Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 2
    Thank you for providing links, I can confirm this is the same attack as referenced in your twitter link (I have reported to the host). I think we won't really know for certain how they did it, but your suggestion that they may have reverse engineered the update is likely. Commented Mar 12, 2018 at 1:45
  • And change your Apple password (as OP logged in to the dodgy site) Commented Mar 13, 2018 at 17:14
  • @LightnessRacesinOrbit never logged in on the website, only on the iTunes application. I have 2FA so I should be ok. Commented Mar 13, 2018 at 17:21
  • 2
    @Imran: You've literally given an attacker your username and password. There is no "should be ok" about it. Change your password. Commented Mar 13, 2018 at 17:22
  • 3
    While I agree the PW should be changed to be on the safe side, it is not clear that Imran gave the attackers login credentials. They said they didn't enter the form on the site, just in iTunes. While I don't know how exactly that app performs authentication, it is likely that it uses https to connect to the iTunes servers. Since the login didn't work I guess the ssl handshake failed, this the request containing the credentials was never sent. I'm not a security expert, but I assume the handshake is performed before any data (like credentials) are transmitted, yes? But change it anyways! Commented Mar 14, 2018 at 8:25