Slashdot Mirror
More Trouble In Apple's App Store
quickOnTheUptake writes in to update the story of foul play in Apple's App Store, which we talked over on Sunday. The Next Web, which broke the story, now provides evidence of rampant App Farms used for theft in the store. Here is a summary of the problems TNW has seen, which includes large-scale break-ins of the App Store accounts of users worldwide. Apple has responded to the initial reports, has disabled the account of the initially fingered rogue developer, and has called on those whose accounts were misused to change their password and credit card. Both TNW and Engadget, at least, believe the problems go far deeper than Apple is admitting.
and thought of uncle milton
Nullius in verba
The title bar was red!
...oh, like the antenna issue?!
Serves that arrogant company right.
Next thing you know a plague of viruses will affect their silly phones.
Sopssa is a fucking worthless troll. Remember it moderators.
Peace out!
Wait, wasn't this the whole reason Apple wanted to approve apps - so they could keep the garbage out?!
Problems or not, these apple stories are starting to feel like the slashdot version of Orwell's two minutes of hate.
What happened there?
They won't allow flash or 'widgety' apps yet allow apps that do noting but get the developer points.
A developer with almost 5,000 apps?
So much for that 200,000 apps in the apple store.... perhaps half are fake?
I know someone who works in the fraud prevention business and they allege that iTunes purchases and credit card fraud are strongly correlated. Their story goes like this: an iTunes purchase is made for an unknown app, and within minutes a very high value (basically max-out) charge is placed on the same card. The catch is that the max-out charge is placed with an *actual* card (presumably a cloned card) and since it is incredibly unlikely that every case is fraud abuse (a made up 'theft' story by the cardholder) there is something that iTunes is either doing directly or indirectly that is enabling this activity.
Now the question for the armchair detectives is: is the iTunes purchase the moment of the leak of the card info (through some sort of hacked app), or is the iTunes purchase a test mechanism for the already stolen card info? Not being a big Apple person I haven't spent much time buying from the App store; is it possible to buy an app for someone elses' device, or for a device that doesn't exist yet?
The hackers attempted to order a macbook pro. I called Apple support- who kept asking what product I was having a problem with. One insisted that I was viewing the Apple website through a Mac, so therefore the problem was actually with the Mac.
Apparently they have no technical support/hacking section for their website- account issues don't exist according to them. I was finally able to reach level 2 tech support after faking a problem with my Macbook; where the account was flagged and order canceled.
www.GrenadeHop.com
Isn't this why you don't put all of your eggs in one basket?
Maybe if people would just hold their phones the right way this wouldn't have happened.
Apple Farming?
They are saying that only 5,000 apps were pilfered a day, when really it's more like 60,000 a day. (yeah just making it up)
Apple, the new BP
Speaking of which, there's a demotivational poster for that.
Wait, so they suggest customers to get new credit cards? Well, one thing I do not understand is this: the credit card information is with Apple, but I thought only Apple has access to this stored information. There should be no way for the bad guys to obtain my credit card information from there. If they have the credentials to my apple account they can make Apple charge my credit card without my authorisation. But in this case Apple would have to give me back this money as I did not authorise it etc. And as soon as I have changed my password ... the problem should stop (as long as they don't get my new password somehow)...
Or what am I missing here?
"The more you tighten your grip, Tarkin, the more star systems will slip through your fingers"
- Princess L
Just wondering: So if harm is done with apps approved by Apple ... isn't Apple then also liable for the fraud done by them?
Yeah, there is an app for that...
Some e-commerce sites make the users enter their credit card numbers every time they transact. Others remember the credit card number as a convenience so that the user doesn't need to keep entering it.
The latter approach is far more convenient, but carries the risk of exposing credit card numbers of anyone who's account gets hacked. I haven't used Apple's store, but since the victims are being charged it seems that Apple chooses to remember their credit card numbers for them.
Given that account hacks are becoming an issue, Apple could mitigate the problem of fraudulent charges by using a hybrid approach: remember the credit card number as per usual, but if a user logs on from a device other than the one he usually uses to log on, then keep the card number secret. Once the user has entered the card number on a device, the card number can be visible next time the user uses it to log on.
This way, if someone hacks into your account the worst he can do without requiring further exploits is download things that you have already purchased, mess with your account settings or perhaps make purchases on your behalf using his own card, but you (the real owner of the account) should remain relatively safe from thieves draining your credit card..
What's next:
"Apple Admits to Typo in iPhone Manual"
"Is Steve Jobs Related to Hitler?"
"Apple Blocks Anti-Apple App from Store"
"Apple Customer Server Fails to Answer Phone in 2 Rings"
"Non-Apple Owners Who Complain About Apple Products, Largest Growing Demographic on Web"
From the article:
One example is Brighthouse Labs with 4568 Apps, all virtually worthless.
How does apple approve of 4578 apps from one developer? I thought each app was audited? Or is some of the auditing done through heavy automation. Such that if you got Pacman approved whereby each dot you ate gave you one point, then you could make another pacman that each dot gave you 2points, and the second version was automatically approved.
Are the people who got hacked also developers on the App Store?
