Fake App On Apple's App Store Scams User Out of 17.1 Bitcoins ($600,000) (msn.com) 198
Long-time Slashdot reader phalse phace quotes the Washington Post: Phillipe Christodoulou wanted to check his bitcoin balance last month, so he searched the App Store on his iPhone for "Trezor," the maker of a small hardware device he uses to store his cryptocurrency. Up popped the company's padlock logo set against a bright green background. The app was rated close to five stars. He downloaded it and typed in his credentials.
In less than a second, nearly all of his life savings — 17.1 bitcoin worth $600,000 at the time — was gone. The app was a fake, designed to trick people into thinking it was a legitimate app.
But Christodoulou is angrier at Apple than at the thieves themselves: He says Apple marketed the App Store as a safe and trusted place, where each app is reviewed before it is allowed in the store. Christodoulou, once a loyal Apple customer, said he no longer admires the company. "They betrayed the trust that I had in them," he said in an interview. "Apple doesn't deserve to get away with this."
Apple bills its App Store as "the world's most trusted marketplace for apps," where every submission is scanned and reviewed, ensuring they are safe, secure, useful and unique. But in fact, it's easy for scammers to circumvent Apple's rules, according to experts. Criminal app developers can break Apple's rules by submitting seemingly innocuous apps for approval and then transforming them into phishing apps that trick people into giving up their information, according to Apple. When Apple finds out, it removes the apps and bans the developers, the company says. But it's too late for the people who fell for the scam.
The Post also points out that the 15 to 30 percent commission Apple collects on all sales in the App Store "goes to fund the 'highly curated' customer experience, the company has said."
In less than a second, nearly all of his life savings — 17.1 bitcoin worth $600,000 at the time — was gone. The app was a fake, designed to trick people into thinking it was a legitimate app.
But Christodoulou is angrier at Apple than at the thieves themselves: He says Apple marketed the App Store as a safe and trusted place, where each app is reviewed before it is allowed in the store. Christodoulou, once a loyal Apple customer, said he no longer admires the company. "They betrayed the trust that I had in them," he said in an interview. "Apple doesn't deserve to get away with this."
Apple bills its App Store as "the world's most trusted marketplace for apps," where every submission is scanned and reviewed, ensuring they are safe, secure, useful and unique. But in fact, it's easy for scammers to circumvent Apple's rules, according to experts. Criminal app developers can break Apple's rules by submitting seemingly innocuous apps for approval and then transforming them into phishing apps that trick people into giving up their information, according to Apple. When Apple finds out, it removes the apps and bans the developers, the company says. But it's too late for the people who fell for the scam.
The Post also points out that the 15 to 30 percent commission Apple collects on all sales in the App Store "goes to fund the 'highly curated' customer experience, the company has said."
Question (Score:5, Interesting)
Am I missing something? The guy already had the hardware portion for his account, but didn't have the software portion? If he had the hardware portion, why didn't he get the software portion at the same time from the same place? Did he not think at some point he would want to check his balance?
I'm not blaming the victim, I'm asking questions. It seems odd he'd have everything set up except the ability to check his account.
Re:Question (Score:5, Insightful)
He didn't want to have to plug in his hardware wallet to check his balance, so he downloaded an app that would "check it from his iphone" and gave it the passwords it asked for, reasoning if it was malware then it wouldn't be 5 stars, or on the apple store to begin with, because they tout the safety of their walled garden so much.
In addition to his obvious 2 mistakes, I'll add a third: apps that are honest today might not be honest tomorrow, after a buyout or hack.
Re:Question (Score:5, Insightful)
You shouldn't have to divulge your private keys in order to "check your balance". The entire payment history of everyone is available on the blockchain as public knowledge. Signing transactions is a different matter, however.
I'm thinking platofmrs with smart contracts, such as EOS and Etherreum could help fix this problem. I know that EOS allow you to tie token transfers to notification actions which can have user configurable results. EOS also has levels of keys so you can have a "hot" key and a "cold" key which could prevent overriding the notification however contract. Bitcoin, being a pure payments system, with only one key, lacks these feature.
Re: (Score:2)
He didn't want to have to plug in his hardware wallet to check his balance
That doesn't make sense. Then what is the point of the hardware in the first place? How were the coins stolen from a hardware wallet when the wallet was not plugged in?
