stereocourier
Level 1 (0 points)

Q: iTunes store account hacked

I'm posting this just to share my story and get reactions. It's a little detailed but I thought worth sharing.

On November 23, 2010 I purchased a single song from the iTunes store for .99. I used store credit that I had from a gift card I received last year. It was the first purchase I had made since July 2010.

On November 25, 2010 I received a receipt for 2 more separate orders to my account. These were for over $50 in iPhones apps. Here's a sampling of some of the purchases:

1 eREAD isoshu, v1.5, Seller: ChengDu YueTong Internet Information Co. Ltd (17+)
2 Plants vs. Zombies, v1.3, Seller: PopCap Games, Inc. (iDP)
3 Monkey Island 2 Special Edition: LeChuck's Revenge, v1.1, Seller: Lucasfilm International Services Inc.
4 Asphalt 5, v1.2.6, Seller: Gameloft (9+)
5 Let's Golf!® 2, v1.0.1, Seller: Gameloft (4+)
6 Frames & FX for Photos, v2.5.1, Seller: Imikimi, LLC (12+)
7 Stenches: A Zombie Tale of Trenches, v1.0.1, Seller: Thunder Game Works (9+)

I do not have a credit card linked to my account, so these were made using my store credit.

I have only 1 computer authorized for my account (my personal home computer). I live alone and no one else touches my Powerbook but me. I also DO NOT own an iPhone, so I would have no interest in apps.

After I saw these bizarre purchases, I checked my account. I noticed 2 strange things: My account information had changed: My street address was correct, but city, state and zip had changed to: Towson, MD 21286-7840. I have never lived in Maryland. Also, I noticed that my password recovery answer had changed to "Murray" in response to a question about my mother's maiden name. That's decidedly NOT my mother's maiden name. Also, my birthdate had changed to an incorrect month and day.

I immediately changed my password and my recovery question/answer challenge.

I reported problems on all of these purchases and also contacted iTunes Account Support by e-mail.

Within 24 hours I received an e-mail from "Vicki" at iTunes Customer Support. She wrote:

"When reviewing over your account "name@domain.net" and the two reported orders, it shows that the content purchased within them was acquired from the computer that is currently authorized for your iTunes account. So I strongly advise that you do consult with those in your household regarding the purchases made, and the charges that resulted from those purchases."

Further:

"I have gone and reversed the charges for the two orders....You will see a store credit in three to five business days....Please note that this is a one-time exception, as the iTunes Store Terms and Conditions state that all sales are final."

I am pleased that Apple is refunding my store credit and replied so quickly.

However, it is simply impossible that these purchases were made from my computer. Again, my Powerbook is the only computer I have ever authorized to access my account, and I am the only person with access to it.

I am not sure how this happened. Any thoughts or similar experiences?

Powerbook G4, Mac OS X (10.5.8)

Posted on Nov 28, 2010 3:45 PM

Close
stereocourier

Q: iTunes store account hacked

  • All replies
  • Helpful answers

first Previous Page 109 of 131 last Next

  • by Carlo TD,

    Carlo TD Carlo TD May 17, 2012 5:32 AM in response to Smoothvirus
    Level 3 (558 points)
    May 17, 2012 5:32 AM in response to Smoothvirus

    well glad you did not find anything.

  • by transmogrification,

    transmogrification transmogrification May 17, 2012 6:25 AM in response to Smoothvirus
    Level 1 (5 points)
    May 17, 2012 6:25 AM in response to Smoothvirus

    "Windows Defender Offline did not find any nasties after I let it run overnight.

     

    I think it's interesting that we are seeing identical attacks across both the Windows and OSX platforms. That would imply that however they are getting in, it's not from infected PC's."

     

    Windows is anti-spyware. Malwarebytes is anti-malware. That may be one reason. Here is a good discussion about it:

     

    http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/malwareb ytes-and-windows-defender/b683e23e-7315-4cf0-9548-90479117c03c

     

    Seriously I would have chosen anything but Windows Defender, like Malwarebytes, or AVG. both are very well rated.

  • by Smoothvirus,

    Smoothvirus Smoothvirus May 17, 2012 7:00 AM in response to transmogrification
    Level 1 (0 points)
    May 17, 2012 7:00 AM in response to transmogrification

    Windows Defender Offline is for sniffing out rootkits. It actually did get some false positives off of some software tools that I use, including keyfinder, which is kind of funny.

     

    I actually do use and like Malwarebytes. I could scan with that too but at this point I think it's pretty much academic.

  • by transmogrification,

    transmogrification transmogrification May 17, 2012 8:02 AM in response to Smoothvirus
    Level 1 (5 points)
    May 17, 2012 8:02 AM in response to Smoothvirus

    Well, academic is debatable. I would contend that academic should have been the starting point. Malwarebytes is an academic choice when looking for malware, vs. Windows Defender, an anti-spyware tool. Since we can't state with blanket certainty what is compromising iTunes accounts for everyone, it's best to check every potential threat with seriousness. This particular thread concerns Mac owners with iPhones. I am a Mac, Windows PC and iPhone owner. I investigate Mac security as a hobby. I haven't been iTunes account compromised, yet, though I have seen a good number of phishing scam attempts. ClamXav has caught these on Mac. ClamAV has caught these on Windows. Windows Defender, no.