How many accounts are known (publicly) to be hacked?
Without more information, it's hard to take any of this as a serious breach... all of these actions could easily have been had by PC malware or Jailbroken phone malware, via the information black market.
Make sure everyone's vote counts: Verified Voting
I have to agree Apple is getting a tone of slashdot attention. Knowing Apple's reputation they probably plan and want the publicity. But lately they been getting a lot of negative attention which is not a good thing.
http://www.thetechnologygeek.org
There is obviously magical properties in use here in a game changing manner.
upload a photo of the person purchasing the item at the point of sale.
chances are, there will be a little kid (mine makes calls on my n900) or the owner.
liqbase
But am I the only one that finds a quote from Princess Leia just sounds stupid?
If we added a car analogy, we're looking at at least a 4-funny.
Reply to That ||
One has to wonder why Apple's policies allowed the situation to get to this point. Why are any apps being approved before Apple has preformed due diligence on them? No background checks on the coders? Apple is making more then enough money to make things right and come out looking to be the champion for iTune users but it doesn't look like it will be so.
Wow, what a mysterious cliffhanger at the end of the summary...just kidding, it's obvious. They never had to worry about security because nobody used their products! With a market share like that, why would any malware writer or hacker bother? But now that Apple somehow convinced so many people to buy their so-so phone, they should have known what comes with that; attempted security breaches!
Actually, it's not the least bit surprising for a company that doesn't know the first thing about security to put out an insecure product and whole related system. This is definitely not going to be the first story like this about Apple if they keep putting out products that get enough market share to get attention from bad people. As a company, they have no idea how to handle it. Think of it this way. Microsoft has had decades to stop all forms of security threats that are constantly targetted at them and still hasn't gotten it quite right. Apple is starting from nothing because they've never had to worry about security on any significant scale. So unless they suddenly pull about 15 years of developed security measures and then some out of their asses and put it into the next iPhone, they're going down in flames. This is sort of funny and entertaining really, and not just because it totally makes the outlook for Linux look better. Either Apple's products are a laughably small market share or it's a huge market share and because of that, turns into a disaster because they don't know what they're doing. So I'd like to see Mac computers get like a 30 or 40% market share so bad people start targetting them. Their OS would make XP look like Fort Knox by comparison.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
Oh, it's the flood of fraud that made my game fail. My game itself is perfect!
Is not requiring stupidly complex passwords to prevent brute force attacks on accounts. Even then however, if you give them out to a 3rd party, ITS YOUR OWN DAMNED FAULT!!
---- Booth was a patriot ----
Visceral hatred always equals more page views.
Listen, when your marketing literally states that you are "changing the world" with your phone, and apparently you didn't properly engineer the antenna, your customers are going to complain bitterly. And then everyone who realizes that Apple is just Microsoft with better industrial designers and better marketing are going to laugh at the brand loyalists who got bitten again because Apple favors form over function.
It's really not more complicated than that.
Some banks / credit cards allow you to generate temporary credit card numbers with a limit that you specify. The ones I've seen in use also tie themselves to the first vendor they are used with. So if first used on iTunes by you then cloned cards will not work elsewhere.
Probably. Here, the problem is that they are selling it wrong.
I used to work inderexrly with the app store and iTunes store in general. I say indirectly because although I had no control over it's contents, I dealt with it's customers.
We use to get three different emails: help, someone stole ny money, help I accidentally clicked yes, yes, ok, agree, ok, download without seeing and or reading ant of the prompts, and help I scratched my iTunes card with a key and can't read the code.
This shows two things: ine the customers are idiots, abs 2 there are a lit of problems.. To anyone affected it was "accidental and you will get a refund. Fraud... Have fun with your bank.
Ps I wasn't fired, I left after being told to take ire time toresolve issues even if it meant putting people on hold who'll I walk across the room to char. Yeah.. Apple cares.
Apple has responded to the initial reports, has disabled the account of the initially fingered rogue developer
Steve ain't kidding about pr0n. Maybe if there was no fingering, the account would still be active.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
For those just tuning in, parent poster is not making this up. Mac keyboards have been infected with keyloggers in the past. The mind boggles why Apple would make their keyboards re-flashable.
Does this say anything about Apple security?
The servers weren't even hacked. 400 accounts with guessable passwords were accessed. That is why the users were asked to change their passwords, and everybody got their money back.
How much hysteria does there have to be around Apple before it's enough?
Do iphone apps run in some sort of sandbox? How hard is it to check that code isn't malicious?
Speaking of which, there's a demotivational poster for that.
I think you mean there's a demotivational poster for that.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
This is yet another ludicrous attack on Apple. The problem here is not that "rogue apps" have stolen your itunes account and credit card number, it is that these rogue developers have stolen itunes accounts/credit cards or purchased same from some other source and are using these to purchase their apps and make money, both from the purchases and the rising up in the charts. So, please, please just stop with this. Why do you idiots want to kill Apple? If it's because they don't make a phone that you like, well, that is really f-ing pathetic.
--- What?
Step 2: Pay hacker to make fraudulent purchases for competitors' apps.
Step 3: Profit!!!!!!!