Re: (Score:3)
"If a hardware wallet is lost or destroyed, the information can be restored with a secret “seed phrase.” Some people keep the seed phrase in a safe-deposit box, hoping they’ll never have to use it, or etched on durable metal that can survive a fire. Scammers use phishing to trick people into giving up their seed phrases. "
Re: Question (Score:4, Interesting)
What doesn't make sense is using a complicated, encrypted hardware wallet.
I've never heard of anyone who accidentally lost the password to their paper wallet. Hardware wallets have their role to play, but they are marketed to newbs as the most secure way to hold cryptocurrency. And they are. But only if you're not a newb.
Paper wallets make more sense. They are easy to understand how to secure. They have known failure conditions. They make it very clear what you should never send to a third party.
Literally two safety deposit boxes and two pieces of paper are all this guy needed to get all the features it seems he was looking for.
Re: (Score:2)
Because that is how bitcoin solves the double-spending problem. You can duplicate a hardware wallet and have the coins in both wallets. But if you spend the coins in one wallet, they go from the other as well, even if it is in an air-gapped safe and not connected to anything.
Re: (Score:3)
why didn't he get the software portion at the same time from the same place
What place do you get software for your phone from other than the App store? His problem is very real. You search for an app on an app store what guarantees are you that it's official? The only guarantee you have is the word of the curator who you assume would do something such as checking to see if a company is legit when they promote themselves as a safe market place.
Re: Question (Score:2)
Yeah, it'd be great if you could install apps directly to the phone from included install media, but Apple needs its cut.
Re: (Score:3, Insightful)
Apple makes sure the app itself is OK, not the people beyond the app.
That is not at all how they market the app store as a safe and curated walled garden. Comments that they are infamous for not only in public marketing but also in court cases in front of judges. Hell they used this very defense against Epic only a few weeks ago.
Stop making excuses for them by mischaracterising what they were saying and then victim blaming.
Crypto attacks criminals, news at eleven. You will always be subject to attack.
Yeah it's her fault she got raped for wearing that skimpy skirt.
Re: (Score:2)
Yeah, it seems from this story that Apple should improve the auditing of apps in their store.
Re: (Score:3)
Yes, because wallet balances are public. Bitcoin wouldn't work if the balance for any given wallet address wasn't on the blockchain. He made the mistake of giving up his private key, which isn't needed to check a balance, only to transfer funds outward.
Storing value in something you don't understand is a recipe for failure. He has no one to blame but himself. What I'd like to know is whether the app told him what his balance was before stealing it - if so, it did what it claime
Re: (Score:2)
Re: (Score:3)
Looking at their website it seems that to use their hardware you have to use their website. The website uses web USB or web Bluetooth to talk to the wallet. There is some kind of desktop app if your browser doesn't support that.
So I guess he figured he could use it with his phone instead and went looking for an official app, which as far as I can tell does not exist.
Re: New Phone maybe (Score:2)
Likely he needed to get an "upgrade" version of the software to even be able to check his balance.
"upgrade" - new, harder to use but prettier interface, and a useless new feature or two. The only advantage is that it's allowed to connect to the server while the older version is not.
Re: New Phone maybe (Score:4, Interesting)
Re: New Phone maybe (Score:2)
While true both apple and google store the lists of apps you already downloaded and allow you to download them again.
I routinely go through my list to purge the crap, however it is right there.
Trusting an icon is a stupid method of trust.
Also apple curates against malware. a legit app can use your information to do something you don't like. You can make a banking app that drains your accounts too. It isn't malware if you give it the information.
Effective curation of outside software (Score:4, Insightful)
is not possible because there will always be too many applications.
A serious walled garden would not allow outsider software, but convenience and greed always trump security.
Faux money like Bitcoin will always be more vulnerable than physical objects like precious metals but there is a passionate desire to own symbols without owning objects which crypto fits well.
If you put your life's savings in one place and fail to diversify you're, to put this as kindly as possible, fucking stupid. There is no excuse to live a life of lazy ignorance because it has such painful consequences.
Re: Effective curation of outside software (Score:2, Interesting)
Even old fashioned banks are not immune to this. A guy I know recently got screwed over royally by Wells Fargo, resulting in his entire account getting drained. I won't go into details except the bank said "tough luck bub".
