Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Users Report Foul Play In App Store Rankings, Purchases

timothy posted about 4 years ago | from the shouldn't-be-an-app-for-that dept.

Crime 144

An anonymous reader writes "Two iPhone App developers have spotted what appears to be a hacking of the App store rankings by a rogue developer. The rankings in the books category of the US iTunes store features 40 out of 50 apps by the same app developer, Thuat Nguyen. What's more concerning is that it seems individuals' iTunes accounts have been hacked to make mass purchases of that one developer's apps." Among the comments attached to the linked story is one which suggests the security problem may lie elsewhere.

cancel ×

144 comments

Macfag Status: (-1, Troll)

Anonymous Coward | about 4 years ago | (#32794164)

TOLD

Re:Macfag Status: (-1, Troll)

Anonymous Coward | about 4 years ago | (#32794274)

One time I was at a free software convention and Linus Torvalds started to make conversation with me. He kept talking about all the women at the party that he would like to have sex with. Making jokes and gestures to his crotch. I just smiled. None of what he said I found amusing. He was really obnoxious. "I wanna fuck all the chicks, I'm no Faggot!" Linus said. After a small uncomfortable silence. I said , "I'm gay and I think I want to have sex with you." He then yelled something I couldn't understand, called me a fucking fag, then tried to beat me up. I was much bigger than him so I was actually able to beat him into unconsciousness. I then stripped him down to nothing, tied him to the banister, and got everyone at the event to insert at least one object into his ass before they left. The moral of this story is to not use GNU/Linux, it will make you gay.

frist psto (-1, Troll)

Anonymous Coward | about 4 years ago | (#32794168)

frosty piss straight to your lips

Hrm (4, Insightful)

therealobsideus (1610557) | about 4 years ago | (#32794188)

Perhaps this is just another reason why I don't use iTunes. If I like an artist I download, I'll buy their CD - if not, I delete it. And makes it much easier to convert a CD to ogg or flacs than with a lot of their Apple's AAC crap.

Re:Hrm (2, Insightful)

Anonymous Coward | about 4 years ago | (#32794236)

Jobs doesn't care as long as he can by another yacht. Someone will mod this troll because they are an apple fanboy. But the truth is he is as unscrupulous as Balmer, Larry Ellison, and a world of corporations and lawyers. Apple, just like the rest, will only do as little as they need to as long as they have a bunch of sheep willing to buy whatever he trots out on stage next.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32794280)

You must be from Cuba. Hi [wikipedia.org] .

Re:Hrm (5, Insightful)

Anonymous Coward | about 4 years ago | (#32794356)

Not liking assholes and viewing greed as a negative human quality doesn't necessarily make one a communist.

Re:Hrm (3, Funny)

Anonymous Coward | about 4 years ago | (#32794400)

You must not be from America.

Re:Hrm (2, Insightful)

Compholio (770966) | about 4 years ago | (#32794672)

But corporations have a right to make profits!!! The public good is just a concept after all, so it can't have any rights. </sarcasm>

Re:Hrm (1)

kent_eh (543303) | about 4 years ago | (#32795044)

But corporations have a right to make profits!!! </sarcasm>

Even if you were being genuine, no one should have any expectation to make a profit from me specifically.

Re:Hrm (-1, Flamebait)

Anonymous Coward | about 4 years ago | (#32794970)

No, but licking assholes and viewing everybody that makes money as greedy is.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32795274)

"Steve jobs is a greedy asshole" != "Everyone who makes money sucks"

Re:Hrm (0, Offtopic)

sjames (1099) | about 4 years ago | (#32797124)

To those who disagree, consider, Christianity defines greed as a sin. The Republican party supports Fundamentalist Christianity. So the Republican party defines greed as a sin. Therefore, the Republican party is Communist!

BOING!!!

Re:Hrm (4, Insightful)

shutdown -p now (807394) | about 4 years ago | (#32795824)

I fail to see what relevance Apple (much less Steve Jobs personally) has here. This is about hacked user accounts. This kind of thing is an unfortunate fact of life, keeping in mind that social engineering attacks take up the majority in security breaches. There's only so much Apple can do to mitigate this, and I don't see that they missed anything.

Heck, if anything, Apple's "walled garden" model - for all my dislike of it - is most efficient at dealing with these kinds of abuses. When malware authors have to go to the effort of hacking user accounts to get their crap shoved at users, you know they're tight against the wall already. In comparison, with Android, you just call yourself "Googe" (note spelling) and upload your malware directly [androlib.com] .

