The Haphazard Blog

Over the long weekend, there were reports that iTunes accounts were hacked and fraudulent purchases were made in iTunes and the App Store. Most notorious was a single author having a lot of his books in the top 50 in iBooks. Yesterday, Apple responded with the following:

The developer Thuat Nguyen and his apps were removed from the App Store for violating the developer Program License Agreement, including fraudulent purchase patterns.

Developers do not receive any iTunes confidential customer data when an app is downloaded.

Engadget also reported that roughly 400 iTunes users were affected by this. To me, all of this does not make sense. I still have questions, and as far as I can tell, the press has taken Apple’s word and moved on to other things.

1. How was a developer able to make fraudulent purchases on other users’ behalf?
2. Is Apple implying that Apps this developer made were able to do this? If so, what have they done to prevent other developers from doing the same thing? Have they issued a remote kill on his Apps? This would seem to be a very big security issue. (Also, some of the people who reported the fraudulent activity claimed they never purchased anything from that developer).
3. If they aren’t implying that, what other mechanism was used by this developer?
4. Apple’s own PR says that over 1.5M books were downloaded in the first 28 days. Since then, over 2M more iPads were sold. It took only 400 iTunes accounts to push 42 books into the Top 50? On the surface, it seems like a very low number of books (assume 400 copies of each) to take over the Top 50. Are sales for popular books that low?

I hope people out there are doing some more digging on this and not just taking Apple’s statement as the full story.