You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

iTunes store account hacked

I'm posting this just to share my story and get reactions. It's a little detailed but I thought worth sharing.

On November 23, 2010 I purchased a single song from the iTunes store for .99. I used store credit that I had from a gift card I received last year. It was the first purchase I had made since July 2010.

On November 25, 2010 I received a receipt for 2 more separate orders to my account. These were for over $50 in iPhones apps. Here's a sampling of some of the purchases:

1 eREAD isoshu, v1.5, Seller: ChengDu YueTong Internet Information Co. Ltd (17+)
2 Plants vs. Zombies, v1.3, Seller: PopCap Games, Inc. (iDP)
3 Monkey Island 2 Special Edition: LeChuck's Revenge, v1.1, Seller: Lucasfilm International Services Inc.
4 Asphalt 5, v1.2.6, Seller: Gameloft (9+)
5 Let's Golf!® 2, v1.0.1, Seller: Gameloft (4+)
6 Frames & FX for Photos, v2.5.1, Seller: Imikimi, LLC (12+)
7 Stenches: A Zombie Tale of Trenches, v1.0.1, Seller: Thunder Game Works (9+)

I do not have a credit card linked to my account, so these were made using my store credit.

I have only 1 computer authorized for my account (my personal home computer). I live alone and no one else touches my Powerbook but me. I also DO NOT own an iPhone, so I would have no interest in apps.

After I saw these bizarre purchases, I checked my account. I noticed 2 strange things: My account information had changed: My street address was correct, but city, state and zip had changed to: Towson, MD 21286-7840. I have never lived in Maryland. Also, I noticed that my password recovery answer had changed to "Murray" in response to a question about my mother's maiden name. That's decidedly NOT my mother's maiden name. Also, my birthdate had changed to an incorrect month and day.

I immediately changed my password and my recovery question/answer challenge.

I reported problems on all of these purchases and also contacted iTunes Account Support by e-mail.

Within 24 hours I received an e-mail from "Vicki" at iTunes Customer Support. She wrote:

"When reviewing over your account "name@domain.net" and the two reported orders, it shows that the content purchased within them was acquired from the computer that is currently authorized for your iTunes account. So I strongly advise that you do consult with those in your household regarding the purchases made, and the charges that resulted from those purchases."

Further:

"I have gone and reversed the charges for the two orders....You will see a store credit in three to five business days....Please note that this is a one-time exception, as the iTunes Store Terms and Conditions state that all sales are final."

I am pleased that Apple is refunding my store credit and replied so quickly.

However, it is simply impossible that these purchases were made from my computer. Again, my Powerbook is the only computer I have ever authorized to access my account, and I am the only person with access to it.

I am not sure how this happened. Any thoughts or similar experiences?

Powerbook G4, Mac OS X (10.5.8)

Posted on Nov 28, 2010 3:43 PM

1,958 replies

bmerri19

Level 1

0 points

Mar 13, 2011 10:10 PM in response to Carl Johnson

Add me to the Hongbin Suo list for a fradulent "Texas Holdem" app purchase along with 1,700,000 chips. Luckily no credit card on file, only drained $50 worth of gift card credits. Requested a refund and changed my password.

Terrence

Level 1

10 points

Mar 14, 2011 12:22 PM in response to elsieraven

Could you post for the rest of us what version of itunes that you are running when this happend? In the past 2 weeks a updated version of itunes was pushed out. I am running version 10.2.1(1) currently. When I had updated from the previous version of itunes, I think I recall reading that this latest version has 60 some odd security fixes.

Mar 14, 2011 12:29 PM in response to Terrence

I had just upgraded to 10.2.1(1) the day before this pilferage, so the problem was not fixed by this update. I can't imagine that the hacking takes place anywhere other than at Apple's end. Or is the iTunes connection not secured?