(How do I know it's malware? I haven't installed it, of course - but when all their apps, including a non-multiplayer five-in-a-row game, request "full network connectivity" and "location information" permissions on install, you know something's fishy; the fake company name is just icing on the cake.)

The irony is that I can't even use Market feature to report it as malware, or at least write a 1-star review with a warning, because you can only write reviews/complaints once you install the app...

Re:Hrm (1)

TooMuchToDo (882796) | about 4 years ago | (#32796910)

How about Apple look at your account, notice you live in Bumfark, IA, and not allow logins from IPs outside of the US unless you provide additional authentication or they send an SMS to your phone and you have to provide the code?

Re:Hrm (5, Insightful)

socceroos (1374367) | about 4 years ago | (#32794242)

Meh, every online store is going to have its weaknesses. Unfortunately, most of the time, the greatest weakness is the users themselves.

Not trying to justify iTunes - I hate it. Just saying that I doubt its any more 'hackable' than the next online store.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32794316)

also, in the comments there are a lot of inconsistency on the 'users' reports.

for one, apple had never refused a refound for wrongly purchased applications.

but hey, let's blame apple for compromised machines and users with weak passwords!
(note: the first vector of infection on macs are pirated software torrents)

bad guy exploits stupid people, news at 11

Re:Hrm (3, Insightful)

sortius_nod (1080919) | about 4 years ago | (#32794422)

Exactly.

It's kind of like blaming Blizzard for people's WoW accounts getting hacked. Your account has something someone wants, they'll try to get it. If you use weak passwords, well, no one's fault but your own there.

Re:Hrm (4, Insightful)

Mitsoid (837831) | about 4 years ago | (#32794606)

Except Blizzard has a track record of account restoration and decent customer service in this area.

In reality, most of the time it's neither party's fault -- The recent Adobe Flash exploit hurt a lot of people as they targeted flash advertisements for wow websites... even legitimate websites could be infected as they have to show advertisements to stay in business.

Thankfully, Blizzard realizes that blaming end-users when a large, large percentage did not 'ask' for it, only costs the company money in the end when users stop using their service.

Re:Hrm (2, Informative)

LoRdTAW (99712) | about 4 years ago | (#32795194)

Like the poster above said, sometimes its neither. My brothers Gmail was hacked during the big Chinese Google hacking debacle. His WoW account was then compromised. Thankfully he has a G1 phone and saw the change password notification email on his phone and put a quick stop to it. Blizzard restored everything and he now has the little FOB thing with the LCD screen. And he changed all his account passwords (he uses very strong completely random passwords). Hasn't had a problem since.

Re:Hrm (1)

interval1066 (668936) | about 4 years ago | (#32794464)

"...every online store is going to have its weaknesses. Unfortunately, most of the time, the greatest weakness is the users themselves."

Perfect parable for US Federal Gov.

Re:Hrm (5, Informative)

Mitsoid (837831) | about 4 years ago | (#32794518)

Other problem with iTunes,
"All sales are final."

From Terms and conditions, security section:
"You are entirely responsible for all activities that occur on or through your Account, and you agree to immediately notify Apple of any unauthorized use of your Account or any other breach of security. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. "

So better hope something else protects those people harmed, as I don't think California law (The "fall back" for iTunes T&C) will help much if a hacker steals $100-300 from you from another country.

Glad I stopped storing my CC info with iTunes after they pulled products I paid for from the store and wouldn't let me re-download. They may have nice hardware, but their policies are horrible for end-users.

You've been Steeved! (3, Insightful)

Animats (122034) | about 4 years ago | (#32794808)

Other problem with iTunes, "All sales are final." .... From Terms and conditions, security section: "You are entirely responsible for all activities that occur on or through your Account, and you agree to immediately notify Apple of any unauthorized use of your Account or any other breach of security. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. "

That's so Steve Jobs.

Re:You've been Steeved! (0)

MobileTatsu-NJG (946591) | about 4 years ago | (#32794928)

That's so lawyeresque.

FTFY.

Re:Hrm (4, Informative)

jrumney (197329) | about 4 years ago | (#32794954)

Let your credit card company fight that fight. They are obliged to refund you, and have bigger pockets for lawyers to make Apple accept liability for its own security problems.

