HACKED!

[John Shields]

Originally Posted by KnightRiderSS

I had someone hack my iTunes and charge my CC...it was only 10 bucks but still annouying...I got the money back...Apple was LESS than helpful...my bank helped me...I changed my account prefs to paypal...they need to make it so you don't have to give billing info...I tried removing mine but it won't let me

I am thinking about parting from apple over this...they need to get their heads out of their asses...

After this fiasco I wont EVER buy another product from them. I wont install iTunes, and I wont send a penny to them. This is silly and should not occur when you manage a store like this and as big as they are. With how widespread this is by the Facebook/MySpace messages it's clearly much bigger than I thought and a lot of people are being affected by this.

Thankfully the account was a back up and not my primary account. Otherwise I'd be looking at a total loss of my last paycheck and a number of bouncing checks, debit charges, etc.

This is a serious deal and like you said, they need to pull their heads out and fix this NOW.

Originally Posted by Scott@Bjorn3D

Also a good move for PayPal is to have the Security key. It is like 5.00 but it has a number set locked to the key and it generates a number to put after your password each time. So even if they now the password they can not do anything.

This I never knew about. So I'll be closing down my bank account, and PayPal account and may open a new PayPal one in the future. If I do, I'll be taking advantage of the key.

[KnightRiderSS]

Originally Posted by Scott@Bjorn3D

Also a good move for PayPal is to have the Security key. It is like 5.00 but it has a number set locked to the key and it generates a number to put after your password each time. So even if they now the password they can not do anything.

https://www.paypal.com/cgi-bin/websc...ityKey-outside

The only problem is if you add iTunes as an authorized biller...they don't even need to log onto paypal to charge you...just iTunes

[2ndgenz28]

Originally Posted by Scott@Bjorn3D

Also a good move for PayPal is to have the Security key. It is like 5.00 but it has a number set locked to the key and it generates a number to put after your password each time. So even if they now the password they can not do anything.

https://www.paypal.com/cgi-bin/websc...ityKey-outside

sounds like it cost $5 every time it maks a new key, and it makes a new key every time you use it???

I got 2 paypal accounts I use em so much, both set up as business but are 90% personal, you just get more option with biz ones.

----------
"What is it?

The PayPal Security Key creates random temporary security codes that help safeguard your PayPal account when you log in. It comes in 2 types, each with different advantages:

Security key: You carry this small credit-card sized device with you. It creates a unique security code on the go.
Mobile phone security key: You can sign up to get security codes sent by text message to your mobile phone.

How much does it cost?

The mobile security key has no costs, except your mobile provider's standard text messaging charges. Check with your mobile provider for details.

Each security key is $5, and there’s no monthly service fee or additional cost. Replacement keys are the same price."

[KnightRiderSS]

Originally Posted by 2ndgenz28

sounds like it cost $5 every time it maks a new key, and it makes a new key every time you use it???

Each security key is $5, and there’s no monthly service fee or additional cost. Replacement keys are the same price."

it's the cost of the actually key fob they send you

[Scott@Bjorn3D]

Yeah the key is 5.00 no extra charges. If you had mutiple accounts you would need multiple keys. Or if you lost the key then 5.00 to disable old one and get new one.

[irocnroll]

Originally Posted by John Shields

They were the first ones we called and they said they'll be contacting us by the end of the day to let us know what the investigation showed. Now that I know exactly how the whole scheme went down I'm hoping they'll quickly reimburse the taken money, remove the charges, and credit all additional overdraft charges.

I'm also going to file a Police Report with the Internet Crimes guys and have them follow up through iTunes to try and obtain IP's on the guys who accessed the account (yesterday and this morning). HOPEFULLY they live in the U.S. and we'll have them up on felony charges. I had an account a long time ago hacked but it was from Canada. So, I never could pursue that.

Did you have itunes on another computer that you might have disposed of in the past? If you dont destroy your harddrive when you toss a computer all your information is there. With a simple program someone can go through and figure out your password to the account and log back in and do whatever they want with it.

[Mr Twisty]

Originally Posted by 2ndgenz28

sounds like it cost $5 every time it maks a new key, and it makes a new key every time you use it???

I got 2 paypal accounts I use em so much, both set up as business but are 90% personal, you just get more option with biz ones.