And people wonder why people are stuffing money under their mattress.
Re: Effective curation of outside software (Score:2)
Re: (Score:2)
You can usually reverse bank transfers. Sometimes it takes a police report, and needs to be done within 12 weeks. The "tough luck" sounds apocryphical.
Re: (Score:2)
is not possible because there will always be too many applications.
So.... what are you saying here? That you just download any old executable code you can get your hands on from the Internet?
A serious walled garden would not allow outsider software, but convenience and greed always trump security.
A serious walled garden like... what? Are we talking NSA that goes through serious vetting processes for all of their purchases? Or are we talking about just rolling our own code for everything here? Because Solarwinds has shown that you can get software even into very restricted government agencies through a well executed supply chain attack.
Faux money like Bitcoin will always be more vulnerable than physical objects like precious metals but there is a passionate desire to own symbols without owning objects which crypto fits well.
If you put your life's savings in one place and fail to diversify you're, to put this as kindly as possible, fucking stupid. There is no excuse to live a life of lazy ignorance because it has such painful consequences.
So are we blaming Apple here, the user, or
When has Apple ever used that term? (Score:2)
AFAIK they've never claimed it is perfect security--because perfect security doesn't exist.
Re: (Score:2, Informative)
Can you find a single instance when Apple referred to the App Store as a "walled garden"?
Apple might not use the words "walled garden," but Apple does say [apple.com] their app store is a "safe and trusted place for customers to discover and download apps" and that Apple "takes responsibility for ensuring that apps are held to a high standard for privacy, security, and content because nothing is more important than maintaining the trust of our users." (emphasis is mine)
Re: (Score:2)
Apple is not advertizing itself as a "walled garden".
"Walled garden" is a /. meme.
Re: (Score:3)
But they don't do that. They advertise that 1) they have automated scans to checks for easy stuff, 2) they don't help the cops, 3) you can't screw yourself up by installing crapware from the Epic store, and 4) that if something slips through the cracks they take it down. And they do that. Since 2) and 3) are not guarantees on the only competitor, they are both more safe and more secure than 100% of the competition.
To put it another way: you know how Ford advertises safe cars? And nobody goes on about how Fo
Ugh stupid (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Probably would be the same with your bank account too.
If you notify the bank a transfer was fraud, they will reverse it. Maybe someone should build THAT into the next cryptocurrency.
Re: Ugh stupid (Score:2)
Re: (Score:2)
There are cryptocurrencies like this thought they often employee DApps which means you are still trusting a third-party. This is the effectively the same as a bank but the bank is federally secured and essentially vetted in this regard. I don't think more regulation is the solution but federal governments building into or finding ways to support the block-chain is in likely a good idea. I believe US taxes can already be paid in crypto and that alone raises a lot of questions about how those funds are handle
Re: (Score:2)
With a bank account number the transaction is reversible - anyone who ever got any check from you has that account number as it clearly printed on the check. One of the benefits of bitcoin is also one of it's drawbacks, untraceable and irreversible transactions. Even physical cash has serial number which can be used to try to track where the money went. Also, if crypto is only save for people who are very technology savvy, it's not really safe for the general public. It's like running your own web server -
Re: Ugh stupid (Score:2)
Except he downloaded "Trutsed Wallet app" instead of "Trusted Wallet App", believing it was the real thing, because it was on the store as "Trusted Wallet App", with zero indication of it being fraudulent.
And "we are so safe and secure" Apple let this happen.
At this point, if Apple were to open a general appliance store, people can expect to end up with "Sony"s which are really "Sorny"s.
Re: Ugh stupid (Score:2)
^This now has me thinking how many counterfiet products end up in Apple Stores, including counterfeit Li-Ion batteries. :\
Re: (Score:2)
Apple does not check what the app is doing.
How and why would they do that?
They check which APIs it wants to access, if it tries to download additional code via internet etc.
And that is basically all.
However if you want to volunteer to "check such apps", perhaps you can sign up somewhere.
Re: (Score:3)
Actually hundreds of millions of people enter the credentials to spend money from their bank account into their phones, laptops, and PCs every day of the week.
Re: Ugh stupid (Score:2)
Re: (Score:3)
If you are a crypto noob, keep your damn balance on a reputable exchange like coinbase, it's far safer than managing your wallet yourself and you don't know what the hell you are doing.