Re:Hrm (2, Interesting)

Mitsoid (837831) | about 4 years ago | (#32795396)

Unfortunately the Federal Trade Commission, through the Fair Credit Billing Act, and Electronic Fund Transfer Act, Provide you only so much protection.

Lets say, BEST case scenario, you receive an e-mail from itunes saying you just purchased $45 in items, you immediately call your card company and suspend the account.

You are still responsible for your entire purchase. The FTC Will not force your card company to refund you (Letter of the law does not require it). If you notify your card company you are responsible for the first $50 in charges -- YOUR CARD COMPANY MAY be kinder, but the LAW does not require it. If you already owe them money or are not in good standing they may not care to be kind to you.

Now, I can call Apple and dispute the charge too right? Wrong. Apple's website clearly states
"35. OTHER TERMS AND CONDITIONS [...] No Apple employee or agent has the authority to vary any of the Service's Policies or the terms and conditions governing any sale. "

So your only hopes? (Based on basic consumer protection laws and store policy)
1) Your card company decides to be nice
2) Enough BAD PR is made of the issue that Apple is forced to do something at a corporate level (as no one you'll ever reach by phone can help you)

Important note: I'm not a lawyer, there may be another law that protects you as it's done in cyberwebs, however what state does that law operate out of? do they have rights in China? Russia? Africa? Europe? for a $50 charge?

Final note: IANAL, there may be cyber laws that also factor in here. However, Apple policy, and current basic consumer protection laws involving credit/debit cards don't protect you from these small purchases like these.. you're still responsible to pay for them legally (as far as I can tell)

Re:Hrm (2, Informative)

winwar (114053) | about 4 years ago | (#32795830)

"You are still responsible for your entire purchase. The FTC Will not force your card company to refund you (Letter of the law does not require it). If you notify your card company you are responsible for the first $50 in charges -- YOUR CARD COMPANY MAY be kinder, but the LAW does not require it."

You might want to read the FTC site. Your liability is zero if the charge involves your CC number rather than your actual card.

Re:Hrm (2, Interesting)

Mitsoid (837831) | about 4 years ago | (#32796000)

And quick follow up to my post:
You have 2 business days from the time Apple sends you an e-mail to notify your bank/credit provider.
After 2 business days from the e-mail, you are liable for $50 if you linked a credit card, and $500 if you linked a debit card.

You *may* have additional protections depending on your issuer, however expect none, go remove your credit card info from apple's server now, change your password, and wait until you need to do another purchase to put it back on at least.

Footnote: 2 days from when apple sent you the e-mail is simply because there's no 'grey area' in this case.. If you read your e-mail and find out 5 days after the fact, you now may have to 'prove' that fact to your debit card company to fall in the $50 bracket.

Use temporary credit card numbers online (4, Informative)

perpenso (1613749) | about 4 years ago | (#32795064)

Some banks / credit cards allow you to generate temporary credit card numbers with a limit that you specify. The ones I've seen in use also tie themselves to the first vendor they are used with. The temporary credit card number is effectively an alias for your real number. Personally I think these temporary numbers are far better to use online than a real credit card number.

--
Perpenso Calc [perpenso.com] for iPhone. Classic Scientific and HEX functionality plus RPN, fractions, complex numbers, 32/64-bit signed/unsigned bitwise operations, UTF-8, IEEE FP decode, and RGB decode with color preview.

Re:Use temporary credit card numbers online (5, Informative)

noidentity (188756) | about 4 years ago | (#32795114)

BTW, Slashdot has an automatic signature feature, which gives you two benefits: you don't have to add it manually after each post, and those readers who aren't interested in the clutter of signtures can turn them off. When you add it manually, you annoy the latter group.

Re:Use temporary credit card numbers online (1)

PitaBred (632671) | about 4 years ago | (#32795324)

I think that's the entire point. Maybe they think if they annoy those that disable signatures, they'll get them to click on ads or something...

Re:Use temporary credit card numbers online (2)

perpenso (1613749) | about 4 years ago | (#32795580)

I apologize, I didn't know about the built-in functionality.

Re:Use temporary credit card numbers online (1)

RocketRabbit (830691) | about 4 years ago | (#32795928)

Thank you sir. As another appdev I appreciate where you are coming from, but I doubly appreciate your attitude and the fact that you shut off the sig.

There is hope for us yet!