Terrence

Level 1

10 points

Mar 14, 2011 12:44 PM in response to Carl Johnson

Hi Carl. Thanks for the quick response. I was curious knowing that there was a recently updated version of itunes that was pushed out. apparently the app didnt fix that. The next question is what AV software do you use? I use MacScan to see if some sort of spyware was installed. I did run iAntiVirus, but didn't recall if it had picked up anything. My event happened around the 1st week of Nov of 2010 when I was traveling in China. When in China, i tried to download a track or 2, but that was when the Apple software balked at me downloading any track displaying that my apple id had been disabled. This didnt become an issue for me until i purchased an iphone4 and could not download any free apps for my itunes saying that my apple id had a problem. To fix that, I had to deal with applecare and do this email back and forth to resolve. My situation appears to have been resolved as of this date and probably before the end of the day is for me to document all the stuff that I have done to secure my system, and then.. to buy a small gift card to see if I can lure someone to take the bait. A continuing story. BTW. I was interviewed for a story that threatpost(dot)com is doing on what we have been experiencing here. Apparently something similar had happened in itunes a year ago. I make copies of the thread here on a frequent basis, so I have a hard copy backup. The purpose is should this be yanked, I have something more than my word and recollection as to what is going on here. It is my hope that I the local apple sales rep will come to the local Apple users group and have an official statement from Apple about what is going on here.

brad p

Level 1

10 points

Mar 14, 2011 1:02 PM in response to Terrence

i was using mac and windows of itunes
mac 7.x
window xp, latest ver. of itunes

i think its the gift card thing, that seems to be a common thread in the hacks

i still cannot use the itunes store... on mac or ipod, but i can log in using a mac that was not involved with my fraud buys..this may not be connected.. not sure..

Message was edited by: brad p

Terrence

Level 1

10 points

Mar 14, 2011 1:06 PM in response to brad p

That is my observation. While someone may get into your account and poke around, the only way for them to easily to use up any money that may be sitting in the account is from the gift card. When unauthorized purchases were made on my account, the hacker had changed my CC information to a MasterCard that belonged to someone else. But my big beef is, how is someone able to log into my apple user id in the 1st place. Is this an inside job? Is access to ones account being done with spyware? That is the real issue for me.

Mar 14, 2011 1:36 PM in response to Carl Johnson

Hi all,

My dad just received an email receipt from the iTunes store for 2 purchases of the same $19.99 app that others have listed:

帝國 Online, 23400銀幣禮包, Seller: GAMEISLIVE CORPORATION LIMITED

He also had a gift card balance that covered the purchase. He used the iTunes Store purchase history section to report the problem.

Looks like this guy figured something out - many of you are having the same issue. This app, and a gift card balance.

Hope Apple takes care of this quickly - and reverses this fraudulent charge on my dad's account.

J

arcane93

Level 1

29 points

Mar 14, 2011 4:22 PM in response to stereocourier

Looks like I just got hit too, as I just got a receipt in my email:

Brotherhood:Ultimate Guide, v1.0, Seller: gao jing (4+) $1.99
Expert Guide For Black Ops, v1.0, Seller: gao jing (4+) $1.99
Cheats Guide For Black Ops, v1.0, Seller: gao jing (4+) $0.99
Game Guide for New Vegas, v1.0, Seller: gao jing (9+) $1.99
Weapons Guide for Black Ops, v1.0, Seller: gao jing (4+) $0.99

Total $7.95, all paid with gift card credit that I had on my account. Needless to say I am not happy.

Oddly, it appears that the hacker responsible actually removed my credit card info from my account, as it now says "no credit card on file" when I had previously had a card on file. Weird. But, um, thanks Mr. Hacker for not trying to make purchases on my credit card, I guess? My billing address remains correct.

Also, this happened after I just upgraded to 10.2.1 ( on Windows 7) yesterday. The gift cards in question were entered some time ago (the most recent one was entered a month ago).

Needless to say, I've changed my password, and I've contacted Apple support. Hopefully they'll restore the credit balance. They'll want to resolve it quickly, as I won't be putting my credit card number back on my account or adding any additional gift cards until this is dealt with.

arcane93

Level 1

29 points

Mar 14, 2011 6:12 PM in response to stereocourier

Something else I'm noting here as I look through this thread -- it seems like the vast majority of these hacks are "buying" apps from a very small group of particular Chinese developers. Now, while I normally believe in innocent until proven guilty and all that . . . Let's just say that this doesn't look very good for these developers. I mean, I'm having a hard time believing that it's a coincidence that whoever hacked my account +just happened+ to buy the current complete catalog of apps by SoftStar/Gao Jing (and nothing else).

