4 ms·

iTunes Connect Issue Logging Developers into Other Accounts

66 points by sachalep 12y ago

fnayr 12y ago
Probably has to do with them trying to finally release the analytics they were supposed to release in Fall 2014.
mik3y 12y ago
Saw it firsthand, it was like account roulette for about 5-10 minutes. Then someone hit the big red button around 11:50a eastern. Smells like something messed up in their session or caching layers..
charlesdm 12y ago
That is one major (excuse my language) fuck up.
julien_c 12y ago
What were the security implications for an entity that has applications there? Anything we should check or change as soon as iTunes Connect is back up?
- Aqua_Geek 12y ago
  Somebody mentioned that trying to perform actions on the apps would error out, so it seems more like an information leakage issue. That being said, when it come back online I'm definitely going to go through all my apps.
  - xuki 12y ago
    Check your users as well. Someone could have created an account.
  - charlesdm 12y ago
    The thought of someone creating a new user on your account like that is disturbing.
  - jobu 12y ago
    Yeah, I wonder how many paid apps are now free.
- k-mcgrady 12y ago
  It sounds like the only issue would be that you could potentially see unreleased apps. You couldn't access financial/payment records and couldn't access app details. You could just see the app dashboard. This is all according to reports I've read in the last hour or so.
  - crazycanuck 12y ago
    You definitely could access app details. Not sure if you could change them - I didn't try - but here's the evidence: https://www.dropbox.com/s/qd0clsmx10h4tpd/Screenshot%202015-01-29%2011.27.20.png?dl=0 https://www.dropbox.com/s/qd0clsmx10h4tpd/Screenshot%202015-... egads!
    - k-mcgrady 12y ago
      Shit, even if not possible to edit that's worse as it includes an address and phone number for the business and the technical contact.
dham 12y ago
logged into another app. Then refreshed and got this. 'use strict'; define(function () { var itcApp = angular.module('itcApp', ['ngRoute', 'routeResolverServices', 'angularFileUpload', 'global_services', 'global_directives', 'global_filters', 'form_elements', 'ngCookies', 'angulartics', 'angulartics.adobe.analytics', 'ngSanitize', 'pasvaz.bindonce']); itcApp.config(['$routeProvider', 'routeResolverProvider', '$controllerProvider', '$compileProvider', '$filterProvider', '$provide', '$httpProvider', '$locationProvider', '$cookiesProvider', '$analyticsProvider', '$sceDelegateProvider', function ($routeProvider, routeResolverProvider, $controllerProvider, $compileProvider, $filterProvider, $provide, $httpProvider, $locationProvider, $cookiesProvider, $analyticsProvider, $sceDelegateProvider) { $routeProvider.when('/', { template: '<div></div>', controller: ['$window', function ($window) { $window.location.href = '/WebObjects/iTunesConnect.woa'; }] }).otherwise({ redirectTo: '/' }); }]); return itcApp; }); So they load all of Angular then redirect to another page?
stevebot 12y ago
god damn, and posting the images to twitter.
United857 12y ago
It's interesting to compare Apple and Google. Talent-wise, Apple has always been a "front-end" focused company, and they've now had several fiascos when they've started to get into "back-end"/cloud stuff (this, iCloud privacy leak, etc...) In contrast, similarly Google had been a "back-end" focused company, and their first few versions of Android were horrible and clunky compared to iOS (but they've improved a lot).
eknkc 12y ago
It's such a bad fuck up that it would justify someone pulling power cables from all iTunes Connect servers to disable access.
crgt 12y ago
It's back up but it's still broken. When I log in with account X, I see the apps associated with account X. Within My Apps, and within Payments, I see the apps associated with account X. BUT. When I tap Sales & Trends, I see data for account Y. It's also one of mine, but it's associated with completely different Apple IDs and user names. I am able to navigate back and forth through the different sections of iTC and get a bizzaro merger of the two accounts. The Sales & Trends sections seems to be powered by https://reportingitc2.apple.com/ https://reportingitc2.apple.com/? and that's when I end up on an incorrect account. Scary.