Re:Hrm (1, Interesting)

Anonymous Coward | about 4 years ago | (#32795266)

They may have nice hardware

If by "nice" you mean it looks nice and feels slick then I agree but my Apple hardware has been much less reliable than other stuff. Seems to be the case with everyone I know that owns Apple hardware. The fans seem to ignore it though even though they wouldn't on non-Apple hardware. Reality distortion field indeed.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32796068)

"...but their policies are horrible for end-users."

I don't doubt that, but I haven't bothered to read them since they seem to be updated every time I use iTunes, and I waste enough of my time reading Slashdot to have any more time left to waste with Apple's EULAs. They should add a changelog or something.

Version 5.76
*fixed third paragraph of section 2.1.3.1 in order to close an embarrassing legal loophole that would more easily enable a user to sue Apple in case their account is hacked
*rearranged wording of section 3.1.7b to be more confusing to someone without a law degree
*changed font to look more legal and scary
*added "Written by Apple's lawyers in California" to front page

Re:Hrm (4, Informative)

dlanod (979538) | about 4 years ago | (#32794302)

I do use iTunes and the level of reviews are generally so crap as to be useless anyway. They tend to either be "this crashed on me once, 1 star" or "AWESOME!!! 5 stars!". That's not even mentioning the frequent "I don't want to buy this app because it looks crap, 1 star" reviews that seem to pop up and aim to be even more useless.

Re:Hrm (3, Informative)

BasilBrush (643681) | about 4 years ago | (#32794762)

That's not even mentioning the frequent "I don't want to buy this app because it looks crap, 1 star" reviews that seem to pop up and aim to be even more useless.

It would be pretty pointless mentioning them because for at least two years it's been impossible to review/rate an app unless you've actually bought it.

big mistake in the first place (2, Interesting)

SethJohnson (112166) | about 4 years ago | (#32795610)

It does deserve to be noted as a colossal mistake to have allowed reviews by people who hadn't even downloaded a given app.

When SuperMonkeyBall was released, there were over 3,000 reviews. The average star rating was a high 4. I paid $9 for it and found out it was a horrible port with horrible controls and actually sucked. Then I read the reviews and they were mostly from iTunes users who were fans of the console version of the game and wanted to mouth off about how great it is. Few of them had actually played it on the iPhone.

Re:Hrm (2, Informative)

shutdown -p now (807394) | about 4 years ago | (#32795720)

I do use iTunes and the level of reviews are generally so crap as to be useless anyway. They tend to either be "this crashed on me once, 1 star" or "AWESOME!!! 5 stars!". That's not even mentioning the frequent "I don't want to buy this app because it looks crap, 1 star" reviews that seem to pop up and aim to be even more useless.

As a side note, that's almost exactly like in Android Market - with the sole difference that you can't write a review there without installing the app, so you don't have "didn't buy, 1 star". The rest is spot on.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32794376)

That works really well with iTunes gift cards. Not.

Re:Hrm (3, Informative)

whisper_jeff (680366) | about 4 years ago | (#32794390)

Perhaps this is just another reason why I don't use iTunes.

Do you pay for everything with cash? And, I mean _everything_. No, really - you do realize that this situation is not unique to iTunes, right? Hackers could go after your Amazon account, your Hydro account, or even your bank account. If the information is stored on a computer, hackers can (and have) found ways to go after it. It is not unique to iTunes.

If you don't like iTunes (as you clearly don't), just don't use it because you don't like it - there's no need to make up excuses. Otherwise, back it up and cancel your bank account and start paying for everything by cash. (*)

*I've heard of some people, who were sufficiently concerned about their information getting into the wrong hands, who do exactly that. It's a bit extreme, in my opinion but they at least put their money where their mouth is, so to speak.

Re:Hrm (1)

Quasar1999 (520073) | about 4 years ago | (#32794430)

I tried that approach a few years ago (pay everything in cash)... only problem was I needed a bank account to cash my paycheque... So that's all I had it for... to put the cheque in, and remove the cash right after. Worked great... until I tried to get car insurance for a car that I paid for in cash... apparently I had no credit history and therefor was a high risk to insure.

So I hacked the credit application database and gave myself great credit.... umm... where was I going with this... ???

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32794962)

That's kinda funny. You had the sense not to get into debt, so you're high risk? lol america.

Re:Hrm (1, Informative)

hedwards (940851) | about 4 years ago | (#32795008)

I doubt very much that's an American thing. If you don't have any debt, as in no loans, CC etc., then they don't know how to rate your risk. Which doesn't make you high risk so much as an unknown. Which for reasons related to prudence mean that any lender should eye such a person with caution.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32796094)

Sorry to disappoint you, hedwards, but it is in fact largely "an American thing". In Sweden, saying that you have a credit history implies what Americans refer to as a bad or negative credit history.