  • by transmogrification,

    transmogrification transmogrification May 17, 2012 8:26 AM in response to transmogrification
    Level 1 (5 points)
    May 17, 2012 8:26 AM in response to transmogrification

    Another good idea for Mac Users, is to repair your permissions on a regular basis. If an installation of rogue software at the system level changes permissions to its' advantage, repairing permissions can thwart these software attempts at gaining access where it shouldn't.

  • by Smoothvirus,

    Smoothvirus Smoothvirus May 17, 2012 8:34 AM in response to transmogrification
    Level 1 (0 points)
    May 17, 2012 8:34 AM in response to transmogrification

    You keep saying that WD detects spyware only, but I'm pretty sure that Windows Defender, and Windows Defender Offline are two different products. Last night's scan was with a Windows Defender Offline bootable CD, I did not use Windows Defender at all. WDO did get some false positives on "hacker tools" that are part of the Hiren Boot CD image I have on my hard drive. Those software packages are not spyware. In fact I'm pretty sure that WDO is using the same virus signatures that Microsoft Security Essentials uses.

  • by transmogrification,

    transmogrification transmogrification May 17, 2012 9:15 AM in response to Smoothvirus
    Level 1 (5 points)
    May 17, 2012 9:15 AM in response to Smoothvirus

    Read the link I provided. Here. I will repost it:

     

    http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/malwareb ytes-and-windows-defender/b683e23e-7315-4cf0-9548-90479117c03c

     

     

    If you have a problem take it up with Microsoft. Don't shoot the messenger.

  • by TunesFan,

    TunesFan TunesFan May 17, 2012 12:33 PM in response to Smoothvirus
    Level 1 (10 points)
    May 17, 2012 12:33 PM in response to Smoothvirus

    Hi there, they got the CVV code from the back of the card they added to your account. Also, iTunes doesn't send text messages to tell you about purchases. If you got a text message it wasn't from apple. Do you mean email via push to your phone?

     

    Either way, they were able to add the CVV because they had access to it, just like the full card # and expiry date and if you get a text claiming to be from apple or iTunes don't tap on any links in the text cause it's not from Apple--they don't contact you--ever--via phone or text unless you have scheduled to do so.

  • by TunesFan,

    TunesFan TunesFan May 17, 2012 1:13 PM in response to ewtaylor2001
    Level 1 (10 points)
    May 17, 2012 1:13 PM in response to ewtaylor2001

    The software is engineered in the US and the hardware is manufactured in China; it's not possible that anything was manipulated.

  • by Smoothvirus,

    Smoothvirus Smoothvirus May 17, 2012 1:23 PM in response to transmogrification
    Level 1 (0 points)
    May 17, 2012 1:23 PM in response to transmogrification

    Yes, I read that link earlier. But that's an article about Windows Defender, and what I used was Windows Defender Offline, which is a different product. Sorry if I sounded a little frustrated earlier. No messenger shooting intended.

     

    Anyhow I will test it out with malwarebytes and clamav later tonight and post the results.

  • by Smoothvirus,

    Smoothvirus Smoothvirus May 17, 2012 1:26 PM in response to TunesFan
    Level 1 (0 points)
    May 17, 2012 1:26 PM in response to TunesFan

    No it was a text message, there were no links embedded in it.  Actually I guess it was a push notification - it was certainly not an email. It just said something like "you have downloaded an app from your computer, if you want to use it on your device sync it later" or something to that effect.

  • by transmogrification,

    transmogrification transmogrification May 17, 2012 2:19 PM in response to Smoothvirus
    Level 1 (5 points)
    May 17, 2012 2:19 PM in response to Smoothvirus

    Smoothvirus wrote:

     

    Yes, I read that link earlier. But that's an article about Windows Defender, and what I used was Windows Defender Offline, which is a different product. Sorry if I sounded a little frustrated earlier. No messenger shooting intended.

     

    Anyhow I will test it out with malwarebytes and clamav later tonight and post the results.

    Please remember, this discussion is the iTunes for Mac Community and most people coming here are Mac users. iTunes for Windows is probably where you might find more relevent help for your issues. I hope that helps or you can post your issues and situation there.

  • by ewtaylor2001,

    ewtaylor2001 ewtaylor2001 May 17, 2012 7:51 PM in response to TunesFan
    Level 1 (0 points)
    May 17, 2012 7:51 PM in response to TunesFan

    right... I refer you to here http://criticalinfrastructure.blogspot.com/2008/06/us-chinese-counterfeit-router s-sold-to.html

  • by jesusponcho,

    jesusponcho jesusponcho May 18, 2012 12:31 AM in response to Smoothvirus
    Level 1 (0 points)
    May 18, 2012 12:31 AM in response to Smoothvirus

    just had this same issue happen to me within the past hour. i changed my information back but didn't change the card yet... not sure if doing so will push those purchases to my card or not. i sent an email to apple support via the express lane support page.

     

    according to my bank account, these fraudulent purchases are not showing up yet. i have 4.99 missing from when i bought an app earlier today.

     

    from what i understand, did they simply add a new card to my account to make these illegal purchases? so i don't have to worry about it being taken from my bank?

  • by scarysheep,

    scarysheep scarysheep May 18, 2012 9:41 AM in response to jesusponcho
    Level 1 (0 points)
    May 18, 2012 9:41 AM in response to jesusponcho

    Exactly the same thing happened to me today. Two new apps appeared on my account, card details deleted, no pending purchases on my bank account. Did they hack my account, make the purchases using a (stolen) credit card, then delete the details? And why is this so endemic?

first Previous Page 109 of 131 last Next