66 points by sachalep 12y ago

fnayr 12y ago

Probably has to do with them trying to finally release the analytics they were supposed to release in Fall 2014.

mik3y 12y ago

Saw it firsthand, it was like account roulette for about 5-10 minutes. Then someone hit the big red button around 11:50a eastern. Smells like something messed up in their session or caching layers..

charlesdm 12y ago

That is one major (excuse my language) fuck up.

julien_c 12y ago

What were the security implications for an entity that has applications there? Anything we should check or change as soon as iTunes Connect is back up?

Aqua_Geek 12y ago
Somebody mentioned that trying to perform actions on the apps would error out, so it seems more like an information leakage issue. That being said, when it come back online I'm definitely going to go through all my apps.
- xuki 12y ago
  Check your users as well. Someone could have created an account.
- charlesdm 12y ago
  The thought of someone creating a new user on your account like that is disturbing.
- jobu 12y ago
  Yeah, I wonder how many paid apps are now free.
k-mcgrady 12y ago
It sounds like the only issue would be that you could potentially see unreleased apps. You couldn't access financial/payment records and couldn't access app details. You could just see the app dashboard. This is all according to reports I've read in the last hour or so.
- crazycanuck 12y ago
  You definitely could access app details. Not sure if you could change them - I didn't try - but here's the evidence: https://www.dropbox.com/s/qd0clsmx10h4tpd/Screenshot%202015-01-29%2011.27.20.png?dl=0 https://www.dropbox.com/s/qd0clsmx10h4tpd/Screenshot%202015-... egads!
  - k-mcgrady 12y ago
    Shit, even if not possible to edit that's worse as it includes an address and phone number for the business and the technical contact.

dham 12y ago

logged into another app. Then refreshed and got this. 'use strict'; define(function () { var itcApp = angular.module('itcApp', ['ngRoute', 'routeResolverServices', 'angularFileUpload', 'global_services', 'global_directives', 'global_filters', 'form_elements', 'ngCookies', 'angulartics', 'angulartics.adobe.analytics', 'ngSanitize', 'pasvaz.bindonce']); itcApp.config(['$routeProvider', 'routeResolverProvider', '$controllerProvider', '$compileProvider', '$filterProvider', '$provide', '$httpProvider', '$locationProvider', '$cookiesProvider', '$analyticsProvider', '$sceDelegateProvider', function ($routeProvider, routeResolverProvider, $controllerProvider, $compileProvider, $filterProvider, $provide, $httpProvider, $locationProvider, $cookiesProvider, $analyticsProvider, $sceDelegateProvider) { $routeProvider.when('/', { template: '<div></div>', controller: ['$window', function ($window) { $window.location.href = '/WebObjects/iTunesConnect.woa'; }] }).otherwise({ redirectTo: '/' }); }]); return itcApp; }); So they load all of Angular then redirect to another page?

stevebot 12y ago

god damn, and posting the images to twitter.

United857 12y ago

It's interesting to compare Apple and Google. Talent-wise, Apple has always been a "front-end" focused company, and they've now had several fiascos when they've started to get into "back-end"/cloud stuff (this, iCloud privacy leak, etc...) In contrast, similarly Google had been a "back-end" focused company, and their first few versions of Android were horrible and clunky compared to iOS (but they've improved a lot).

eknkc 12y ago

It's such a bad fuck up that it would justify someone pulling power cables from all iTunes Connect servers to disable access.

crgt 12y ago

It's back up but it's still broken. When I log in with account X, I see the apps associated with account X. Within My Apps, and within Payments, I see the apps associated with account X. BUT. When I tap Sales & Trends, I see data for account Y. It's also one of mine, but it's associated with completely different Apple IDs and user names. I am able to navigate back and forth through the different sections of iTC and get a bizzaro merger of the two accounts. The Sales & Trends sections seems to be powered by https://reportingitc2.apple.com/ https://reportingitc2.apple.com/? and that's when I end up on an incorrect account. Scary.