Re:Hrm (1)

pongo000 (97357) | about 4 years ago | (#32794818)

Otherwise, back it up and cancel your bank account and start paying for everything by cash. (*)

After reading this FAQ item [stanford.edu] on Donald Knuth's webpage, I'm beginning to wonder if it's not whether my bank account will be owned, but when...

Re:Hrm (2, Interesting)

am 2k (217885) | about 4 years ago | (#32794948)

If you hoard all your wealth in cash at home, there's a big physical security issue you have to worry about. It might not happen from a far-away country, but it's even more untraceable.

With the existence of the key bumping method, I'm actually more worried about that than online security.

Re:Hrm (1)

noidentity (188756) | about 4 years ago | (#32795126)

Even if all your cash is secured somewhere safe, it still gets stolen from when the Federal Reserve inflates the money supply, thereby lowering the value of each dollar.

Re:Hrm (0)

Anonymous Coward | about 4 years ago | (#32796030)

You mean the MPEG-4 audio spec AAC crap.

Tech savvy people, right? (1)

Runaway1956 (1322357) | about 4 years ago | (#32796394)

A lot of these people seem to come across as "tech savvy". So - why do they have their primary credit card accounts linked to the app store? I have one debit card that I use online. Guess what? It's almost always EMPTY. Balance of zero. No cash onhand. DEBIT cards can't be used to make mass purchases when there is no balance on them. Each week, when I get my pay, I pretty much know what I want to purchase online - I just deposit enough to cover those purchases, and a dollar or two more.

Hey hackers - good luck trying to rip me off!!

lol (-1, Offtopic)

Anonymous Coward | about 4 years ago | (#32794194)

third

had to be said... (-1, Offtopic)

Anonymous Coward | about 4 years ago | (#32794220)

What a Thuat

App Store Hack - Yup, There's an App for That, Too (-1, Offtopic)

Anonymous Coward | about 4 years ago | (#32794224)

When you are king, everyone wants a piece of you, and By George (get it), they'llhave it !!

Re:App Store Hack - Yup, There's an App for That, (-1, Offtopic)

Anonymous Coward | about 4 years ago | (#32794330)

Fuck you and your fucking kING George!

Unpossible! (-1, Troll)

DWMorse (1816016) | about 4 years ago | (#32794262)

But wait, Macs are certainly more secure than PCs.

Wait, more spin is trickling in... all these accounts were iTunes on Windows machines, right? Right? =P

Hrm, maybe I should go into marketing for Apple.

Re:Unpossible! (2, Informative)

Kitkoan (1719118) | about 4 years ago | (#32795314)

Ignoring the 'X OS is more secure then Y OS' debate, nothing is immune to being hacked. It just takes times and a desire. Like every system, if someone wants to break into it enough then they will find a way. Something like this would have been a targeted attack which pretty much makes any normal security moot since the way it was done would have been unique to this system. Its a tailor-made attack and nothing short of disconnecting the iTunes server could have prevented it.

On a side note though, it was an interesting move for them to do this on a long weekend since it's the 4th of July holiday weekend in the US and since this is a US company they no doubt have a lot of their staff off so they can enjoy the holiday. Least amount of physical presences and security to watch out for such an attack. Tomorrow might be one hell of a day at the office for Apple though.

Fowl Play (5, Funny)

brianwells (809913) | about 4 years ago | (#32794278)

The only fowl play I've found so far is Angry Birds.

Re:Fowl Play (2, Funny)

noidentity (188756) | about 4 years ago | (#32794468)

Just wait until a bunch of twits tweet about it, then it will be full of fowl.

it's a new Service "iBuy" (3, Funny)

s0litaire (1205168) | about 4 years ago | (#32794284)

Guys this is apple! So it's not a hack or flaw!

Apple is taking the hassle of you actually wanting to buy things. Let Apple (Or un-approved 3rd party) decide which apps you're going to buy...

Re:it's a new Service "iBuy" (1)

MakinBacon (1476701) | about 4 years ago | (#32794392)

One more thing: Your iBuy has already purchased itself on your behalf!

Timing is everything (1)

tomhudson (43916) | about 4 years ago | (#32794304)

Amazing that this only breaks into the news over a long weekend?

