While wading through a 1600+ reply thread on Apple Discussions I received an email from a colleague who relayed a similar story of his iTunes account getting hacked while he slept overnight:

I woke up this morning to let our puppy out and glanced at my Gmail inbox on my phone. I had an email from service@paypal.com with the subject “Your account has been limited until we hear from you.”

I assumed this had something to do with BillMeLater because I made a ~$500 purchase using BML within the last month. But then again, I have a ~$2k BML credit line and always pay it off well within the required period so this was just pure speculation.

Once I logged into PayPal, I noticed seven iTunes purchases all made around 3:45 a.m. Here’s a screenshot of the iTunes purchases that were made on my account while I slept:

I use the iTunes Store mostly for music purchases but I never make seven random purchases like that – especially at 3:45am. By the time I logged into Paypal, they were already all over it. All seven of the transactions were on-hold and it said “Awaiting Seller’s Response”…which I assume meant iTunes. I had no idea what was going on behind the scenes but I can only assume PayPal was reaching out to them to determine whether this pattern of charges was consistent with other fraudulent activity that has been taking place via iTunes with a linked PayPal account.

My password was strong as it consisted of an uppercase, lowercase, numbers, and was eight characters long. However, I haven’t changed the password for a few years. I’m bad with changing password unless prompted to do so. Guess I really need to change this mindset going forward. It appears that the hacker bought a combo of apps and videos (Project Runway, Season 8).

One lesson I learned in all this was to remove my checking account as the payment source in PayPal and switch it to a credit card.

I ended up filing a PayPal dispute for each of the seven transactions. Five of them have been reversed as of now. I received an automated response for each one that was reversed just stating what their decision was. Two are still under review by PayPal.

There were no signs of ‘Kingdom Conquest” in the iTunes Purchase History as was noted in the blog post by Adrian Kingsley-Hughes on ZDNET on May 12, 2012.

All of the fraudulent charges on my iTunes/PayPal account were apparently gifts for “ffffffffff.” (that’s 10 f’s — presumably to prevent you from counting).

Moving forward, Apple should provide more information to the victims of such attacks. Saying simply “we have reversed the purchase” isn’t enough. I’d like to know how much information was accessed, for example, is my bank info now potentially in the hands of a hacker? Or was the breach limited to iTunes accounts w/ linked Paypal accounts? Also, it would be helpful to know how this breach occurred. Also, what is being done to address it since this clearly isn’t an isolated case.

I asked these questions to Apple when I reported the problem though I assume I’ll get a vague response similar to how PayPal responded.

Update: R. Emory Lundberg adds some interesting color in a comment on Facebook:

In most instances I’ve seen this occur it is because either:

• The account is brute forced or the same email address/password pair is used elsewhere and they’ve been compromised,
• The user has had their iPhone or iPad/iPod on an open wireless network and someone snarfs their session and/or credentials

That second one is interesting because many people just configure MobileMe/.Mac/iCloud accounts as IMAP and don’t force it to use SSL or TLS and are doing plain-text SMTP or IMAP and leaking their account information that way.

Also, any email account associated with an iTunes account can be used like this, many people have several. The AppleID site can show you what addresses are valid for your AppleID. In my case I have $username@me.com, $username@mac.com, and then a $family@otherdomain.com and my personal email accounts for FaceTime et al.

Some things have started to change since the passing of Steve Jobs (witness the Apple dividend) but others not only remain the same, they rage on and even accelerate. Like the holy war between Apple and Google.

Jobs was known to have a chip on his shoulder about Android, claiming that Google unceremoniously stole it from Apple. Biographer Walter Isaacson had this doozy of a quote in Steve Jobs:

I will spend my last dying breath if I need to, and I will spend every penny of Apple’s $40 billion in the bank, to right this wrong. I’m going to destroy Android, because it’s a stolen product. I’m willing to go thermonuclear war on this.

Some things never change.

Google developed an amazing Navigation app for Android and it’s free. But it’s not available on iOS because Google’s loathe to give consumers any incentive to buy an iOS device. Google, after all, wants you to purchase an Android device. And it’s not going to put one of its defining apps (like Navigation) on iOS any time soon.

Take that, iPhone!

But there’s no love lost by Apple either.

In March Apple began using OpenStreetMap data in iPhoto for iOS — where Google map data would be the logical choice. Google’s map data is richer, it includes satellite, terrain and street view imagery, live traffic and information about practically every local business in the universe (complete with phone numbers and reviews).

