<?xml version="1.0" encoding="utf-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>
<channel>
	<title>Comments on: Phishing Scam: Apple Store</title>
	<atom:link href="http://theappleblog.com/2008/07/05/phishing-scam-apple-store/feed/" rel="self" type="application/rss+xml" />
	<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/</link>
	<description>TheAppleBlog, published by and for the day-to-day Apple user, is a prominent source for news, reviews, walkthroughs, and real life application of all Apple products.</description>
	<pubDate>Wed, 03 Dec 2008 02:59:43 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.3</generator>
		<item>
		<title>By: rwahrens</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118258</link>
		<dc:creator>rwahrens</dc:creator>
		<pubDate>Sun, 06 Jul 2008 21:00:17 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118258</guid>
		<description>Good tip, Paul!

Thanks!</description>
		<content:encoded><![CDATA[<p>Good tip, Paul!</p>
<p>Thanks!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Tom W Browning</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118254</link>
		<dc:creator>Tom W Browning</dc:creator>
		<pubDate>Sun, 06 Jul 2008 14:47:43 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118254</guid>
		<description>@rwahrens Every little helps. Shrug.</description>
		<content:encoded><![CDATA[<p>@rwahrens Every little helps. Shrug.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Paul</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118251</link>
		<dc:creator>Paul</dc:creator>
		<pubDate>Sun, 06 Jul 2008 05:00:48 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118251</guid>
		<description>If you hold the cursor over the link in Mail, a pop-up box will appear with the correct address.  Anything that is odd about the web address will be readily apparent.  In the billing phish you get: appartement-maroc.net/apple.store/us.  Most people should quickly recognise that the address is fake and you are being phished.</description>
		<content:encoded><![CDATA[<p>If you hold the cursor over the link in Mail, a pop-up box will appear with the correct address.  Anything that is odd about the web address will be readily apparent.  In the billing phish you get: appartement-maroc.net/apple.store/us.  Most people should quickly recognise that the address is fake and you are being phished.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: rwahrens</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118246</link>
		<dc:creator>rwahrens</dc:creator>
		<pubDate>Sun, 06 Jul 2008 02:06:07 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118246</guid>
		<description>"...the industry as a whole is struggling to find an effective solution."

I believe that this is really my point.  To make the statement that Apple itself needs to step up to the plate is to be a bit shortsighted.

With a user base of over twenty-five million users, many of whom are obviously well enough off to afford the more expensive high end Apple units, to say that Apple has not till now been an economic target is also shortsighted.  Since the vulnerabilities in Windows are well known, and it is also well known that millions of them are never updated, THAT is why Apple is not targeted, combined with the fact that to work out ways to target them as bots is harder than to just use what works and won't take additional work.

Phishing works, and does not target a particular platform, all it takes is someone unaware of the dangers.  that is why it is used, and won't go away until folks get the message.

"...clearly your dissemination of this key piece of data isn’t working either."  It isn't MY dissemination, any more than you claim the other solution.  Obviously, the INDUSTRY hasn't figured this out either, but they damn well should.</description>
		<content:encoded><![CDATA[<p>&#8220;&#8230;the industry as a whole is struggling to find an effective solution.&#8221;</p>
<p>I believe that this is really my point.  To make the statement that Apple itself needs to step up to the plate is to be a bit shortsighted.</p>
<p>With a user base of over twenty-five million users, many of whom are obviously well enough off to afford the more expensive high end Apple units, to say that Apple has not till now been an economic target is also shortsighted.  Since the vulnerabilities in Windows are well known, and it is also well known that millions of them are never updated, THAT is why Apple is not targeted, combined with the fact that to work out ways to target them as bots is harder than to just use what works and won&#8217;t take additional work.</p>
<p>Phishing works, and does not target a particular platform, all it takes is someone unaware of the dangers.  that is why it is used, and won&#8217;t go away until folks get the message.</p>
<p>&#8220;&#8230;clearly your dissemination of this key piece of data isn’t working either.&#8221;  It isn&#8217;t MY dissemination, any more than you claim the other solution.  Obviously, the INDUSTRY hasn&#8217;t figured this out either, but they damn well should.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Appleníaco &#187; Pishers usam site parecido com a Apple Store para roubar informações</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118244</link>
		<dc:creator>Appleníaco &#187; Pishers usam site parecido com a Apple Store para roubar informações</dc:creator>
		<pubDate>Sun, 06 Jul 2008 01:20:33 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118244</guid>
		<description>[...] Fonte: The Apple Blog [...]</description>
		<content:encoded><![CDATA[<p>[...] Fonte: The Apple Blog [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anonymous Coward</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118242</link>
		<dc:creator>Anonymous Coward</dc:creator>
		<pubDate>Sat, 05 Jul 2008 21:47:53 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118242</guid>
		<description>Wikipedia (http://en.wikipedia.org/wiki/Extended_Validation_Certificate) has some basic information on the EV process as well as commentary on its usefulness. Yes, it's not perfect but it seems that the industry as a whole is struggling to find an effective solution. The InformationCard model that I pointed out earlier has a number of benefits that show how to move beyond existing, weak, username/password solutions and some implementations take care to note "you have not visited this site before". There's even an implementation for OS X. Right now, it seems to be all about "raising the bar".