Banks and CC companies will expect some purchases "out of the ordinary" on long weekends, and you won't be getting the first-line staff when you complain to Apple, etc.

Re:Timing is everything (1)

TheKidWho (705796) | about 4 years ago | (#32794326)

Are you implying that the two iPhone app developers who spotted this are in cahoots with Apple?

Re:Timing is everything (1)

tomhudson (43916) | about 4 years ago | (#32794370)

Of course not - what I'm saying is that if you're going to scam a lot of people, a short workweek is the best time to do it. People are making their vacation plans, you've got the long weekend before the head honchos will deal with it, etc.

Re:Timing is everything (1)

whisper_jeff (680366) | about 4 years ago | (#32794342)

So they're supposed to sit on the news until Monday? News happens when it happens.

Oh, and it's a holiday in _America_. That doesn't mean it's a holiday in the rest of the world. Just FYI.

Re:Timing is everything (2, Informative)

noidentity (188756) | about 4 years ago | (#32794438)

Oh, and it's a holiday in part of North _America_. That doesn't mean it's a holiday in the rest of the world. Just FYI.

Refined that for you.

Re:Timing is everything (1)

dryeo (100693) | about 4 years ago | (#32795640)

Actually most of North America has a holiday this weekend (including taking Friday off) as July 1st is Canada day.

Re:Timing is everything (1)

tomhudson (43916) | about 4 years ago | (#32794452)

Both itunes.com (17.149.168.45) and store.apple.com (17.149.156.10) route to Internap's San Jose facility (apple-17.sje.pnap.net (66.151.128.62).

Last I heard, unless the Big One has hit in the last day, San Jose is still part of the US.

Re:Timing is everything (1)

helix2301 (1105613) | about 4 years ago | (#32795130)

I am surprised as well that this breaks over a long weekend and I agree timing is everything with something like this.

Possible details from AppleInsider (5, Informative)

immaterial (1520413) | about 4 years ago | (#32794324)

Last month, a user posted a forum comment stating, "I am going to tell you the truth about what has been going on with your account." The anonymous user then explained, "let’s say you are a Chinese guy or girl with an iPhone or iPad and you want to get some music, movie or app. How you do you do it? You go to http://www.taobao.com/ [taobao.com] The (by far) largest online market in the world and type iTunes in the search bar. Immediately you will be presented with a list of more than 7,000 items.

"You want to save money, so you filter the list to show only items under RMB25.00- (US $3.60) and still you have more than 3,600 offers. So you pick some one at random like, as an example, this one: http://item.taobao.com/item.htm?id=5516054242 [taobao.com] . You open the online chat and you transfer him RMB22.00 (US $3.20). He ask you in the online chat to provide a new iTunes account name and password, and you comply: User: qiuwge3foe3333@yahoo.com Password: qwer34567

"He asks you to wait 10 minutes online. He has already a number of user accounts under surveillance, so he enters in the iTunes account of his victim, change his/her username and password to the one you provided, and come back to ask you try it and approve the transaction so Taobao.com releases his money. Even if you cant read Chinese you can see very clearly in his item description that this account will not last more than 24 hours (the time for his victim to see the charges mounting and then cancel the credit card).

"He claims that he selects 'his' accounts so you can drain at least US $250.00 from them before they get cancelled. He urges you to be fast and buy and download as fast as you can. Start immediately! Keep the download going on for the full 24 hours! There is no warranties on how long it will last! Because he already changed the username and password, the victim can’t stop you.

More details here [appleinsider.com] though so far there's no explanation of how the accounts are getting hacked.

Re:Possible details from AppleInsider (2, Insightful)

girlintraining (1395911) | about 4 years ago | (#32794414)

More details here though so far there's no explanation of how the accounts are getting hacked.

It's not hard to guess: Average people use the same password for just about everything, or simple permutations of the same password. Get access to any source that the user entered a password for, gain access to everything else.

Re:Possible details from AppleInsider (-1, Troll)

Anonymous Coward | about 4 years ago | (#32794914)

It's even easier to guess: this is made up shit by immaterial, the anti-china, pro "us democray" rah rah rah troll.

Fuck you.

Re:Possible details from AppleInsider (1, Informative)

Anonymous Coward | about 4 years ago | (#32795196)

Hmmm, I wonder if I can guess what country you're from.

I'm thinking it's probably one that claims to belong to its people, and in reality belongs to an oppressive plutocracy with an absolutely brilliant record for brainwashing its subjects.

