5 ms·

Hi everyone. I registered bogusapple.com after a buddy of mine posted a screenshot of Little Snitch prompting iTunes' access to the domain. All credit for find

Hi everyone. I registered bogusapple.com after a buddy of mine posted a screenshot of Little Snitch prompting iTunes' access to the domain. All credit for finding this snafu goes to gentmatt, and my bank account for allowing me the ability to frivolously buy a domain. I don't believe that accessing this domain is built directly into the compiled code of apps, since (in my opinion) it did not happen close enough to a software update. I believe it is just some kind of a typo (bogus.apple.com?) for something used as part of the web page views that comprise the iTunes and the Mac App Store apps. I fully expect that this problem will quietly go away once they deploy new versions. I picked up the domain just to see if any particularly exciting web requests were being made, and it's been fun to watch user agents, but as soon as Twitter, news sites, and forums got wind of it, it's pretty much impossible for me to discern any meaningful traffic anymore. I suppose I could start filtering any requests with a referer, or ones not coming from *.apple.com. We'll see. It's been a fun 13 hours. Any questions?

avar 14y ago
Not a question but just a word of advice to be careful. What you did could to a layperson be construed as intentionally exploiting a bug in their software with the result that you're now intercepting requests from unsuspecting customers of theirs, and getting data via your logs that in some countries falls under privacy laws. Depending on how big of an embarrassment this turns out to be for them and how well funded their legal department is this might not turn out to be hassle-free for you.
- famousactress 14y ago
  That's a shame, since the first thing that occurred to me was thank goodness someone with nefarious intentions didn't buy the domain and attempt to pass it off as something Apple owned (and thereby users might trust).
  - stcredzero 14y ago
    He should get permission to host a bunch of #fakestevejobs content. (Parodic tribute stuff, of course.)
- droithomme 14y ago
  Well, it's not his fault Apple is sending traffic to the web site he owns. If it is true that there is anything illegal with owning that domain and receiving traffic, then it is also true that a nefarious agent could "mistakenly" send a bunch of requests containing "private information" to the server of an enemy, then report the enemy's "illegal actions" to the authorities.
  - adlwalrus 14y ago
    This is a great point, and it illustrates the absurdity of many other laws as well.
  - thrownaway2424 14y ago
    Right. If there's anything illegal going on here, it's Apple using its customers' computers to DDoS this guy's domain.
  - codeka 14y ago
    The main difference here is that he bought the domain after it was known Apple was sending requests to it. But I do agree that any (hypothetical) legal ramifications would look bad for Apple.
  - rlpb 14y ago
    This isn't how the law works. The law cares about intent.
ChuckMcM 14y ago
In addition to user agents it would be useful to collect path strings and operations so if you're getting GET / or GET /something?option&option&option would be useful. I did a quick scan (not very definitive) through the Xcode SDK and didn't see anything hard coded with this name but you never know.
hk_kh 14y ago
You should start listening on 443
atomical 14y ago
How many hits have you got?
- VxJasonxV 14y ago
  Legitimate ones? Hard to tell. Onlookers as a result of this coverage? Lots. I don't really want to meaningfully count :).
ejdyksen 14y ago
Reminds me of this: http://slashdot.org/story/99/12/25/114201/microsoft-hotmailpassport-service-interruptedupdated http://slashdot.org/story/99/12/25/114201/microsoft-hotmailp...
- GICodeWarrior 14y ago
  It looks like the details are here: http://www.doublewide.net/ http://www.doublewide.net/
csmattryder 14y ago
On the Apple Community link, you state that you lack adequate logging of :443, could you not link bogusapple to localhost/dedicated server through the hosts file then boot up an Apache/whatever instance to log the access traffic?
- VxJasonxV 14y ago
  I didn't want to pay for an SSL certificate that would pass SSL validation (read: not StartCom, not CACert, and I will never ever support GoDaddy). Domain registration fees aren't going to break the bank, SSL is another story. Not to mention the whole 'proving who I am' and other identity checks any worthwhile SSL agency employs.

avar 14y ago

Not a question but just a word of advice to be careful. What you did could to a layperson be construed as intentionally exploiting a bug in their software with the result that you're now intercepting requests from unsuspecting customers of theirs, and getting data via your logs that in some countries falls under privacy laws. Depending on how big of an embarrassment this turns out to be for them and how well funded their legal department is this might not turn out to be hassle-free for you.

famousactress 14y ago
That's a shame, since the first thing that occurred to me was thank goodness someone with nefarious intentions didn't buy the domain and attempt to pass it off as something Apple owned (and thereby users might trust).
- stcredzero 14y ago
  He should get permission to host a bunch of #fakestevejobs content. (Parodic tribute stuff, of course.)
droithomme 14y ago
Well, it's not his fault Apple is sending traffic to the web site he owns. If it is true that there is anything illegal with owning that domain and receiving traffic, then it is also true that a nefarious agent could "mistakenly" send a bunch of requests containing "private information" to the server of an enemy, then report the enemy's "illegal actions" to the authorities.
- adlwalrus 14y ago
  This is a great point, and it illustrates the absurdity of many other laws as well.
- thrownaway2424 14y ago
  Right. If there's anything illegal going on here, it's Apple using its customers' computers to DDoS this guy's domain.
- codeka 14y ago
  The main difference here is that he bought the domain after it was known Apple was sending requests to it. But I do agree that any (hypothetical) legal ramifications would look bad for Apple.
- rlpb 14y ago
  This isn't how the law works. The law cares about intent.

ChuckMcM 14y ago

In addition to user agents it would be useful to collect path strings and operations so if you're getting GET / or GET /something?option&option&option would be useful. I did a quick scan (not very definitive) through the Xcode SDK and didn't see anything hard coded with this name but you never know.

hk_kh 14y ago

You should start listening on 443

atomical 14y ago

How many hits have you got?

VxJasonxV 14y ago
Legitimate ones? Hard to tell. Onlookers as a result of this coverage? Lots. I don't really want to meaningfully count :).

ejdyksen 14y ago

Reminds me of this: http://slashdot.org/story/99/12/25/114201/microsoft-hotmailpassport-service-interruptedupdated http://slashdot.org/story/99/12/25/114201/microsoft-hotmailp...

GICodeWarrior 14y ago
It looks like the details are here: http://www.doublewide.net/ http://www.doublewide.net/

csmattryder 14y ago

On the Apple Community link, you state that you lack adequate logging of :443, could you not link bogusapple to localhost/dedicated server through the hosts file then boot up an Apache/whatever instance to log the access traffic?

VxJasonxV 14y ago
I didn't want to pay for an SSL certificate that would pass SSL validation (read: not StartCom, not CACert, and I will never ever support GoDaddy). Domain registration fees aren't going to break the bank, SSL is another story. Not to mention the whole 'proving who I am' and other identity checks any worthwhile SSL agency employs.