Attacks/Breaches
7/6/2010
01:38 PM
50%
50%

Apple App Store Suffers Hack Attack

Company insists user data has not been compromised, but is nonetheless advising customers to watch for suspicious transactions.

Apple said Tuesday that it removed a seller from its online applications store after discovering that he gamed the store's sales ranking system to make it appear as though his e-books accounted for 42 of the site's top 50 electronics books.

Apple said the hack was carried about by a developer named Thuat Nguyen.

"His apps were removed from the App Store for violating the developer Program License Agreement, including fraudulent purchase patterns," Apple said in a statement.

The company did not provide details about how Nguyen managed to rig its sales data. Some observers are speculating that he merely manipulated sales figures, while others believe Nguyen may have actually gained access to App Store user accounts to make unauthorized purchases.

Nguyen listed his Web site as "mycompany", an Internet address that reportedly leads to a domain name parking page.

Apple insisted App Store or iTunes users' information is not at risk as a result of the incident. "Developers do not receive any iTunes confidential customer data when an app is downloaded," the company said.

Still, Apple cautioned its customers to be vigilant for suspicious transactions.

"If your credit card or iTunes password is stolen and used on iTunes we recommend that you contact your financial institution and inquire about cancelling the card and issuing a chargeback for any unauthorized transactions," Apple said.

"We also recommend that you change your iTunes account password immediately," Apple added. Investors shrugged off news about the breach. Apple shares were up .69%, to $248.65, in midday trading Tuesday.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.