As for "your solution just isn't working", I'm not sure why this is "my" solution. You advocated the need for users to be aware that e-mail that leads directly to a site that requests personal information is bad, clearly your dissemination of this key piece of data isn't working either ;-)

BTW, I wonder if you assume that I'm trolling. That's not the case. I use a selection of different hardware and software from multiple vendors with Mac's being my families primary machines. The point here is that Apple is going to be the next target, as a result of its success it is now economically worthwhile for phishers to hit Apple users and phishing against the Apple store itself is a great example of that.</description>
		<content:encoded><![CDATA[<p>Wikipedia (http://en.wikipedia.org/wiki/Extended_Validation_Certificate) has some basic information on the EV process as well as commentary on its usefulness. Yes, it&#8217;s not perfect but it seems that the industry as a whole is struggling to find an effective solution. The InformationCard model that I pointed out earlier has a number of benefits that show how to move beyond existing, weak, username/password solutions and some implementations take care to note &#8220;you have not visited this site before&#8221;. There&#8217;s even an implementation for OS X. Right now, it seems to be all about &#8220;raising the bar&#8221;.</p>
<p>As for &#8220;your solution just isn&#8217;t working&#8221;, I&#8217;m not sure why this is &#8220;my&#8221; solution. You advocated the need for users to be aware that e-mail that leads directly to a site that requests personal information is bad, clearly your dissemination of this key piece of data isn&#8217;t working either <img src='http://theappleblog.com/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' /> </p>
<p>BTW, I wonder if you assume that I&#8217;m trolling. That&#8217;s not the case. I use a selection of different hardware and software from multiple vendors with Mac&#8217;s being my families primary machines. The point here is that Apple is going to be the next target, as a result of its success it is now economically worthwhile for phishers to hit Apple users and phishing against the Apple store itself is a great example of that.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Phishing Warning Concerning Apple &#124; Mac Tricks And Tips</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118241</link>
		<dc:creator>Phishing Warning Concerning Apple &#124; Mac Tricks And Tips</dc:creator>
		<pubDate>Sat, 05 Jul 2008 20:32:33 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118241</guid>
		<description>[...] to trick users into given there personal banking information away. For course its a scam. I thank The Apple Blog and Malware Blog for bringing this to my [...]</description>
		<content:encoded><![CDATA[<p>[...] to trick users into given there personal banking information away. For course its a scam. I thank The Apple Blog and Malware Blog for bringing this to my [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: rwahrens</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118239</link>
		<dc:creator>rwahrens</dc:creator>
		<pubDate>Sat, 05 Jul 2008 20:10:16 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118239</guid>
		<description>No, those certificates are next to useless, they can be faked, and have been shown to have been.  Then, where are you?  

I agree that OS manufacturers should step up, but then, perhaps, they should step up with something that WILL work and not something that just shows a false promise!

In the meantime, perhaps the education half of your solution just isn't working as well as it should?</description>
		<content:encoded><![CDATA[<p>No, those certificates are next to useless, they can be faked, and have been shown to have been.  Then, where are you?  </p>
<p>I agree that OS manufacturers should step up, but then, perhaps, they should step up with something that WILL work and not something that just shows a false promise!</p>
<p>In the meantime, perhaps the education half of your solution just isn&#8217;t working as well as it should?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ocell</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118238</link>
		<dc:creator>Ocell</dc:creator>
		<pubDate>Sat, 05 Jul 2008 19:06:27 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118238</guid>
		<description>"this info could give the phishers full access to all purchases that can be made from Apple: hardware, software, iTunes account, and iPhoto products."

Umm... if they have your credit card info and SSN, they can buy anything from anywhere... not just Apple. I know this is "The Apple Blog" and all, but they're not the only company that accepts credit cards for payment.</description>
		<content:encoded><![CDATA[<p>&#8220;this info could give the phishers full access to all purchases that can be made from Apple: hardware, software, iTunes account, and iPhoto products.&#8221;</p>
<p>Umm&#8230; if they have your credit card info and SSN, they can buy anything from anywhere&#8230; not just Apple. I know this is &#8220;The Apple Blog&#8221; and all, but they&#8217;re not the only company that accepts credit cards for payment.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anonymous Coward</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118237</link>
		<dc:creator>Anonymous Coward</dc:creator>
		<pubDate>Sat, 05 Jul 2008 18:51:41 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118237</guid>
		<description>Re: colored bars from rwahrens. I absolutely agree that the colored bars are not a silver bullet solution. Similarly user education alone is also not a silver bullet - we've been trying that one for years and people are still caught by phishers and still responding to Nigerian e-mails. The solution involves both the application of technology *and* user education and, in this case, there's absolutely no reason for Apple to not step up and do more in their browser to enable the use of EV certificates and provide greater feedback to users to help trigger them to think a little more before entering their personal data on a rogue site.

