irnpg

Q: Weird iTunes Prompt?!

These prompts look super suspicious.  Does this indicate that this computer is infected?  Or is this just an error?

 

Thanks!

 

Screen Shot 2016-09-21 at 9.06.56 AM.pngScreen Shot 2016-09-21 at 9.08.02 AM.png

Intel iMac, Mac OS X (10.4.10)

Posted on Sep 21, 2016 7:15 AM

Close

Q: Weird iTunes Prompt?!

  • All replies
  • Helpful answers

  • by turingtest2,

    turingtest2 turingtest2 Sep 21, 2016 7:32 AM in response to irnpg
    Level 10 (86,039 points)
    Apple TV
    Sep 21, 2016 7:32 AM in response to irnpg

    Very odd. I'd shutdown iTunes and reboot, then see if you get it again.

     

    tt2

  • by Limnos,

    Limnos Limnos Sep 21, 2016 7:37 AM in response to irnpg
    Level 9 (54,101 points)
    Mac OS X
    Sep 21, 2016 7:37 AM in response to irnpg

    I wouldn't jump to say the computer is infected. It looks like either a coding bug in iTunes or iTunes is getting bad information from the rental server.  Apple has been doing a lot of stuff in the past few days and if you catch them at the wrong time an update may be happening at their end while you are trying to use a service.  Since you are the only person to have reported this kind of error on the forum I suspect it is a temporary glitch.

  • by irnpg,

    irnpg irnpg Sep 21, 2016 7:55 AM in response to Limnos
    Level 1 (4 points)
    iTunes
    Sep 21, 2016 7:55 AM in response to Limnos

    To add a little more detail. 

     

    This came off my wife's "work" computer.  She doesn't rent anything from itunes with the account that is used on that computer.  So my concern is that this is a phishing attempt to get her passwd for her apple ID.   Recently, on her iPhone she also got a ton of weird messages, SMS messages and itunes / icloud account prompts.   She uses the same AppleID for her iPhone and the computer in question.    All of this started after we retuned from Asia. We were in HK. 

     

    I'm posting the details in case this is an exploit of some kind.   Hopefully, it is not.  

  • by turingtest2,

    turingtest2 turingtest2 Sep 21, 2016 7:59 AM in response to irnpg
    Level 10 (86,039 points)
    Apple TV
    Sep 21, 2016 7:59 AM in response to irnpg

    I take it this screen appears instead of the normal iTunes Store Home Page? Or are you seeing it somewhere else?

     

    tt2

  • by Limnos,Helpful

    Limnos Limnos Sep 21, 2016 9:56 AM in response to irnpg
    Level 9 (54,101 points)
    Mac OS X
    Sep 21, 2016 9:56 AM in response to irnpg

    You are seeing this window in iTunes? I believe most phishing attempts are either in the form of emails or browser pop-ups.  To do that in iTunes would require hacking the iTunes code or some kind of intervention plug-in.

     

    Given the dust that accompanies an iTunes upgrade happening alongside an OSX upgrade alongside an iOS upgrade as is happening right now I would say 99% it is some glitch from Apple's servers.  The timing happens to coincide with your returning from Asia.  You can always change passwords to make sure, and presumably you didn't let somebody walk into her room with a flash drive and install something on her computer. 

  • by irnpg,

    irnpg irnpg Sep 21, 2016 9:55 AM in response to Limnos
    Level 1 (4 points)
    iTunes
    Sep 21, 2016 9:55 AM in response to Limnos

    This is on OS X.

  • by irnpg,

    irnpg irnpg Sep 21, 2016 9:58 AM in response to turingtest2
    Level 1 (4 points)
    iTunes
    Sep 21, 2016 9:58 AM in response to turingtest2

    iTunes launches when she connects her iPhone to the computer's USB.  Once it launches, the prompts start.

  • by turingtest2,

    turingtest2 turingtest2 Sep 21, 2016 10:08 AM in response to irnpg
    Level 10 (86,039 points)
    Apple TV
    Sep 21, 2016 10:08 AM in response to irnpg

    Not anything I've ever seen. You could launch iTunes without the device connected to see it behaves differently. You could try signing out of the iTunes Store. See https://www.malwarebytes.com/antimalware/mac/ for a malware scanner, not that this sounds like typical malware, but potentially anything that can intercept web traffic could try to redirect iTunes Store requests and use them to try to steal account credentials.

     

    tt2

  • by thomas_r.,

    thomas_r. thomas_r. Sep 21, 2016 12:10 PM in response to irnpg
    Level 7 (30,924 points)
    Mac OS X
    Sep 21, 2016 12:10 PM in response to irnpg

    That's no malware I've ever seen before, but I don't know what it might be.

     

    One possibility is that it's some new malware. It's broken-looking enough to actually be some lame piece of malware trying to imitate an iTunes password request.

     

    On the other hand, I've come across a few other reports of similar legit requests, with the same wording. And even for lame malware, this is just a little too broken. So another possibility is that there's something badly corrupt with her system or her copy of iTunes.

     

    As a first step, I'd probably recommend deleting iTunes and downloading a fresh copy here:

     

    http://www.apple.com/downloads/

     

    Of course, you'll want to make sure she's not using a really old system that can't run the latest version of iTunes first.

     

    In addition, check her Apple ID and see if anyone's been renting stuff on her account. If they have, she'll need to change her Apple ID password ASAP, and should also enable 2-factor authentication:

     

    Two-factor authentication for Apple ID - Apple Support

  • by turingtest2,

    turingtest2 turingtest2 Sep 21, 2016 12:16 PM in response to thomas_r.
    Level 10 (86,039 points)
    Apple TV
    Sep 21, 2016 12:16 PM in response to thomas_r.

    Thanks for dropping by.

     

    tt2

  • by thomas_r.,

    thomas_r. thomas_r. Sep 21, 2016 4:58 PM in response to turingtest2
    Level 7 (30,924 points)
    Mac OS X
    Sep 21, 2016 4:58 PM in response to turingtest2