Also, for the record, I did a quick Google search on text from these apps (all of them are "game guides") that I took from the screen captures in the app store (I did not install the apps on my phone, and for obvious reasons I'd advise anyone else who's been hacked not to install any of the apps purchased by the hackers either). Based on my search, the text and images on these "game guides" appears to have been directly ripped from GameSpy, IGN, and GamesRadar. So even if these hacks weren't occurring around them, these apps are a direct copyright infringement (I think I may report them to these sites as well, maybe they can force Apple to do something). It took me less than a minute to find that this content was plagiarized; so much for Apple's thorough app approval process.

So why hasn't Apple stepped in and done something like, oh, +banned these developers and their apps from the app store+ ? Apple is really dropping the ball on this one.

mahzooey

Level 1

0 points

Mar 15, 2011 8:52 AM in response to arcane93

My account was also hacked or something weird happened. I got an email from paypal this morning about 2 $40 charges to iTunes - however I never got a receipt from Apple on what was purchased. Are these guys just doing dictionary attacks to brute force their way in? I also can't figure out what was purchased. Also nothing in my Apple account was changed (billing info, password, etc.) it seems weird to hack into my account for $80 and then leave. I have filed a dispute with PayPal and also cancelled the billing agreement with iTunes. Not sure what my next steps will be if I ever need to buy an app/music again.

arcane93

Level 1

29 points

Mar 15, 2011 9:20 AM in response to mahzooey

You should be able to view your purchase history in iTunes (I'm not on the computer that I have iTunes installed on to be able to look up the exact method, but if you go to your account info, you should see a button that says "Purchase History" or something like that). If they bought something on your account, it should be listed in there.

Yeah, I'm wondering how they got in as well. I only ever log into my account on my phone and directly in iTunes (well, prior to logging in here to post on this thread, anyway, but that was after it happened). I've got up-to-date anti-virus software on my computer, and I've seen no other signs of any issue. The fact that it's happening to both Mac and PC users seems likely to rule out a virus as well. I'm not ruling out brute force, though that would take both them somehow knowing my Apple ID, and figuring out my password (which was a relatively secure one). One would also think that Apple would have noticed brute force attacks on their servers and done something about it by now if that were happening, given that from this thread it appears to have been going on for a while. I'm wondering if they've maybe found some other loophole or exploit in Apple's system that they're using.

Mar 15, 2011 9:20 AM in response to Carl Johnson

I ran Sophos antivirus, so far nothing other than a couple of junk attachments that look like Windows trojans, and I'm on OS X.

I still haven't heard anything from Apple, they say they'll respond in 24 hours and it's approaching 48 here.

I was just thinking about cutting my cable and relying on the iTunes store and other sources, now I'm thinking twice. I'll certainly not connect a bank account or credit card to the account.

arcane93

Level 1

29 points

Mar 15, 2011 9:32 AM in response to Carl Johnson

I think I actually feel safer about connecting a credit card to my account than I do about using iTunes gift cards. At least with a credit card, if there's a problem I can file a dispute with the bank. From the sound of what I've been reading on this thread, it's hit-or-miss to get Apple to credit back a gift card balance, or to even get anyone at Apple to talk to you about it. I haven't heard anything yet regarding my report, but it has been less than 24 hours, so I'll give them a little while longer. Until I hear otherwise from Apple, though, I have to assume that my $7.95 gift card balance is gone.

Mar 15, 2011 3:37 PM in response to arcane93

I received a response from apple saying that they would refund my money although it wasn't a lot I think I was lucky as I noticed a very small amount and probably wouldn't have noticed it by just looking at my account. I am still waiting for my account to be re-activated and I also got the usual about passwords. I did have a credit card attached to my account but have since removed it. I am pretty my pc hasn't been hacked or any viruses and suspect this is something to do with iTunes. I have asked for an explanation of why this has happened but still waiting for a response.

MrRees

Level 1

0 points

Mar 16, 2011 8:36 AM in response to stereocourier

I just got done last night troubleshooting an hacked itunes account. They were drafted at total of $200 in charges in a matter of minutes. The hack went as far as changing setting in the itunes account. Its possible that the account was dictionary attacked (the pass was alpha numeric but not strong) but I am wondering if we are dealing with rogue developers or hacked apps that are compromising the accounts from the apple devices (ipad, iphone itouch) some how. Just an idea not certain BUT What if these "bad apps" are pushing updates to the app on the device causing it to do fake password prompts? That would be an easy way to get your password?

How hard would it be to tell (or program) the app to prompt for user input (asking for password) faking to be an app update??? Any app developers here want to fill me in here on that possibility?

iTunes store account hacked