4 ms·

> It’s also not clear how the attacker got my billing and shipping info. This sounds like a real mystery. I wonder what happened here and how Apple is so confi

by arbuge 4y ago

> It’s also not clear how the attacker got my billing and shipping info. This sounds like a real mystery. I wonder what happened here and how Apple is so confident that your account wasn't compromised, because it really sounds like it was. Either that or some other account with those same credentials was. It's also a bit of a mystery to me why the hackers would use your shipping info to begin with here. Why not some address where retrieving things would be easier for them? They must have been really confident they could intercept your package.

maicro 4y ago
If I had to guess, the answer to both is some stolen session issue - either personal device or a device that the user was logged into once had saved login information, which the attacker gained access to. However, to reduce the chance of needing to verify any information/login again, they left the default shipping address (as changing it would have A] left an address trail, and B] been suspicious). But again, that's my guess - I'll leave solid answers to the actual security researched in the comment chain X)
- zenexer 4y ago
  That was my guess, too. However, Apple seemed to think there was no relevant session activity on my account at the time. They stopped short of confirming that the payment and shipping info was entered manually. When I asked directly, they initially said they’d put me in touch with the fraud team, but the fraud team refused to talk directly to me and would only talk through another support rep. They refused to answer any questions about how the order was placed.
zippergz 4y ago
This happened to me (this exact scam, with the email bomb, shipping and email matching my real addresses, etc.) a few years ago with a major electronics brand. My account was not compromised because I didn't have an account with them. But probably some other company got compromised, and they got my my matching info from one of those dumps.
zenexer 4y ago
I had very similar questions for Apple, but they refused to answer most of them. I’m confident my Apple account wasn’t compromised directly: - Apple confirmed there were no login attempts around the relevant time period - I have 2FA enabled, but I didn’t receive any approval alerts and couldn’t have leaked the number even if I had—I was asleep at the time. This doesn’t rule out malware, though. - All authorized devices on my account were in my home. My home was locked. - I use a randomly-generated password. That doesn’t rule out phishing, though. Session stealing is still a possibility, but Apple seemed reasonably confident that hadn’t happened. Initially, I was promised a call back from Apple’s fraud team. However, after closing they investigation, they refused to talk to me directly. They wouldn’t even tell me the IP address used to check out. I do know that the order was placed on the website, rather than in a store. As to why they would use my shipping info: I still don’t know. If they entered the info manually, it’s awfully convenient that it exactly matched the info on my Apple account, considering most companies don’t get that info. I do know that T-Mobile and Citizens Bank both have that info, since I have T-Mobile as a carrier and am enrolled in the iPhone Upgrade Program. My T-Mobile billing info didn’t match exactly, but it was very similar. Citizens Bank matched exactly. I’ve now given both Citizens Bank and T-Mobile unique email addresses that differ from my Apple ID.

by arbuge 4y ago

maicro 4y ago

If I had to guess, the answer to both is some stolen session issue - either personal device or a device that the user was logged into once had saved login information, which the attacker gained access to. However, to reduce the chance of needing to verify any information/login again, they left the default shipping address (as changing it would have A] left an address trail, and B] been suspicious). But again, that's my guess - I'll leave solid answers to the actual security researched in the comment chain X)

zenexer 4y ago
That was my guess, too. However, Apple seemed to think there was no relevant session activity on my account at the time. They stopped short of confirming that the payment and shipping info was entered manually. When I asked directly, they initially said they’d put me in touch with the fraud team, but the fraud team refused to talk directly to me and would only talk through another support rep. They refused to answer any questions about how the order was placed.

zippergz 4y ago

This happened to me (this exact scam, with the email bomb, shipping and email matching my real addresses, etc.) a few years ago with a major electronics brand. My account was not compromised because I didn't have an account with them. But probably some other company got compromised, and they got my my matching info from one of those dumps.

zenexer 4y ago

I had very similar questions for Apple, but they refused to answer most of them. I’m confident my Apple account wasn’t compromised directly: - Apple confirmed there were no login attempts around the relevant time period - I have 2FA enabled, but I didn’t receive any approval alerts and couldn’t have leaked the number even if I had—I was asleep at the time. This doesn’t rule out malware, though. - All authorized devices on my account were in my home. My home was locked. - I use a randomly-generated password. That doesn’t rule out phishing, though. Session stealing is still a possibility, but Apple seemed reasonably confident that hadn’t happened. Initially, I was promised a call back from Apple’s fraud team. However, after closing they investigation, they refused to talk to me directly. They wouldn’t even tell me the IP address used to check out. I do know that the order was placed on the website, rather than in a store. As to why they would use my shipping info: I still don’t know. If they entered the info manually, it’s awfully convenient that it exactly matched the info on my Apple account, considering most companies don’t get that info. I do know that T-Mobile and Citizens Bank both have that info, since I have T-Mobile as a carrier and am enrolled in the iPhone Upgrade Program. My T-Mobile billing info didn’t match exactly, but it was very similar. Citizens Bank matched exactly. I’ve now given both Citizens Bank and T-Mobile unique email addresses that differ from my Apple ID.