Safer than managing it yourself? For a non-techie, you are probably right. Still...never forget Mt Gox.
Re: (Score:2)
How is coinbase more reputable than a company who creates bitcoin hardware for miners? And what makes you think the same problem doesn't exist for a coinbase app on the app store.
The problem here isn't how reputable the company is providing the bitcoin service, the problem is that Apple prevents access to its devices through any means other than a curated service and that you need to implicitly trust Apple.
It doesn't matter if you're looking for the coinbase app, downloading paypal, or even the Bank of Amer
Re: (Score:3)
More like DON'T keep your money in any exchanges. Keep them in your wallet with backups.
Re: (Score:2)
That's what this guy was trying to do. He bought a special hardware wallet device that is supposed to securely store crypto currency. It might even work, I don't know.
apple needs to ban bit coin pay in all apps if (Score:3)
apple needs to ban bit coin pay in all apps if not then you must let EPIC have there own in app sales.
...no longer admires the company. (Score:2)
The question is, is there a better (for him) alternative to which he will switch? If not, that means he still thinks Apple is the best product for him.
All life savings in bitcoin? Living on the edge. (Score:5, Insightful)
If you have all life savings in bitcoin, you obviously are ok with risk and volatility. Risk in crypto includes not just the high volatility of the market, but also any technology related pitfalls. One of the drawback of untraceable currency is that thefts which can happen in split seconds cannot be traced and/or recovered, unlike conventional currency, which even in its least traceable form - printed money - has serial numbers which can be used to try to investigate and recover stolen cash.
Re: (Score:2)
the only real solution is (Score:2)
as far as amazon or walmart. or paypal i will i have used them but i dont like keeping a lot of apps on my phones anymore, and prefer to go minimalist, and if it is something i dont really really need i get uninstall it or disable it, i would like to see Apple and Google come out with a choice of OSs when firmwa
That really sucks (Score:3)
And could happen to any of us if the app instead was faked to looked like etrade/schwab/ameritrade/etc. Getting 100 shares of AMZN moved out of your brokerage account would be pretty shitty too.
Except when I move an unusual sum out of my account, my broker calls me up. I say, yes I'm buying a house today and this is part of the down payment. And the transaction is approved. Sure I pay massively more in fees than someone using bitcoin. But a tiny fraction of a percent compared to such a large sum. Completely removing the human element is a level of convenience we probably don't need.
Worth their 30% cut? (Score:3)
Apple asserts that the 30% cut of all payments on apps in their App Store, as well as the developer registration payments, are necessary because their App Store ensures such high quality and safe software.
Yet a thief got a fraudulent app onto the App Store which just took someone's life savings.
Either the App Store has such high quality and so much control from Apple that Apple is responsible if something like this happens, or it is not worth the 30% that customers are paying Apple (via that cut from payments in apps).
Which is it, Apple? You can't take all that money and deliver nothing.
It could be option 3. (Score:2)
Re: (Score:2)
> Apple implements best effort security
What's the best effort that a trillion-dollar corporation can conceivably muster?
Is verifying signatures in scope? Calling the developer?
They certainly put much more effort into demanding specifics from Hey! when it comes to Apple getting a cut.
Epic will have a field day with this. (Score:2)
"Apple claims that 30% is appropriate since Apple must work to secure their store. However here we have a case where Apple failed to secure their store and when money was on the line refused to compensate someone for their security failing. So what exactly is Apple providing except for a backless claim?"
Re: (Score:2)
no, no, no - see - this is proof that 30% wasn't enough funding to secure the walled prison. Proof - PROOF I tell 'ya. They'll have to raise it to 50% to be on the safe side.
Thanks (Score:2)
I needed a good laugh at someone else's expense.
what would have been better (Score:2)
If Bitcoin had been designed to use dual-credentials, where the B credentials can only read (only the A credentials can actually carry out a transaction), this kind of thing might be prevented. The fakers would have to use other tricks like hoping the victim enters the A credentials when the fake app acts like the B credentials are invalid.
Apple marketed the App Store as safe and trusted (Score:2)
And as such should be held responsible. If I went to a convention and someone sold me a dodgy product, and that convention said they vetted everyone, the convention would be held responsible.