(You can compare the quality of Apple’s, Google’s and OSM’s map data on this mashup site).

So why would Apple switch to obviously inferior map data in its products instead of using Google’s?

One word. Spite.

Just like Google’s loathe to release its amazing Navigation app on iOS, Apple’s loathe to pay Google to use its map data on iOS. (It’s unclear if Apple actually pays Google any cash for its map data, but the location data and queries are highly valuable and Google could probably find a way to make money from it, if it isn’t doing so already).

Apple was just testing the water with iPhoto. A spate of rumors over the weekend suggest that Apple is dropping Google as the data provider in its stock Maps app, which installed by default on the home screen of millions of iPhones, iPods and iPads. It would follow similar defections by Wikipedia and foursquare.

Take that Android!

According to the rumors, Apple is going to replace the Google with OpenStreetMap in the version of Maps that ships with iOS 6 — rumored to make its debut next month at WWDC. But instead of being inferior, rumors suggest that the new Apple offering could one-up Google Maps.

Apple has made several mapping acquisitions since 2009, including Placebase, Poly9, and C3 Technologies and rumors suggest that its been spending the last few years combining them into a super-secret Google-Maps killer. 9to5Mac’s Mark Gurman thinks that the result could be a stunning new iOS app that includes 3D renderings of cities and a “much cleaner, faster, and more reliable experience.”

I’m fine with change for the better, but I’m not fine with Apple releasing an inferior mapping product because it’s in a stupid holy war with Google. Maps is too important an app for Apple to use as a pawn in its game with Google. I use an iPhone because it’s better than the others offerings out there, but it’s a close race. If Apple takes a step backwards and dumbs down Maps, I won’t hesitate to defect to Android, and I suspect that I won’t be the only one.

Google Maps has quite a compelling feature set, will Apple be able to compete?

It looks like the venerable MacBook Pro may be going on a diet.

It’s no secret that the MacBook Air has been a smashing success for Apple, the razor thin notebooks are projected to contribute $7 billion to Apple’s bottom line this year and have spawned a parade of me-too Ultrabook clones from Intel.

But while the MacBook Air basks in the spotlight the workhorse MacBook Pro (like its big brother the Mac Pro) hasn’t garnered much attention. Last updated by Apple in October 2011, the MacBook Pro has sported the same unibody aluminum industrial design since its debut in the Fall of 2008.

It what reeks of a controlled leak, Bloomberg reports that Apple will release a thinner MacBook Pro at WWDC in June 11, 2012. Citing “people with knowledge of the plans” Bloomberg reports that the new MBPs will feature high-definition, Retina Displays “like those on the iPhone and iPad.” It’s also likely that the new MBPs will be powered by Intel’s new Ivy Bridge processors and come with OS X 10.8 “Mountain Lion” pre-installed.

ZDNET’s Sean Portnoy notes that DigiTimes’ supply chain sources state the the new MacBook Pros will go into production starting in June and will peak in July to allow for plenty of inventory for the critical back-to-school buying season.

Lending further credence the rumors, benchmarks for a MacBook Pro9,1 (and a new iMac desktop) running an Ivy Bridge Core i7-3820QM processor have surfaced with a Geekbench score of 12252 — about 17 percent faster than the current i7-powered MacBook Pro models.

Perhaps the most shocking rumor is that the new MBP will come with a USB 3.0 port, the first in a Mac. 9to5Mac reports that the latest Mountain Lion beta indicates that the upcoming Ivy Bridge machines will support USB 3.0 and a new NVIDIA GeForce GT 650M GPU.

Are you waiting for the new MacBook Pro or does the MacBook Air suit your needs?

Photo: 9to5Mac

OS X Lion v10.7.4 Update appears to have a number of attractive fixes for users in a Windows server environment, including improved reliability of binding and logging into Active Directory accounts, and when connecting to a WebDAV server. It appears to fix a longstanding bug for issues that may prevent files from being saved to an SMB server.

Details on the security portion of the update can be found here.

However, a number of storage vendors have reported problems with mounting external SATA storage following the update. In a Macintouch post, a Sonnet Technologies tech advised customers to wait on the update based on a number of support calls. However, the company hadn’t been able to replicate the issue.

Mark James of SoftRAID also posted on Macintouch saying that his company started receiving reports of SoftRAID volumes not mounting following the update. The company had then received reports of Apple RAID volumes also failing to mount.

