updated 11:28 pm EDT, Wed March 19, 2014
Vulnerability shut down, but fooled visitors into providing info
Late Wednesday afternoon, Electronic Arts reported that it had finally closed a serious vulnerability on its web servers that allowed hackers to host a fake "Apple ID" page -- part of a phishing scam that attempted to trick users into visiting the fake page and supplying personal information and credit card details that Electronista reported on earlier today. Netcraft, which originally spotted the compromised pages, reported the problem to EA on Tuesday night.
The fake Apple ID page
MacNN has received reports that readers received emails citing recent, popular titles that the recipients may well have actually looked at or bought, with the explanation that their account may have been compromised and that users would need to "verify" their account details at a legitimate-looking URL that was disguised to hide the EA subdomain. Users who clicked on the URL directly from the email (a common phishing mistake) would be taken to the fake page and may reveal their iTunes account details, including credit card number.
"We found it, we have isolated it, and we are making sure such attempts are no longer possible," a company spokesperson said in an emailed statement late Wednesday afternoon, but questions remain about why the reported compromised pages were allowed to continue running even well into Thursday morning after being reported the previous evening. Initially, the company said it had "taken immediate steps to disable any attempts to misuse EA domains," but disputed the "underlying claims" of Netcraft's findings. Netcraft, for its part, immediately blocked the page by adding it to its list of phishing sites, used by a wide variety of browsers, anti-virus and filtering programs to block suspicious sites.
Apple itself has had a stellar record on protecting users' credentials from hackers, but it remains a tempting target for phishing scams, having over 500 million active credit cards on file. The company has added two-factor and Touch ID authentication as strengthened alternatives to help avoid fraud -- however, users tricked into supplying details or still using weak passwords are often the victims of phishing and other scams, though Apple usually covers any losses incurred from such incidents.
As has been the standing advice for users for years, clicking on links directly from "security threat" or "super bargain" type emails -- particularly when they say the site will require "confirmation" of personal details and financial info -- is to be avoided, but the URL can be manually copied and tested in a web browser if users are unsure. In addition, browsers often have visual signals to assure users that they are visiting the legitimate and secure site of a brand-name vendor.
How to tell one is on the real Apple website