Slashdot Mirror
Two iOS Fitness Apps Were Caught Using Touch ID To Trick Users Into Payments of $120 (threatpost.com)
secwatcher shares a report from Threatpost: Two apps that were posing as fitness-tracking tools were actually using Apple's Touch ID feature to loot money from unassuming iOS victims. The two impacted apps were the "Fitness Balance App" and "Calories Tracker App." Both apps looked normal, and served functions like calculating BMI, tracking daily calorie intake or reminding users to drink water; and both received good reviews on the iOS store. However, according to Reddit users and researchers with ESET, the apps steal money -- almost $120 from each victim -- thanks to a sneaky popup trick involving the Apple Touch ID feature.
According to heated victims who took to Reddit to air their complaints, after a user launches one of the apps, it requests a fingerprint scan prompting users to "view their personalized calorie tracker and diet recommendations." After the users use Touch ID, the app then shows a pop-up confirming a payment of $119.99. The pop-up is only visible for a second, according to users. "However, if the user has a credit or debit card directly connected to their Apple account, the transaction is considered verified and money is wired to the operator behind these scams," said Lukas Stefanko, malware analyst with ESET security, in a Monday post on the scam.
According to heated victims who took to Reddit to air their complaints, after a user launches one of the apps, it requests a fingerprint scan prompting users to "view their personalized calorie tracker and diet recommendations." After the users use Touch ID, the app then shows a pop-up confirming a payment of $119.99. The pop-up is only visible for a second, according to users. "However, if the user has a credit or debit card directly connected to their Apple account, the transaction is considered verified and money is wired to the operator behind these scams," said Lukas Stefanko, malware analyst with ESET security, in a Monday post on the scam.
$119.99 less food they can buy, increased metabolism due to anger... So the app works then.
Come on. Who writes these abstracts? Google Translate?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
As long as Apple got their 30% cut, they looked the other way.
worked as designed, it's on IOS.
it worked as designed.
and the users authorized the payment with their Touch ID.
We know creimer is safe!
If it’s a regular App Store or Apple Pay transaction, the app doesn’t control the request for you to scan your fingerprint - so I don’t see how it can pop up “just for a second”.
I think there’s some information possibly being withheld here.
#DeleteChrome
$120 is a pretty good deal for a semester in the school of hard knocks. Compare it a DUI that costs of $9000 (you're already thinking of DBZ, cuz you lost the game), and it's obvious this a better ROI with less risk to others.
This is why I am ok with the Apple App store always taking 30% off the top. You don't see these kinds of scams in the Apple App Store, only on shady internet sites that require you to sideload or jailbreak your phone. Apple needs their thirty percent cut or they couldn't protect people from scams like these. That thirty percent Lets them do a serious analysis of every program being submitted, to look for shady things like this. Stay in the walled garden, it is safe.
Oh, wait, you said this is on iPhones? Then it is just a rogue actor. Omelet, broken eggs. Not a big deal. Nothing to see here.
The iHeartRadio app pulls similar bullshit, just not as scammy.
Shortly after bringing up the app, and around the time you select starting your feed, a near full-screen ad pops up asking if you want a subscription, with a cancel "X" in the top corner and a "Purchase button" on the bottom. Problem is, the whole ad surface is actually a purchase button unless you tap the small area with the "X". If you mess up and have FaceID or touch the home button, it immediately attempts a transaction.
I tried every decent and legal way I could think of to resolve the issue w/the business before I rented the chicken suit
You want to know what your problem is. That apple. You should be eating it, not having it fry your brain.
Common sense here. Don't save that kinda crap on your phone.
Just use the damn card in your wallet...
Anybody dumb enough that this happened to them should consider it an excellent educational investment. $120 is cheap, and the potential education very valuable. Of course, it's not about what you learn, it's what you DO with what you learn, isn't it?
Apps started off kinda cool .. small, lightweight, and useful.
Over the years, apps have become primarily sources of ads, malware, and other shady things.
The more apps there are in a given category, the more likely most of them are complete garbage which exist to rip off their 'customers'.
The number of apps I have is pretty low, and I've mostly stopped looking for them. They generally add little value beyond what I could reach with a browser, and I refuse to use a smart phone to use a browser because I don't have the same blocking and privacy tools available to me.
Whatever, it's a first world problem ... you downloaded a fitness app (didn't your phone come with one?), you set up fingerprint scanning, and you tied that to a credit card ... honestly, this is about what I'd have expected from doing those things.
Phones seem to want to make things easy and convenient to access your credit cards, the problem is that takes away a lot of the security you get from not doing stupid stuff like that.
I consider this whole digital pay ecosystem to be a series of security blunders which should combine nicely to a shitstorm of people getting ripped off by stuff like this.
This is a problem entirely of the user's own creation.
With payment by phone, expect plenty more scams like this.
people still use this failed technology? they get what they deserved.
Once is enough.
It's a simple cost of doing business for any consumer who wires their bank credentials into the cloud, and then runs random applet downloads in the same sandbox.
So you put a wall-sized aquarium in your nursery with your newborn twins, and inside the aquarium you stock a giant python or cobra, and then you get yourself a riced-out 1 hp Roomba from Akihabara, just because, and then you download an experimental, indoor auto-mapping package for said Roomba from some applet pop-shop located in a dusty, foreign currency–starved minor-dictatorship whose borders you could barely sketch onto the right continent.
What could possibly go wrong?
You can't even download a free app without a credit card registered.
Website Just Down For Me? Find out
Fyi app was already removed. Try that in google store. Or a refund