However, we have identified the likely source of the problem through the kernel.log file. The file system is failing to mount the [volume].
If you encounter this problem (your RAID volume is not mounting), open the Kernel.log file in the Console.app and filter for “45″; you should see strings indicating “hfs_mountfs: buf_meta_bread failed with 45″. There are also entries with “unsupported function” when the OS tries to mount the volume.
We are investigating this, and do not yet have a solution. We want to alert all Lion users who use RAID (or PGP), do not update Lion to 10.7.4 until there is a published fix for this problem.

Some products that weren’t certified to run under OS X Lion but that had, now may break under the OS X Lion v10.7.4 Update. This may be with Java security tightening in the update. Some of these titles were detailed in the Macintouch discussion.

Some users may have been running VMWare Fusion 2.0.x under OS X Lion 10.7.3 or earlier, however, the end of the road is the latest update from Apple. Of course, the latest Fusion 4.1.2 is fully Lion compatible. VMWare certifies Version 3.x for Snow Leopard and Leopard but Version 3.1.3 will run Lion with some caveats explained in this Knowledge Base article.

The first-look review by AnandTech founder and editor in chief Anand Lal Shimpi looks at a MSi (Micro-Star International Co.) Z77A-GD80 motherboard, which supports Ivy Bridge and Sandy Bridge processors. It sports 8 SATA ports,  a pair of USB 3.0 ports and an option for two more. It also has an on-board FireWire header.

It’s all interesting reading. In his evaluation, his workbench littered with Thunderbolt storage devices “just worked,” except for the Pegasus R6 RAID array. There was no need to install drivers; all had native support under Windows 7.

However, there were limitations. For example, there are 4 PCIe slots on the logic board, but only a couple of slots can be used at any time dues to the Thunderbolt controller and overprovisioning concerns.

In addition, Anand said the system won’t support hot-plugging of Thunderbolt devices, including the Thunderbolt drives tested.

You can remove a Thunderbolt device once in Windows, but you cannot add a new one. Anything you want access to in Windows has to be plugged in at boot. OS X allows more flexibility in this regard as you can add/remove Thunderbolt storage and other devices while the OS is running, but even then it’s not always well behaved. It’s not all that uncommon to need a reboot after plugging in a chain of Thunderbolt devices under OS X, although admittedly Apple has been improving compatibility and behavior over time.

Update: Intel has informed us that we will see updated drivers for Windows certified Thunderbolt devices that will enable hot plugging under Windows. Intel further informed us that MSI’s board has not yet made it through the certification process and a lot of these teething issues will hopefully be addressed by then.

Or not. We will see how things move along. Mac users and developers have a year up on the Windows platform. Certainly, all Thunderbolt devices have been built with Macs in mind and tested on Macs. I hot-plug my Pegasus 4 regularly and I’ve had no troubles since the installation of the latest firmware.

According to Anand, Thunderbolt chains with many devices sometimes hang and it appears more frequently on the PC tested than with similar setups running on Mac OS X.

Anand offered several thoughts on the Thunderbolt market. He expects Thunderbolt won’t be deployed widely on PCs because of the extra cost of controllers and components.

Instead you can expect higher end motherboards to integrate it, or offer an add-in card of sorts which is the route ASUS is taking. I’d expect Ultrabooks to make better use of Thunderbolt naturally, but we will see it on desktops this year.

The meeting is being held in the Media Center of the Belhaven Ave. Middle School in Linwood, NJ (their home page has a link for directions near the bottom of the left column.)

I’ll be presenting a reprise of my favorite iPad apps that I gave at ACAMUG last year, with zero duplicates! Ok, maybe a couple toward the end, but there will be something for everyone. So bring your iPad and your iTunes password — it will be fun.

I’ll be posting a list of the apps that I present tonight here on The Apple Core sometime over the weekend (or Monday) for those that weren’t able to attend in person.

If you’re like me, you probably wish that iOS had widgets. (Widgets have been on my iOS wishlist for a long time)

There are a couple of things that would be convenient to do with one touch, like toggling Bluetooth on and off for example. The problem is that doing so requires the use of private/undocumented Apple APIs — which is forbidden by Apple’s developer agreement (and which is why Apple pulled Bluetooth OnOff from the App Store).

If you’ve ever wanted to quickly change your iPhone or iPad’s brightness setting without traversing the Settings app, I’ve got the app for you.

