanism for the already stolen card info? Not being a big Apple person I haven't spent much time buying from the App store; is it possible to buy an app for someone elses' device, or for a device that doesn't exist yet?
The hackers attempted to order a macbook pro. I called Apple support- who kept asking what product I was having a problem with. One insisted that I was viewing the Apple website through a Mac, so therefore the problem was actually with the Mac.
Apparently they have no technical support/hacking section for their website- account issues don't exist according to them. I was finally able to reach level 2 tech support after faking a problem with my Macbook; where the account was flagged and order canceled.
www.GrenadeHop.com
Isn't this why you don't put all of your eggs in one basket?
Maybe if people would just hold their phones the right way this wouldn't have happened.
Apple Farming?
They are saying that only 5,000 apps were pilfered a day, when really it's more like 60,000 a day. (yeah just making it up)
Apple, the new BP
Speaking of which, there's a demotivational poster for that.
Wait, so they suggest customers to get new credit cards? Well, one thing I do not understand is this: the credit card information is with Apple, but I thought only Apple has access to this stored information. There should be no way for the bad guys to obtain my credit card information from there. If they have the credentials to my apple account they can make Apple charge my credit card without my authorisation. But in this case Apple would have to give me back this money as I did not authorise it etc. And as soon as I have changed my password ... the problem should stop (as long as they don't get my new password somehow)...
Or what am I missing here?
"The more you tighten your grip, Tarkin, the more star systems will slip through your fingers"
- Princess L
Just wondering: So if harm is done with apps approved by Apple ... isn't Apple then also liable for the fraud done by them?
Yeah, there is an app for that...
From the article:
One example is Brighthouse Labs with 4568 Apps, all virtually worthless.
How does apple approve of 4578 apps from one developer? I thought each app was audited? Or is some of the auditing done through heavy automation. Such that if you got Pacman approved whereby each dot you ate gave you one point, then you could make another pacman that each dot gave you 2points, and the second version was automatically approved.
Are the people who got hacked also developers on the App Store?
How many accounts are known (publicly) to be hacked?
Without more information, it's hard to take any of this as a serious breach... all of these actions could easily have been had by PC malware or Jailbroken phone malware, via the information black market.
Make sure everyone's vote counts: Verified Voting
the app store never reveals credit card information. if you know a user's log in and password, you can make app store and itunes purchases from any device. you can't, however, get their credit card.
unfortunately it's trivially easy to get the login information. All a developer has to do is make an app that asks for credentials. It can be very legit so as to make it through apple's approval process. Really, all apple cares about is if the app is reasonably stable, doesn't duplicate their functionality, and isn't using private api's. Maybe you have a high score system, or simply say the user needs an account to read the book in the app. Hell, you could probably just make an app with 2 text fields for username and password that does nothing and apple will approve it. You will probably end up with a database where > 50% of the username / password combos are actually appleIds and passwords ready to buy stuff on the app store.
i'm not sure what apple can do to combat this social engineering. i don't use my appleId within apps or any other login really. It would be nice however if i could whitelist some deviceid's that i say can make purchases from my account. maybe make that hardware identifier work for me for a change.
I have to agree Apple is getting a tone of slashdot attention. Knowing Apple's reputation they probably plan and want the publicity. But lately they been getting a lot of negative attention which is not a good thing.
http://www.thetechnologygeek.org
There is obviously magical properties in use here in a game changing manner.
upload a photo of the person purchasing the item at the point of sale.
chances are, there will be a little kid (mine makes calls on my n900) or the owner.
liqbase
But am I the only one that finds a quote from Princess Leia just sounds stupid?
If we added a car analogy, we're looking at at least a 4-funny.
Reply to That ||
What's next:
"Apple Admits to Typo in iPhone Manual"
"Is Steve Jobs Related to Hitler?"
"Apple Blocks Anti-Apple App from Store"
"Apple Customer Server Fails to Answer Phone in 2 Rings"
"Non-Apple Owners Who Complain About Apple Products, Largest Growing Demographic on Web"
One has to wonder why Apple's policies allowed the situation to get to this point. Why are any apps being approved before Apple has preformed due diligence on them? No background checks on the coders? Apple is making more then enough money to make things right and come out looking to be the champion for iTune users but it doesn't look like it will be so.
Wow, what a mysterious cliffhanger at the end of the summary...just kidding, it's obvious. They never had to worry about security because nobody used their products! With a market share like that, why would any malware writer or hacker bother? But now that Apple somehow convinced so many people to buy their so-so phone, they should have known what comes with that; attempted security breaches!
