MacNN | Follow-up: EA compromised site used in Apple ID scam shut down
Mac News Network View: Standard | Headlines | Categorized | Slim
Mac News Network
Mac News iPod News Reviews Forums
 

Desktop Headlines
Follow-up: EA compromised site used in Apple ID scam shut down
Wednesday, March 19, 2014 @ 11:28pm

Late Wednesday afternoon, Electronic Arts reported that it had finally closed a serious vulnerability on its web servers that allowed hackers to host a fake "Apple ID" page -- part of a phishing scam that attempted to trick users into visiting the fake page and supplying personal information and credit card details that Electronista reported on earlier today. Netcraft, which originally spotted the compromised pages, reported the problem to EA on Tuesday night.



The fake Apple ID page
The fake Apple ID page
MacNN has received reports that readers received emails citing recent, popular titles that the recipients may well have actually looked at or bought, with the explanation that their account may have been compromised and that users would need to "verify" their account details at a legitimate-looking URL that was disguised to hide the EA subdomain. Users who clicked on the URL directly from the email (a common phishing mistake) would be taken to the fake page and may reveal their iTunes account details, including credit card number. "We found it, we have isolated it, and we are making sure such attempts are no longer possible," a company spokesperson said in an emailed statement late Wednesday afternoon, but questions remain about why the reported compromised pages were allowed to continue running even well into Thursday morning after being reported the previous evening. Initially, the company said it had "taken immediate steps to disable any attempts to misuse EA domains," but disputed the "underlying claims" of Netcraft's findings. Netcraft, for its part, immediately blocked the page by adding it to its list of phishing sites, used by a wide variety of browsers, anti-virus and filtering programs to block suspicious sites. Apple itself has had a stellar record on protecting users' credentials from hackers, but it remains a tempting target for phishing scams, having over 500 million active credit cards on file. The company has added two-factor and Touch ID authentication as strengthened alternatives to help avoid fraud -- however, users tricked into supplying details or still using weak passwords are often the victims of phishing and other scams, though Apple usually covers any losses incurred from such incidents. As has been the standing advice for users for years, clicking on links directly from "security threat" or "super bargain" type emails -- particularly when they say the site will require "confirmation" of personal details and financial info -- is to be avoided, but the URL can be manually copied and tested in a web browser if users are unsure. In addition, browsers often have visual signals to assure users that they are visiting the legitimate and secure site of a brand-name vendor.
How to tell one is on the real Apple website
How to tell one is on the real Apple website


Comments on this Article
Print Friendly Version
Email to a Friend
Add MacNN to Your RSS Feeds
Buy from the Apple Store


Related Stories:

Most Recent Stories:
  • Google petitions FCC for NM desert testing of broadcast-capable drones - 4:39 PM EST
  • Home Depot transaction security reportedly ramshackle since 2008 - 3:08 PM EST
  • Former NBA star arrested for $14,000 theft through Apple EasyPay - 2:41 PM EST
  • New Oculus Rift 'Crescent Bay' headset shown, 'massive leap' over DK2 - 2:25 PM EST
  • Oculus Rift DK1 source code, schematics released as open source - 1:45 PM EST
  • Apple, HP slam patent troll with $3.6 million each in attorney fees - 12:37 PM EST
  • Briefly: Modbook Pro X Last Call campaign, Twitter for iPhone update - 11:48 AM EST

    Today's iPodNN Stories:
  • Oculus Rift DK1 source code, schematics released as open source - 1:45 PM EST
  • Google to reinvest in YouTube content, expand promotional efforts - 5:39 PM EST
  • Vodafone plans takeover of 140 Phones 4U stores, save 900 jobs - 3:33 PM EST
  • Nokia.com visitors in United Kingdom redirected to Microsoft site - 11:05 AM EST
  • Sony reveals SmartEyeglass headset prototype, releases SDK - 5:53 AM EST
  • No comments posted on this story yet. Please post yours.
    Your Comments
    In order to post comments, you must be a registered member of the MacNN Forums and logged in. Please login with your MacNN Forums username and password.

    MacNN Forums Login:

    MacNN Forums Password:

    Not a member of the MacNN forums? Register now for free.