Go ahead - hold them accountable. (Score:2)
With any luck you'll get $50.
https://www.apple.com/legal/in... [apple.com]
"If I went to a convention and someone sold me a dodgy product, and that convention said they vetted everyone, the convention would be held responsible."
Are you sure? Maybe that's true. But first you'd have to find a convention that claimed they did that, and then find one that ALSO had no disclaimers of liability built into entrance documentation.
In the end, Apple does not guarantee you anything. None of its rhetoric approaches a legal commitmen
A simple solution to that (Score:2)
Why only 16.1 bitcoin? (Score:2)
No 30% cut? (Score:2)
And now Apple have removed the app.. .
Because it didn't give them a cut of the stolen money
stupidity squared (Score:3)
Keeping that much money in Bitcoin - well, if you like danger, ok.
But trusting that much money to an app you downloaded without careful checking? Seriously? You couldn't take two looks or something? You couldn't go on their official website and follow the link to their official app there or something?
Fools and their money...
A fool and his moiney.... (Score:3)
With a Trezor wallet once it is set up the keys never leave the device. The user keeps a backup of the recovery seed and only needs to use it in the case of device failure, loss, etc.
The ONLY way that the scammer could have stolen the Bitcoins is by asking the user to perform a few steps when setting up the app , like:
* Enter the Trezor recovery seed( https://en.bitcoin.it/wiki/BIP... [bitcoin.it] )
* Enter any passphrases used on the Trezor.
If the person did this then they gave away the Bitcoin and neither Apple, Bitcoin, or the Russians had anything to do with it. A fool and his money....
Line of defense (Score:2)
Re: (Score:2)
Re: Wait... (Score:2)
Re: (Score:2)
Unless you jailbreak your iPhone you pay Apple $99 for the privilege [apple.com] to sign and run your own apps on your own device. One of the many reasons Apple's nickeling and diming is part of the Apple Tax [urbandictionary.com]
You can also allow a small number of people (25 internal and 10,000 external beta testers) to run your app for 90 days via TestFlight [apple.com]
Re: (Score:2)
Just as long as the developer manually registers you on his developer account ... or in other words, you're full of it.
Re: (Score:2)
It has to be signed by either a dev account with your device registered to that account or an enterprise deployment key used in breach of contract.
Unusable or illegal, those are the choices.
Re: (Score:2)
The irony runs deep.
Re: Wait... (Score:2)
So when did Apple add the sideload option for iPhone/iPad users?
Re: Wait... (Score:2)
Unless this guy is some big cheese, Apple's lawyers will smash his lawyers in an instant.
Class action? Sure. Make those lawyers rich, and you get $5 off of your next Apple purchase.
Re: (Score:2)
Exactly what claim are they making? Provide a link/citation.
Re: (Score:2)
Fool, money part ways.
"How am I supposed to buy drugs on Silk Road now/!" he wailed.
Re: (Score:2)
If he had bought drugs, at least he'd have something of value to show for it.
Re: (Score:3)
at least he'd have something of value to show for it.
Experience and skepticism have value.
He now has more of both.
Re: (Score:3)
I was forcibly reminded of a very old quote by a colleague taking very expensive medication who was very glad to have a few months supply stored when recently losing their job:
> Drugs will get you through times of no money better than money will get you through times of no drugs. —Freewheelin' Franklin.
Re: krypto kurrency, its pretend, like keystone ko (Score:4, Informative)
Not a random app, an app using the name and logo of a company he trusted -- and apparently approved to use those trade marks by Apple. It was a scam enabled by Apple.
Re: krypto kurrency, its pretend, like keystone k (Score:4, Insightful)
Re: krypto kurrency, its pretend, like keystone k (Score:5, Insightful)
Yes, the user absolutely made mistakes that he should not -- but this is why any smart security person encourages defense in depth: We should not rely on a single security control, especially not "the user pays close attention and is thoughtful", to protect against a security threat. In this case, Apple specifically advertises the App Store as a source that users should trust.
Re: (Score:2)
Yes, the user absolutely made mistakes that he should not -- but this is why any smart security person encourages defense in depth: We should not rely on a single security control, especially not "the user pays close attention and is thoughtful", to protect against a security threat. In this case, Apple specifically advertises the App Store as a source that users should trust.
