Slashdot Mirror
Mystery of Vanishing iTunes Credit Shows No Sign of Fading
E IS mC(Square) writes "Back on November 28, 2010, somebody started a thread on Apple's support forums about someone spending more than $50 of his iTunes Store credit on iPhone apps. That discussion thread has since swelled to more than 45 pages, with nearly 700 posts. 'Someone — or some group of someones — seems to be able to spend iTunes gift card credit without permission, buying apps that users don't want. And whoever's doing the hacking seems pretty good at it: Hundreds of users have seen their iTunes credit stolen, and the hack shows no signs of slowing, ten months after it was first reported.' Apple has refunded certain accounts, but not in all cases. Apple suggests that the hack stems from weak, easily guessable passwords, and/or phishing attacks where customers are fooled into entering their passwords into hackers' forms."
Apple should really look into this more, rather than just passing off the blame. Typical.
That brings me to an interesting point, / . is just "the ramblings of socially-inept, technology-literate news-mongers".
Am I missing something regarding the "easily guessable passwords" statement? Don't they own the service so can't they enforce any password schema they desire?
Impose a minimum password length requiring punctuation, numbers and/or capitals and run it against a dictionary before accepting it.
SMS based verification?
Disclaimer: Used to work for AppleCare CPU, and then iTunes Store Support
Honestly, theres three reasons this happens.
1) People letting their kids use their device. Conversation goes like this:
Parent: "Son, did you waste $50 on iFart Pro?"
Kid: "No......"
Parent: "SINCE MY KID WOULD NEVER LIE APPLE STOLE MY MONEY GIVE IT BACK RIGHT NOW"
What people don't realize is Apple can see the Serial Number of the device that purchased anything. If $50 worth of crap was bought on your own phone, You're responsible. An exception to the rules may be made if it was a kid or something.
2) Phishing: Time and time again, $50 bucks worth of crap is bought from a different machine with an IP address in China.
3) Identity theft: I spent half my time dealing with purchases made on stolen credit cards. Call your bank. If someone went to a grocery store with your CC, and bought groceries, you don't get mad at the grocery store and demand your money back, you call your bank. Same applies to the iTunes Store.
As far as passwords go, the requirements are a capital, a number, and more than eight digits long. 12345678, etc ARE kicked out. If you haven't changed your password in 10 years, its probably grandfathered to be shorter, just change it. Theres no maximum length...As usual, Where the login is based on a email, and password, idiots who use the same password for everything get taken advantage of when Gawker, Sony, etc, etc gets hacked.
And they always blame the victim, but I know of at least one time it was one of their employees looting accounts that hadn't been logged into for a while so hopefully the users wouldn't notice. Of course when he finally got caught, they kept it quiet and continued to blame the users.
I'm not saying this is an inside job, but it's a definite possibility. (If someone was running a dictionary attack on Itunes, it would noticed if they have even halfway competent security. And although phishing occurs, it's never a complete answer and can usually be avoided with reasonable vigilance. After all, it's not like they don't know which ip or iphone it's going to.)
What you recommend will work only for iPhone and iPad 3G. It won't work for a Mac computer, a PC running Windows OS, an iPod touch, or an iPad with Wi-Fi, none of which can receive SMS.
First, iTunes cards have the number hidden on the cards in the store, you have to scratch off a coating.
Second, with an iTunes card, you transfer the card balance into your account all at once, after that the card is completely useless. So if you can complete the transfer, the card was valid and not compromised and after you transfer the card, it doesn't matter if it was compromised, because the value is gone from the card and is in your account now. You cannot use the card to spend the value on apps, you have to have access to the account you transferred the credit into.
What people are complaining about here is that they have a credit on their account (perhaps from one of these cards) and it is being spent out of their account. This can't be done with any kind of compromise of the gift cards themselves.
These people's accounts have been compromised. It's unclear how that happened.
http://lkml.org/lkml/2005/8/20/95
Obligotory "You're holding it wrong" post.
It's called the Towson Hack just google it to find out just how widespread this scam is and what Apple is doing about it... not much.
Towson, MD, 21286-7840 (is that a real zip code?).
Apparently, yes
(+1, Disagree)
Is this really a mystery? I'm pretty sure Apple hit the nail on the head.
For one thing every account that was hacked should have "registered" devices. Simply track the IPs of where those devices were registered and apps downloaded and you have a means to determine fraud from naught.
She had a Paypal account tied to her iTunes account emptied of over $400.
Luckily her buying habits and those of the hacker/s were wildly divergent (inspirational audio books vs. FPS shooters), so she got her refund...after nearly two months.
Her password? It was at least eight characters, capitalization, numbers and special characters and is considered "strong" by any password assessment tool you'll find.
I equate Apple's response to these attacks as the same Ford had to Pinto gas tanks.
For this to have gone on as long as it has means either the changes needed to really combat it would be bad for business, or the bean counters have decided the percentages warrant the non-response.
Some days it's just not worth
chewing through my restraints.
I had this happen to me back in May. The only reason I knew is because Apple sent me a receipt to the purchase of the app in question. When I looked online to see what the app was it was already pulled from the app store, but various caches online showed it was a very badly designed "game" about chinese words with the dev being a chinese name. At that point I knew someone hacked my account and bought the app (yup it was bought with credit I had on the acct).