Re:Possible details from AppleInsider (0)

Anonymous Coward | about 4 years ago | (#32796392)

The USA fits that description pretty well these days... Mass media brainwashing, rule by plutocratic elites...

Re:Possible details from AppleInsider (0)

Anonymous Coward | about 4 years ago | (#32795250)

That doesnt even make sense, considering the scale on which this is happening.

Re:Possible details from AppleInsider (1)

ducomputergeek (595742) | about 4 years ago | (#32795578)

This is why you only use pre-paid gift cards that you can buy anywhere. Usually once a month I'll get a $15 or $25 refill while at the checkout line at walmart or the grocery store and fill up my iTunes account.

Re:Possible details from AppleInsider (1)

RocketRabbit (830691) | about 4 years ago | (#32797212)

Dude I just clicked on taobao.com and now my IDS logs are absolutely ablaze with hack attempts from China.

Those guys are really responsive.

Jobs answer (2, Funny)

Exitar (809068) | about 4 years ago | (#32794340)

Just avoid hold it in that way.

Re:Jobs answer (0, Insightful)

Anonymous Coward | about 4 years ago | (#32794764)

This joke DOESN'T MAKE SENSE. Stop modding bullshit.

Re:Jobs answer (0)

Anonymous Coward | about 4 years ago | (#32794956)

This joke DOESN'T MAKE SENSE.

It does if you hold it correctly.

Re:Jobs answer (2, Funny)

Ethanol-fueled (1125189) | about 4 years ago | (#32795258)

What happen? Did Apple set you up the bomb?

Main screen turn on.

You have no reception make your time.

Re:Jobs answer (1)

shutdown -p now (807394) | about 4 years ago | (#32795846)

It's not a technical flaw in Apple's software, or design flaw in Apple's ecosystem. Well... I guess that "Troll" mod is well-deserved.

Sounds like phishing... (4, Insightful)

maccodemonkey (1438585) | about 4 years ago | (#32794380)

Any bets? Sounds like there were suddenly a bunch of phished accounts that got "activated."

Re:Sounds like phishing... (2, Insightful)

gsgriffin (1195771) | about 4 years ago | (#32794474)

Yep. Email for you: "Secure your iTunes account now...All iTunes customers are encouraged to log on to their account and change their passwords now. CLICK HERE TO GO TO THE SECURE WEBSITE. Enter your personal info and we will make sure you are protected...blah blah"

I hate to think that 20 years from now we will still have people all around the world falling victim to phishing. Everyday I get princes and princesses from all around the world that need my help in transferring millions of dollars to the US. Every time I delete the email, I think, "lots of people are falling for this today and losing their money....sad!"

Re:Sounds like phishing... (2, Informative)

hedwards (940851) | about 4 years ago | (#32795028)

Eh, not just that, I got a call the other day from US Pharmacy, wanting to know about my Xanax prescription. I don't take Xanax and a quick google revealed it to be a phishing scam wherein they eventually ask for your CC number to supposedly look up the account information. Of course, I hung up when he wouldn't admit that I don't have a prescription for that from them.

Re:Sounds like phishing... (1)

PitaBred (632671) | about 4 years ago | (#32795386)

People have been falling for snake oil for a long time before it was called Homeopathy. It's going to be constant as long as people relinquish reason when blinded by greed

Could be worse (1)

Ilgaz (86384) | about 4 years ago | (#32795234)

It is not phishing, it is something worse. Some Apple guy told a friend "change your password immediately" when he contacted them regarding 4-5 apps he didn't actually buy showing up on his order history.

It really sounded like some "password stolen" issue to me but I really doubt it is phishing as I know the guy, not a type who will be a phishing victim.

Note that it is a theory only, I don't have the actual data nor I am an iPhone customer.

PICNIC Problem (1, Informative)

Anonymous Coward | about 4 years ago | (#32794382)

This is a Problem In Chair Not In Computer problem. If users are stupid enough to respond to the iTunes phishing scams that circulate then they shouldn't be surprised when someone uses their details.

My suggestions:
1. Report any fraudulent transactions to your credit card company/bank so the transactions are stopped. And get your card cancelled.
2. Login and choose a secure password morons

Re:PICNIC Problem (1)

MichaelSmith (789609) | about 4 years ago | (#32794508)

This is a Problem In Chair Not In Computer problem. If users are stupid enough to respond to the iTunes phishing scams that circulate then they shouldn't be surprised when someone uses their details.

