RSSApple makes e-mail harvesting easy with MobileMe
By Ed Oswald | Published August 22, 2008, 1:00 PM
A curiously simple oversight may have opened every MobileMe user to the risk of having their e-mail address harvested just by looking through the company's iDisk folder hierarchy.
Specifically, the oversight appears to be that every MobileMe user's iDisk folder is named with the exact same username as his or her e-mail address. All a spammer would need to do is add '@me.com' to this information, and the legitimate e-mail address is complete.
It should be mentioned that this is not a new problem for MobileMe -- it appears to have been a risk since iDisk was introduced in .Mac as well, but it certainly does not help the tarnished image of Apple's online service.
Folders are Web-accessible through an address like the following: idisk.mac.com/steve-public. Some are saying it may be as easy as using a Web crawler tool in order to figure out the entire folder hierarchy.
TechCrunch, which was the first to report on the possible security flaw, also suggested hackers may use a dictionary attack to figure out usernames.
Selling e-mail addresses is a lucrative business. However, those addresses aren't valuable commodities unless they can be verified as legitimate. Obviously, if a user has an iDisk folder -- the e-mail address attached to it is going to be legitimate.
Worse yet may be Apple's response to the matter. It appears as if the company is aware of how potentially easy it may be to put its users at risk, but seems willing to do nothing in response.
"We've never had a complaint from a customer about people spamming them because of their iDisk public folder name. There is no way to remove your account name from the iDisk folders. I'm very sorry," a Apple representative told one person.
Issues with MobileMe e-mail are nothing new. Other than the obvious connectivity issues, last week it was discovered customers of the service were the target of a phishing scam aimed at stealing personal information.
Apple did not respond to requests for comment as of press time.
Money corrupts and Apple is no exception. Here's to the newest EVIL empire...
Score: 0
|huh, interestingly enough I created a new hotmail and gmail account which wasn't really used anywhere yet and within few days I started receiving spam.. If its that easy without the email actually being out there I don't think this is a BIG DEAL.
Score: 0
|I think hackztor hit the nail on the coffin with the line, "you have to remember Apple is expanding globally fast".
They are now in the horrible spot of having to re-succeed! Success is tough to repeat and staying ahead of the market is even tougher.
http://afewtips.com
Score: 0
|Apple is getting hit hard with MobileMe because of there precedent perfectionist image. Apple brought this upon themselves with their slogan "It Just Works". I think now Apple is realizing that they are not invulnerable to problems. In addition, you have to remember Apple is expanding globally fast. There will be alot more problems now once you get a larger user base. Everyone has problems, but the larger the user base the more people see of those problems. Ask yourself who has used Windows vs who has used Mac OS.
Score: 0
|Great job Crapple!
Score: 0
|I don't think it takes an iDisk account to get spammed, just check your own email inbox/junk box.
Nothing to see here, move along people. Just more envious apple bashing by those unfortunate enough not to have experienced a truly modern and impressive OS called OSX.
Score: 0
|>>
Just more envious apple bashing by those unfortunate enough not to have experienced a truly modern and impressive OS called OSX.
>>>
Or people that know a bit more about security than someone posting on a forum that thinks a BSD/MACH based OS is 'modern'...
Score: 0
|I don't think it takes an iDisk account to get spammed, just check your own email inbox/junk box.
You're absolutely right. The amount of spam e-mail on any account is huge; even addresses that aren't published. So when all users of an e-mail service have their addresses published in the open on the web, guess how much spam that will attract.
It's ok. I'll wait.
Score: 0
|Apple's really been hitting it out of the park with this whole MobileMe rollout!
Score: 0
|Wow. Good job, Apple!
Score: 0
|