I brought it to the attention of Apple and they immediately disabled my account. Then asked for proof that I was who I said I was. After I did so they reenabled my account, changed my password and credited me the money.
It was more of a PITA than anything, and left me scratching my head as to how they got my login info. Which is probably a worse feeling than losing $5 on an app purchase.
This happened to me. There were a lot of mysterious charges for apps the neither I nor my wife purchased. I turns out that my wife forgot that she had given the password to our teenage daughter.
Here's a weird thing: Some people posted that their credit card info has been changed. So I think the following could happen: Crook hacks into my iTunes account. Crook also has a stolen credit card. He changes the credit card info to the stolen credit card. He then uses my account with the stolen credit card to buy stuff; the money probably goes to some associate of the crook. I don't notice unless I check my iTunes account because _my_ credit card is not affected. Still bizarre.
This isn't a mystery or a hack. It's simple phishing and social engineering. If it were a legitimate problem, it would be FAR more widespread given the size of their user base. The Macworld article even mentions that someone reported having their Paypal account "hacked" to purchase iTunes Store credit immediately after their iTunes Store account was compromised, and though it doesn't come out and say it, we can probably guess that the user had the same password for both. When you have over 200M accounts linked to credit cards, your users will be a target.
All of this drives me mad - I can't imagine what it does to Joe User. I basically try random variations on passwords I know I've used, then click on "Forgot Password."
This whole system is seriously broken.
Three Squirrels
I can only guess English is not your first language, or you are of the texting generation.
(If someone was running a dictionary attack on Itunes, it would noticed if they have even halfway competent security.
Let's say one in 10,000 users uses "123456" as their password. That means trying to login with a random Apple ID and the password "123456" has a one in 10,000 chance to succeed. Now let's say we have a list of the top 100 passwords used by idiots. A botnet could perform 10,000 login attempts per day (every time a different account, and a different one of the top 100 passwords) and crack one account per day. That would be very, very hard to notice.
I'm thinking they could make this a much smaller problem if all apps have a refund policy. If you notice an app has been purchased that you didn't want, you have time to notice the problem, undo the purchase, and change your password if you suspect the purchase was made without your permission. Of course the 15 minutes you get from the Android market would be inadequate. But a real refund policy, such as a 30-day policy, would do the job. Anybody who actually pays attention to their bank account probably looks at it at least once per month.
... out of the few hundred million iTunes users?
I thought more people synced iDevices to Windows than that. My bet is that it is either shitty passwords, or crappy old Windows XP machines that have been compromised.
Maybe even people who had their password compromised by the Sony hack(s) a while ago,and use the same email/password on iTunes.
Nothing to see here, move along.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
I have this friend, and he is, well stupid like most people.
So, we are going to do some Free 2 Play games, and one of the websites wants (which is becoming very popular), your email address as your login name.
So when it comes to password, he says to me, why do they want my email address password?
I'm like, "WTF? No, they want you to make a new password for this account that is using your email address as your login name.
Needless to say, it took me like 5 mins to explain it to him. And he's not that computer stupid (though close).
So no, it doesn't surprise me that people use weak passwords, or will put in the wrong type of info (like your itunes account password) on websites that isn't iTunes.
Be seeing you...
If you create an account on a website, and you give them your email address, and you use the same password that you use for email, guess what you've given them access to?
Same goes for your Apple ID. If Apple ID = email, and you use the same password, you've given them access to your email AND to your Apple account. ...and probably a dozen other websites, like PayPal, eBay, etc.
--- Generation X: The first generation to have SIG lines inferior to their parents... ---
Would be to confirm first purchases on a new iDevice. A confirmation mail to your email address where you have to confirm that it is really you and not someone else.
"Freiheit ist immer auch die Freiheit des Andersdenkenden" - Rosa Luxemburg, 1871 - 1919
Man, that must be a little bubble if you don't know any Windows users with iPhones. Unless you're saying that not one of them used iTunes to activate their phones or that those that did immediately followed this up by uninstalling iTunes. Both are possible, but seem unlikely to me.
I only know one iphone user, and her son set it up for her I dont know what arrangement that took. but everyone else I know with a smarphone has a android product, the little local cellphone providers out here in the sticks give them away like flip-phones (and nail you on overages)
Wow. Okay, scratch my sarcasm. It really is a small bubble. So no iPod users on Windows either? Some of them don't mount as flash drives so you're stuck with iTunes (at least from a practical standpoint – there are workarounds but Windows users are less likely than Linux users to hunt them down).
yes believe it or not there are people who do not have to have apple jammed up their ass for every little thing, and there are plenty of other ways to carry music outside of an ipod or itunes
why is this so difficult to comprehend?
You know what's difficult to comprehend? Well over 200 million iPods have been sold and you're claiming that you don't know anyone that has iTunes installed on Windows. And now you're making it sound as if you don't even known anyone with an iPod. Either you really are extremely limited in your knowledge of or interactions with other people, or you were just talking smack and have gotten all pissy because you got called on it. After that "apple jammed up their ass" comment, I suspect the latter.