Atominx, Inc.’s Quick Brightness app (free, App Store) does just that. You simply set low and high brightness settings within the app, set QBright to “Switch the Brightness and Exit” from within Settings app and you’re done. Touch the app icon and it switches between your high and low brightness settings and returns you to the home screen.

The only problem is that unlike Bluetooth OnOff, Quick Brightness doesn’t hold its setting across a device lock. So there’s that. But it’s still much quicker than switching your brightness the old fashioned way.

I’m not sure if Quick Brightness uses private APIs (it was only approved on the App Store today), but a similar free app (Quick Bright) has been on the App Store since January 2012, so I’m assuming that it doesn’t. Curiously, Quick Bright is open source (via the MIT License) with full source available and a fork of DCRoundSwitch library, but Quick Brightness (which looks like a clone of Quick Bright) lists no such credits in its description.

Available versions include:

• OS X Lion Update 10.7.4 (Client) (692.68 MB)
• OS X Lion Update 10.7.4 (Client Combo) (1.4 GB)
• OS X Lion Update 10.7.4 (Server) Client (738.71 MB)
• OS X Lion Update 10.7.4 (Server) Combo (1.49 GB)

Apple has also released Security Update 2012-002 for users running Mac OS X Snow Leopard:

• Security Update 2012-002 (Snow Leopard) (238.73 MB)
• Security Update 2012-001 Server (Snow Leopard)

Here’s the info from the OS X Lion Update read me file:

The 10.7.4 update is recommended for all OS X Lion users and includes general operating system fixes that improve the stability, compatibility, and security of your Mac including fixes that:

• Resolve an issue where the “Reopen windows when logging back in” setting is always enabled
• Improve compatibility with certain British third-party USB keyboards
• Address an issue that may prevent files from being saved to a server
• Improve the reliability of copying files to an SMB server

For detailed information on this update, please visit this website: http://support.apple.com/kb/HT5167.

For information on the security content of this update, please visit: http://support.apple.com/kb/HT1222.

Much has been written about the iOS-ification of Mac OS, but what about the iOS-ification of the Web?

It began with features from iOS slowly migrating into OS X on the desktop — like LaunchPad, gestures, reverse scrolling and sandboxing (which arrived in  OS X 10.7 Lion) and it continues with Notifications, Messages, Reminders, and Notes which will arrive this summer in OS X 10.8 Mountain Lion.

It appears that Apple might be taking its iOS features to a completely new frontier — the Web browser.

MacRumors and 9to5Mac both reported sightings of what appear to be an iOS-like notification banner while browsing iCloud.com from a desktop Web browser.

The notification (pictured above) simply reads “Default Title for English- This is a test message description” and appears to be a test of a possible future iCloud status notification and most likely an extension of Notification Center which arrived in iOS 5 and is slated to arrive on the desktop in OS X 10.8 (”Mountain Lion”) in late summer 2012.

9to5Mac notes that the icon in the notification banner is the icon Apple uses to signify troubleshooting, help, and system status.

While such a feature isn’t unrealistic (in fact, it feels like a natural evolution of Notification Center) it shows how far Apple’s iOS features have come.

Apple today released iOS 5.1.1 (build 9B206, 54.4 MB) for iPhone, iPad and iPod touch. According to the release notes iOS 5.1.1 addresses the following:

• Improves reliability of using HDR option for photos taken using the Lock Screen shortcut
• Addresses bugs that could prevent the new iPad from switching between 2G and 3G networks
• Fixes bugs that affected AirPlay video playback in some circumstances
• Improved reliability for syncing Safari bookmarks and Reading List
• Fixes an issue where ‘Unable to purchase’ alert could be displayed after successful purchase

Perhaps more importantly, iOS 5.1.1 also contains a number of security fixes according to Apple knowledgebase article HT5278, including Safari vulnerabilities that allow maliciously crafted websites to be able to spoof the address in the location bar, execute cross-site scripting attacks and cause unexpected application termination or arbitrary code execution.

The update is being pushed out to devices Over-The-Air (OTA), but iOS 5.1 users can also download it immediately by touching Settings > General > Software Update. You can also install iOS 5.1.1 by plugging your device into iTunes and clicking on Update.

Further reading:

• Apple patches serious security holes in iOS devices
• iOS 5.1.1 update squashes iPad 3 2G/3G network switching bug