My suggestions:
1. Report any fraudulent transactions to your credit card company/bank so the transactions are stopped. And get your card cancelled.
2. Login and choose a secure password morons

But with your average person the problem is in the chair. You can give lots of good advice, but the market is still going to be corrupt because it provides avenues for theft. A corrupt market is bad for all of us.

Re:PICNIC Problem (1)

Mitsoid (837831) | about 4 years ago | (#32796126)

Secure passwords mean little in the case of Phising/Trojans.

I've seen a lot of Passwords "Stolen" over the last few weeks -- likely the adobe bug, or another vulnerability.

If your password is "!!Hell0Kitty77KeRt*?Captain" it can be stolen just as easily as any insecure password.

And in the case of Adobe / in-advertisement trojans, you can't really blame the end user for using programs that are almost 'required' nowadays to actually use websites. To expect end-users to know enough about IT security as an IT expert is silly. How do I teach my grandfather to use Firefox, and install NoScript and configure his security settings... (I unfortunately cant get to him)

easy shot (2, Funny)

Anonymous Coward | about 4 years ago | (#32794460)

They're buying it wrong. They shouldn't buy it that way.

The hell? (0)

Robotron23 (832528) | about 4 years ago | (#32794594)

Thuat chance of these rankings being legit. Nguyen piss off if you believe they are.

Faster this appspam is removed faster we can Wok on Bai. Sheesh.

Re:The hell? (2, Insightful)

Inf0phreak (627499) | about 4 years ago | (#32794786)

If you know how the name Nguyen is supposed to be pronounced, you'll be completely blind to the second half of this attempted joke ("attempted joke"---almost sounds like a crime, doesn't it?)

Re:The hell? (0)

Anonymous Coward | about 4 years ago | (#32795144)

Lol weaboo faggot ^_^

Re:The hell? (1)

gyrogeerloose (849181) | about 4 years ago | (#32795202)

("attempted joke"---almost sounds like a crime, doesn't it?)

If it ain't, it should be: a crime against humormanity.

Re:The hell? (1)

RocketRabbit (830691) | about 4 years ago | (#32795964)

Oh Phuc off you Thach.

Re:The hell? (1)

Culture20 (968837) | about 4 years ago | (#32796230)

If you know how the name Nguyen is supposed to be pronounced, you'll be completely blind to the second half of this attempted joke ("attempted joke"---almost sounds like a crime, doesn't it?)

Not an epic Nguyen?

This is STILL going on? (1, Informative)

Anonymous Coward | about 4 years ago | (#32795206)

The exact same thing used to happen (and possibly still does) with PalmOS apps and the associated online stores. Certain developers, mostly asian-based, would create very basic, sometimes useless apps, and list them on stores like Handango for low, low prices. Then they'd suddenly skyrocket in the listings. If you grabbed a demo version, you could see that a lot of these applications were complete duplicates with just the name changed. They'd bank on some legit sales once the app was ranked, but boost their own sales with stolen credit cards/accounts. Every now and then, someone would get delisted. I'm surprised, given that its been years since I did anything on the PalmOS (had a few apps myself, only I just created them out of boredom and could care less about sales), that this wasn't foreseen by Apple. It's a pretty basic scam.

Occam's Razor (4, Insightful)

webdog314 (960286) | about 4 years ago | (#32796488)

After reading the article, the other linked article, and the comments posted on the linked site, I have to ask what's more likely here: that approximately 30 people out of 100+ millions of iTunes users have infected systems with key-loggers and were phished, or that the App Store has some huge security problem?

Just saying.

I've said it before.. (2, Interesting)

crossmr (957846) | about 4 years ago | (#32796708)

Apple doesn't care. Even if it was 100% their problem.
They don't care.
There are currently apps on the app store which are fake. They aren't as described. I grabbed one of them when they had a "Free" day. They're described as epic stickman fighting games. But the screenshots bear no resemblance to what the description is and feature no UI. They're filed under games, but feature no gameplay. They are all the same 4 low res stickman videos they pulled off some site.
There are several copies of this app with different names. They've all been reported multiple times but apple has not removed them, made them change the description or even categorize them appropriately.

Could it be? (2, Interesting)

masterwit (1800118) | about 4 years ago | (#32796860)

I be some user just entered
<script>
before a comment.
Control the content you control the users, right?
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...