Ahhh but that isn't really what Apple says at all. Because Apple uses defense in depth. They screen the app store for malicious behavior. They sandbox applications so that Application A cannot steal data from Application B. Apple has never and will never say "all apps on the appstore are trustworthy." They say that they have put protections in place to make using the App Store safe. And it is true. The App in question is not exploiting any vulnerability to steal data. This person voluntarily gave the
Re: (Score:2)
Being a bitcoin owner should not require being a security expert, any more than driving a car should require knowing how to disassemble the engine. Sadly, the cryptocurency tools and exchanges are deliberately obscured from law enforcement, so fraud and theft have been and will remain frequent issues.
Re: (Score:2)
Use the fucking website and not an app? I'm pretty sure their precious has a browser installed.
Re: (Score:3)
Perhaps he should have validated the publisher of the app.
I think we can all agree that he really should have, especially considering the stakes. Of course I think we all should be able to agree that another entity that really, really should be validating the publisher of app here is Apple, who is selling it through their store.
Re: (Score:2)
Apple is not selling the app, they just provide the stall and take their cut. The maker of the app is the seller.
Re: (Score:3)
Re: (Score:2)
He surely did not know.
As I do not know either.
But I only have 0.001 BTC :P so I do not need to know.
(How is that actually possible that a public key is enough to check other peoples balances, makes no sense)
Re: (Score:3)
The weakest link is Apple corporate policy. They put their stamp of approval on apps. They advertise their app store as being safe and reliable. They make it near impossible to get apps from any other source. And they don't spend a dime on actually validating a single thing. They are only reactive. When bad stuff happens, they might eventually get around to taking a look, if there is enough bad publicity.
Re: krypto kurrency, its pretend, like keystone ko (Score:4, Informative)
Not a random app, an app using the name and logo of a company he trusted -- and apparently approved to use those trade marks by Apple. It was a scam enabled by Apple.
Sorry to spoil your Apple hategasm but this thing is also 'a scam enabled by Google on Android' (to paraphrase our own good self):
https://www.reddit.com/r/TREZO... [reddit.com]
https://cointelegraph.com/news... [cointelegraph.com]
Trezor scam apps popping up on the various major mobile app-stores seems to be a distressingly regular occurrence.
Re: krypto kurrency, its pretend, like keystone k (Score:5, Informative)
Android apps have no expectation of a professional security review by Google. The problem is Apple has set expectations that someone is looking at this shit, but the truth is no one is.
Re: (Score:2)
Android apps have no expectation of a professional security review by Google.
There is no deep security review by either company for apps.
Re: (Score:2)
True. But the dance to get apps accepted is so lengthy and complex that it discourages casual scammers from bothering.
Re: (Score:2)
I'm not entirely sure I know what a "casual scammer" is.
Re: (Score:2)
How much time and work does the scammer invest? The Ebay scammer who sends you a photo of a cellphone, rather than the cell phone itself, is what I would call a casual scammer. A scammer who invests the time and effort to actually develop an app and negotiate registration of the app at the Apple store is what I'd refer to as a dedicated scammer.
Re: (Score:2)
Uhh...
Neither do iOS apps. The only security difference between Android and iOS is that Apple doesn't let you use non-App Store apps, so you can't fuck yourself up by sideloading malware. The actual stores work exactly the same way.
Re: krypto kurrency, its pretend, like keystone k (Score:4, Insightful)
Instead, Apple ensures that you download the malware directly from Apple.
Re: (Score:3)
Sorry to spoil your Apple fanboism, but (a) I expect Google to screw this kind of thing up, (b) I think most other people do too, and (c) Apple very specifically markets this kind of benefit as a defense of the App Store being a monopoly.
Re: (Score:2)
Yet none of the Android users lost $600,000. Says a lot about the lack of intelligence and common sense of iphone users.
[citation needed]
Re: krypto kurrency, its pretend, like keystone (Score:2)
If Apple is doing the most basic of security reviews as they claim, they would have caught the misleading use of someone else's trademarks.
Re: (Score:2)
Please tell me where Apple is promising to do a "security review" that includes hiring a lawyer to searcxh the USPTO database for registered trademarks.
Re: krypto kurrency, its pretend, like keystone (Score:3)
Re: krypto kurrency, its pretend, like keystone (Score:2)
Why would you hold either of these as long as a year? I prefer my wealth stored in productive assets.