Actually, it's not the least bit surprising for a company that doesn't know the first thing about security to put out an insecure product and whole related system. This is definitely not going to be the first story like this about Apple if they keep putting out products that get enough market share to get attention from bad people. As a company, they have no idea how to handle it. Think of it this way. Microsoft has had decades to stop all forms of security threats that are constantly targetted at them and still hasn't gotten it quite right. Apple is starting from nothing because they've never had to worry about security on any significant scale. So unless they suddenly pull about 15 years of developed security measures and then some out of their asses and put it into the next iPhone, they're going down in flames. This is sort of funny and entertaining really, and not just because it totally makes the outlook for Linux look better. Either Apple's products are a laughably small market share or it's a huge market share and because of that, turns into a disaster because they don't know what they're doing. So I'd like to see Mac computers get like a 30 or 40% market share so bad people start targetting them. Their OS would make XP look like Fort Knox by comparison.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
Is not requiring stupidly complex passwords to prevent brute force attacks on accounts. Even then however, if you give them out to a 3rd party, ITS YOUR OWN DAMNED FAULT!!
---- Booth was a patriot ----
Visceral hatred always equals more page views.
Listen, when your marketing literally states that you are "changing the world" with your phone, and apparently you didn't properly engineer the antenna, your customers are going to complain bitterly. And then everyone who realizes that Apple is just Microsoft with better industrial designers and better marketing are going to laugh at the brand loyalists who got bitten again because Apple favors form over function.
It's really not more complicated than that.
Some banks / credit cards allow you to generate temporary credit card numbers with a limit that you specify. The ones I've seen in use also tie themselves to the first vendor they are used with. So if first used on iTunes by you then cloned cards will not work elsewhere.
Probably. Here, the problem is that they are selling it wrong.
Is the story factually incorrect in any way, or otherwise misleading? No? Then stop whining about it and find a better company to support.
What he can't kill, he has sex on. Trent.
I used to work inderexrly with the app store and iTunes store in general. I say indirectly because although I had no control over it's contents, I dealt with it's customers.
We use to get three different emails: help, someone stole ny money, help I accidentally clicked yes, yes, ok, agree, ok, download without seeing and or reading ant of the prompts, and help I scratched my iTunes card with a key and can't read the code.
This shows two things: ine the customers are idiots, abs 2 there are a lit of problems.. To anyone affected it was "accidental and you will get a refund. Fraud... Have fun with your bank.
Ps I wasn't fired, I left after being told to take ire time toresolve issues even if it meant putting people on hold who'll I walk across the room to char. Yeah.. Apple cares.
Apple has responded to the initial reports, has disabled the account of the initially fingered rogue developer
Steve ain't kidding about pr0n. Maybe if there was no fingering, the account would still be active.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
That is my point: Stop whining and find better news for nerds.
Slashdot has turned into a bunch of sissy girls.
What's next:
"Apple Admits to Typo in iPhone Manual"
"Is Steve Jobs Related to Hitler?"
"Apple Blocks Anti-Apple App from Store"
"Apple Customer Server Fails to Answer Phone in 2 Rings"
"Non-Apple Owners Who Complain About Apple Products, Largest Growing Demographic on Web"
For those just tuning in, parent poster is not making this up. Mac keyboards have been infected with keyloggers in the past. The mind boggles why Apple would make their keyboards re-flashable.
You could always go to slashdot settings and select that you don't want to see as many apple stories...
I don't mind the Apple stories.
I mind that Anti-Apple-baiting.
For people who don't buy their stuff but just want to complain.
Does this say anything about Apple security?
So I assume you have commented only on stuff you have bought?
The servers weren't even hacked. 400 accounts with guessable passwords were accessed. That is why the users were asked to change their passwords, and everybody got their money back.
How much hysteria does there have to be around Apple before it's enough?
Do iphone apps run in some sort of sandbox? How hard is it to check that code isn't malicious?
Speaking of which, there's a demotivational poster for that.
I think you mean there's a demotivational poster for that.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This is yet another ludicrous attack on Apple. The problem here is not that "rogue apps" have stolen your itunes account and credit card number, it is that these rogue developers have stolen itunes accounts/credit cards or purchased same from some other source and are using these to purchase their apps and make money, both from the purchases and the rising up in the charts. So, please, please just stop with this. Why do you idiots want to kill Apple? If it's because they don't make a phone that you like, well, that is really f-ing pathetic.
--- What?
Step 2: Pay hacker to make fraudulent purchases for competitors' apps.
Step 3: Profit!!!!!!!