MacNN | Follow-up: EA compromised site used in Apple ID scam shut down
Mac News Network View: Standard | Headlines | Categorized | Slim
Mac News Network
Mac News iPod News Reviews Forums
 

Desktop Headlines
Follow-up: EA compromised site used in Apple ID scam shut down
Wednesday, March 19, 2014 @ 11:28pm

Late Wednesday afternoon, Electronic Arts reported that it had finally closed a serious vulnerability on its web servers that allowed hackers to host a fake "Apple ID" page -- part of a phishing scam that attempted to trick users into visiting the fake page and supplying personal information and credit card details that Electronista reported on earlier today. Netcraft, which originally spotted the compromised pages, reported the problem to EA on Tuesday night.



The fake Apple ID page
The fake Apple ID page
MacNN has received reports that readers received emails citing recent, popular titles that the recipients may well have actually looked at or bought, with the explanation that their account may have been compromised and that users would need to "verify" their account details at a legitimate-looking URL that was disguised to hide the EA subdomain. Users who clicked on the URL directly from the email (a common phishing mistake) would be taken to the fake page and may reveal their iTunes account details, including credit card number. "We found it, we have isolated it, and we are making sure such attempts are no longer possible," a company spokesperson said in an emailed statement late Wednesday afternoon, but questions remain about why the reported compromised pages were allowed to continue running even well into Thursday morning after being reported the previous evening. Initially, the company said it had "taken immediate steps to disable any attempts to misuse EA domains," but disputed the "underlying claims" of Netcraft's findings. Netcraft, for its part, immediately blocked the page by adding it to its list of phishing sites, used by a wide variety of browsers, anti-virus and filtering programs to block suspicious sites. Apple itself has had a stellar record on protecting users' credentials from hackers, but it remains a tempting target for phishing scams, having over 500 million active credit cards on file. The company has added two-factor and Touch ID authentication as strengthened alternatives to help avoid fraud -- however, users tricked into supplying details or still using weak passwords are often the victims of phishing and other scams, though Apple usually covers any losses incurred from such incidents. As has been the standing advice for users for years, clicking on links directly from "security threat" or "super bargain" type emails -- particularly when they say the site will require "confirmation" of personal details and financial info -- is to be avoided, but the URL can be manually copied and tested in a web browser if users are unsure. In addition, browsers often have visual signals to assure users that they are visiting the legitimate and secure site of a brand-name vendor.
How to tell one is on the real Apple website
How to tell one is on the real Apple website


Comments on this Article
Print Friendly Version
Email to a Friend
Add MacNN to Your RSS Feeds
Buy from the Apple Store


Related Stories:

Today's MacNN Stories:
  • Report: Apple bought back another $5 billion in stock in June quarter - 7:52 PM EST
  • Cellphone unlocking bill without bulk unlock ban passed by House - 4:10 PM EST
  • Forums: Why isn't anyone excited about Yosemite? - 3:46 PM EST
  • Verizon to begin throttling some 'unlimited' LTE users - 3:45 PM EST
  • Apple deals: budget priced Macs from $719 - 3:45 PM EST
  • DealNN: $300 off 15.4-inch rMBP - 3:44 PM EST
  • Bose suing Beats over infringement of active noise reduction patents - 3:29 PM EST
  • Users of iOS iPhoto may lose Journals, Books, Slideshows in iOS 8 - 3:04 PM EST
  • Lyft caves to NYC regulators, strict TLC-regulated licensure required - 1:24 PM EST
  • Apple manufacturing expenses surge to $15.4B in Q3 - 12:46 PM EST
  • Production of new iPads, 5.5-inch iPhone yet to begin, rumor claims - 11:15 AM EST
  • Friday Deals: 4TB Hard drive, Surface RT, OTA TV streamer, more! - 10:43 AM EST
  • Swiss Apple Store expansion may require first 'open-air' temp shop - 9:46 AM EST
  • ComiXology starts offering DRM-free backups of digital comics - 6:16 AM EST
  • OS X Yosemite public beta includes iTunes 12 beta access - 1:24 AM EST
  • Briefly: Gmail for iOS update, EverWeb for Mac 1.5 - 12:56 AM EST
  • Review: Razer Taipan mouse - 12:45 AM EST

    Today's iPodNN Stories:
  • Russian government offers $110,000 bounty for Tor tracking code - 3:27 PM EST
  • Amazon Fire Phone now available to purchase in United States - 12:05 PM EST
  • LG reportedly testing user removal of pre-installed "bloatware" - 10:31 AM EST
  • Briefly: Google Glass webcam support, Google Play offline games - 8:31 AM EST
  • Presidential executive order over drone usage reportedly on the way - 7:34 AM EST
  • No comments posted on this story yet. Please post yours.
    Your Comments
    In order to post comments, you must be a registered member of the MacNN Forums and logged in. Please login with your MacNN Forums username and password.

    MacNN Forums Login:

    MacNN Forums Password:

    Not a member of the MacNN forums? Register now for free.