Slashdot Mirror
Two iOS Fitness Apps Were Caught Using Touch ID To Trick Users Into Payments of $120 (threatpost.com)
secwatcher shares a report from Threatpost: Two apps that were posing as fitness-tracking tools were actually using Apple's Touch ID feature to loot money from unassuming iOS victims. The two impacted apps were the "Fitness Balance App" and "Calories Tracker App." Both apps looked normal, and served functions like calculating BMI, tracking daily calorie intake or reminding users to drink water; and both received good reviews on the iOS store. However, according to Reddit users and researchers with ESET, the apps steal money -- almost $120 from each victim -- thanks to a sneaky popup trick involving the Apple Touch ID feature.
According to heated victims who took to Reddit to air their complaints, after a user launches one of the apps, it requests a fingerprint scan prompting users to "view their personalized calorie tracker and diet recommendations." After the users use Touch ID, the app then shows a pop-up confirming a payment of $119.99. The pop-up is only visible for a second, according to users. "However, if the user has a credit or debit card directly connected to their Apple account, the transaction is considered verified and money is wired to the operator behind these scams," said Lukas Stefanko, malware analyst with ESET security, in a Monday post on the scam.
According to heated victims who took to Reddit to air their complaints, after a user launches one of the apps, it requests a fingerprint scan prompting users to "view their personalized calorie tracker and diet recommendations." After the users use Touch ID, the app then shows a pop-up confirming a payment of $119.99. The pop-up is only visible for a second, according to users. "However, if the user has a credit or debit card directly connected to their Apple account, the transaction is considered verified and money is wired to the operator behind these scams," said Lukas Stefanko, malware analyst with ESET security, in a Monday post on the scam.
Come on. Who writes these abstracts? Google Translate?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
As long as Apple got their 30% cut, they looked the other way.
If it’s a regular App Store or Apple Pay transaction, the app doesn’t control the request for you to scan your fingerprint - so I don’t see how it can pop up “just for a second”.
I think there’s some information possibly being withheld here.
#DeleteChrome
$120 is a pretty good deal for a semester in the school of hard knocks. Compare it a DUI that costs of $9000 (you're already thinking of DBZ, cuz you lost the game), and it's obvious this a better ROI with less risk to others.
This is why I am ok with the Apple App store always taking 30% off the top. You don't see these kinds of scams in the Apple App Store, only on shady internet sites that require you to sideload or jailbreak your phone. Apple needs their thirty percent cut or they couldn't protect people from scams like these. That thirty percent Lets them do a serious analysis of every program being submitted, to look for shady things like this. Stay in the walled garden, it is safe.
Oh, wait, you said this is on iPhones? Then it is just a rogue actor. Omelet, broken eggs. Not a big deal. Nothing to see here.
The iHeartRadio app pulls similar bullshit, just not as scammy.
Shortly after bringing up the app, and around the time you select starting your feed, a near full-screen ad pops up asking if you want a subscription, with a cancel "X" in the top corner and a "Purchase button" on the bottom. Problem is, the whole ad surface is actually a purchase button unless you tap the small area with the "X". If you mess up and have FaceID or touch the home button, it immediately attempts a transaction.
I tried every decent and legal way I could think of to resolve the issue w/the business before I rented the chicken suit
With payment by phone, expect plenty more scams like this.
Apps went downhill when IAP was introduced into iOS, around the 5.0 mark. Games went from entertaining and interesting to way difficult, forcing one to buy in game currency to get past a hurdle, or wait 8-16 hours. Apps also started doing everything they can to try to upload as much data as possible. For example, why would a flashlight app demand access to the phone, contacts, music library, GPS, text messages, and everything else.
Now, we are just seeing the next step in this. Apps trying to phone home with as much data as possible are not making money, so we are now seeing them hit IAP. Realistically, the app makers who can pull this won't be punished. At worst, Apple might find a mechanism to stop that, but the people who crafted the scam will end up making money big time.
Any app can do this. For example, a security app which prompts the user to authenticate to log in can ask for that... then pop up an IAP dialog and make a couple C-notes. This could be done randomly, even perhaps with some AI scanning to find the ideal mark, perhaps teenagers who wouldn't be reporting this to parents for fear their device would be taken away.
It's a simple cost of doing business for any consumer who wires their bank credentials into the cloud, and then runs random applet downloads in the same sandbox.
So you put a wall-sized aquarium in your nursery with your newborn twins, and inside the aquarium you stock a giant python or cobra, and then you get yourself a riced-out 1 hp Roomba from Akihabara, just because, and then you download an experimental, indoor auto-mapping package for said Roomba from some applet pop-shop located in a dusty, foreign currency–starved minor-dictatorship whose borders you could barely sketch onto the right continent.
What could possibly go wrong?
You can't even download a free app without a credit card registered.
Website Just Down For Me? Find out