Over time, assuming that the adoption of Apple hardware+software continues to rise, it's just not going to be sufficient for Apple to try to rely on claims that *nix is just more secure, they are going to have to work on the problems proactively. Remember a recent browser hacking contest? First to fall...Apple, it took a lot more time to take down Vista and Linux didn't break. With increased popularity comes increased responsibility.</description>
		<content:encoded><![CDATA[<p>Re: colored bars from rwahrens. I absolutely agree that the colored bars are not a silver bullet solution. Similarly user education alone is also not a silver bullet - we&#8217;ve been trying that one for years and people are still caught by phishers and still responding to Nigerian e-mails. The solution involves both the application of technology *and* user education and, in this case, there&#8217;s absolutely no reason for Apple to not step up and do more in their browser to enable the use of EV certificates and provide greater feedback to users to help trigger them to think a little more before entering their personal data on a rogue site.</p>
<p>Over time, assuming that the adoption of Apple hardware+software continues to rise, it&#8217;s just not going to be sufficient for Apple to try to rely on claims that *nix is just more secure, they are going to have to work on the problems proactively. Remember a recent browser hacking contest? First to fall&#8230;Apple, it took a lot more time to take down Vista and Linux didn&#8217;t break. With increased popularity comes increased responsibility.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: rwahrens</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118236</link>
		<dc:creator>rwahrens</dc:creator>
		<pubDate>Sat, 05 Jul 2008 18:12:49 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118236</guid>
		<description>No, those colored bars really don't give you as much comfort as you think.  They, too can be fooled.

There is NOTHING like being aware that NOBODY sends an email to their customers with a link to follow where you are asked for personal information.  One should ALWAYS go to your vendor's site using your own bookmarks, or better yet, just calling them to settle any possible problems.

That is a cross platform issue, and is not unique to Macs or PCs.</description>
		<content:encoded><![CDATA[<p>No, those colored bars really don&#8217;t give you as much comfort as you think.  They, too can be fooled.</p>
<p>There is NOTHING like being aware that NOBODY sends an email to their customers with a link to follow where you are asked for personal information.  One should ALWAYS go to your vendor&#8217;s site using your own bookmarks, or better yet, just calling them to settle any possible problems.</p>
<p>That is a cross platform issue, and is not unique to Macs or PCs.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: David Cintron</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118235</link>
		<dc:creator>David Cintron</dc:creator>
		<pubDate>Sat, 05 Jul 2008 18:08:23 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118235</guid>
		<description>I think the posters claim that many would have recently purchased an iPhone 3G is a little off since it is not available for sale on the internet. Also it's iPhone 3G, not 3G iPhone. Naming is very important.</description>
		<content:encoded><![CDATA[<p>I think the posters claim that many would have recently purchased an iPhone 3G is a little off since it is not available for sale on the internet. Also it&#8217;s iPhone 3G, not 3G iPhone. Naming is very important.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Anonymous Coward</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118234</link>
		<dc:creator>Anonymous Coward</dc:creator>
		<pubDate>Sat, 05 Jul 2008 18:06:25 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118234</guid>
		<description>Apple needs to step up and improve the support for EV SSL certificates in Safari- this is what eBay/Paypal have been complaining about recently. Both IE7 and FF have this and, in IE7, the green address bar or dark red one give clear signals to the user regarding the state of the connection to the site. I'd like to see browsers start linking their password stores to not just the site URL but also the site certificate as this would give another indication that the user hasn't visited the site before. There's also a lot of work going with "Information Cards", both from Microsoft and the open community, it'd be great to see Apple engage in that.</description>
		<content:encoded><![CDATA[<p>Apple needs to step up and improve the support for EV SSL certificates in Safari- this is what eBay/Paypal have been complaining about recently. Both IE7 and FF have this and, in IE7, the green address bar or dark red one give clear signals to the user regarding the state of the connection to the site. I&#8217;d like to see browsers start linking their password stores to not just the site URL but also the site certificate as this would give another indication that the user hasn&#8217;t visited the site before. There&#8217;s also a lot of work going with &#8220;Information Cards&#8221;, both from Microsoft and the open community, it&#8217;d be great to see Apple engage in that.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Brendan West</title>
		<link>http://theappleblog.com/2008/07/05/phishing-scam-apple-store/#comment-118233</link>
		<dc:creator>Brendan West</dc:creator>
		<pubDate>Sat, 05 Jul 2008 17:50:30 +0000</pubDate>
		<guid isPermaLink="false">http://theappleblog.com/?p=3646#comment-118233</guid>
		<description>You guys really should point out for Safari users a lock icon DOES appear in the upper right corner of a Safari window when you're in a secure protocol (HTTPS).</description>
		<content:encoded><![CDATA[<p>You guys really should point out for Safari users a lock icon DOES appear in the upper right corner of a Safari window when you&#8217;re in a secure protocol (HTTPS).</p>
]]></content:encoded>
	</item>
</channel>
</rss>

<!-- Dynamic Page Served (once) in 1.428 seconds -->
<!-- Cached page served by WP-Cache -->
<!-- Compression = gzip -->