----------
"What is it?

The PayPal Security Key creates random temporary security codes that help safeguard your PayPal account when you log in. It comes in 2 types, each with different advantages:

Security key: You carry this small credit-card sized device with you. It creates a unique security code on the go.
Mobile phone security key: You can sign up to get security codes sent by text message to your mobile phone.

How much does it cost?

The mobile security key has no costs, except your mobile provider's standard text messaging charges. Check with your mobile provider for details.

Each security key is $5, and there’s no monthly service fee or additional cost. Replacement keys are the same price."

Looks more like the key is a device that costs $5.00.... The one key creates a new security code for every use, so it only costs the price of a text message for each use.

[John Shields]

Originally Posted by irocnroll

Did you have itunes on another computer that you might have disposed of in the past? If you dont destroy your harddrive when you toss a computer all your information is there. With a simple program someone can go through and figure out your password to the account and log back in and do whatever they want with it.

No, it's not on any other computer anywhere else. When I looked in the account it said the application was authorized on 5 different computers... so I imagine they did that when they hacked it. But it wasn't loaded up anywhere. Only other harddrive iTunes was on, was fried completely. But seeing how this isn't isolated there must be something wrong here beyond phishing scams, keyloggers, or access to personal computers. There must be a loophole somewhere that someone figured out in mass.

[irocnroll]

Originally Posted by John Shields

No, it's not on any other computer anywhere else. When I looked in the account it said the application was authorized on 5 different computers... so I imagine they did that when they hacked it. But it wasn't loaded up anywhere. Only other harddrive iTunes was on, was fried completely. But seeing how this isn't isolated there must be something wrong here beyond phishing scams, keyloggers, or access to personal computers. There must be a loophole somewhere that someone figured out in mass.

It may have been fried to normal standards but you can easily switch the board on a dead hard drive with a new hard drive and still retreive the data. Not saying that this is what happened, but I have done it with dead drives in the past to get data off of them.

Also if I were you I would Unauthorize all computer if you havent done so and change your iTunes password so if they attempt to do this again they will be unsuccessful. PLus the music will be useless to them as they will need to sign in your account to verify the DRM on each song.

[irocnroll]

Originally Posted by MisterCamaro69

Looks more like the key is a device that costs $5.00.... The one key creates a new security code for every use, so it only costs the price of a text message for each use.

Correct, these are similar to VPN key fobs companies use to log into their networks while away from the internal network. I also this Blizzard has one available for players that play World of Warcraft to prevent account hacking.

[2ndgenz28]

So for $5 they send you a 99cent kids toy that spits out a 4 digit random code when ever the button is pushed.

How does it know its right?
They must be pre programed with a master key of such ehy, to where it can't spit out a bad code?
Even if ya pushed it a bunch of times on accident or purpose so you skipped using some codes, it don't care?

Id buy it for $5 if its dummy proof. Don't want to be denied buying something in line like a deadbeat

[irocnroll]

Originally Posted by 2ndgenz28

So for $5 they send you a 99cent kids toy that spits out a 4 digit random code when ever the button is pushed.

How does it know its right?
They must be pre programed with a master key of such ehy, to where it can't spit out a bad code?
Even if ya pushed it a bunch of times on accident or purpose so you skipped using some codes, it don't care?

Id buy it for $5 if its dummy proof. Don't want to be denied buying something in line like a deadbeat

The button on the key doesnt generate the code, it only displays it for that time stamp. if you keep pressing the button the code doesnt change untill the programmed time changes. So what it does it both the key fob and the database are programmed with the same algorithm based on when the codes should refresh.

I dont know what the refresh times are on these, it could be when the code is used up it generates a new one, or based on an hourly/daily function. So if you dont press the button you wont see anything on the screen, probably to save the battery life on the unit. Once you press the button, the key is displayed and you enter it on the site. The database checks that the key is the correct one for that time stamp and then gives you access to your account.

[Mr Twisty]

I ordered the key... It's $5.00 one time fee, plus any text fee if you use cell phone key. If you have free text, then it's just the $5.00.

Now they would need my phone... or hack it as well... (not likely) to access paypal. Pretty good reassurance for five bucks.

[Scott@Bjorn3D]

And is alot more digits than 4. The key has a SN on the back that you register to you account.