iPhone dev: Apple gave out my password

Social engineering attacks are devastatingly effective.

That's the guy who developed Nokia Multimedia Transfer.app!!

I'm sorry for him, hope everything got solved in the end

Apple IDs are known targets of crooks. Someone has been trying to guess my password recently, written up at spamwars.com/archives/2008/07/an_unnerving_pa.html.

Update 2: So it's soon 48 hours after the password reset, but no further contact from Apple. Perhaps I should let them know that, so far, 65 000 people have seen this and many might be wondering how Apple will end up handling the case?


Yeah, go on and try to get something for free. Isn't that what you are after? So exactly 65 000 people saw this. And how many commented?

His story is pathetic and so is the entire issue.

Can we stop paying attention to this bs...

Apple obviously plans to give out everyone's user data in the future. That's what the Mobile Me switch is all about. They are the new AOL.

To all idiot commenters above who never understood the story:
Marko Karpinnen is person who has an ADC account. One day, he logs in to his ADC membership account and couldn't log in because his password was invalid. Marko says hmm, so we he went on to reset his password by going through the ADC site's password reset. His security question response was accepted and he was successful in resetting his password. Now confused, he began looking into his ADC account and finds out that it had been accessed by someone else. He also noticed that his account is now owned by a person with an email marko.blablah@yahoo.com. While it looks like his because his name is also Marko, it's not actually his e-mail. He also discovered that his .Mac e-mail accounts was accessed. To his surprise, one of the e-mails there is an auto reply from the Apple servers that someone requested a password reset through the ADC feedback web form. The actual message sent through the form was the "am forget password of mac..." statement you see above. He then began securing all his other accounts that he might have thought had been linked to his ADC. Since he only uses his .Mac email for ADC business, he says the damage was minimized, but yet to see the full magnitude of the situation. He then contacts Apple with the details of the events and had since been touched once by someone from the Apple team. Marko is still waiting for more explanations from Apple.

Okay, this is not just one person craving for attention. It was a legitimate concern and he posted this event due to his frustration with the situation. Imaging the stress someone has to go through when personal (or even worse financial) info gets compromised. Take it or leave it. If you think Marko is an attention whore, then move on. I am as skeptical as everybody else, but let's keep an open mind and have patience as we wait for the whole thing to unfold. The best thing to do is to bookmark his blog post because he's updating it for sure.

I don't know what is worse: the poor grammar in the email, or the IDIOT who works at Apple. Can I have a high paying job at Apple too? I promise to be a complete moron and screw things up just as fast as I can.

"As a result of the login change, the perp had access to Karppinen's credit card details..."

Unless you count the last 4 digits of a credit card number as "details", that's patently untrue.

Apple does not allow you to view your CC details through your account other than the last 4 digits.

It is true that he could have used the stored card data for iTunes Store purchases, but that's about all.

Alright already. Enough with this stupid story. It's been on Digg, it's been on consumerist, it's been on AppleInsider, it's been on CultofMac, it's been onMacRumors, etc etc etc.
How many sites need to post the same daggone story?

To those who aren't understanding it: a phisher sent that forged email directly from his own email account to apple saying "Hello, I have lost my password, can you send me login info for my account, and change it to match this email marko.[redacted]@yahoo.com?" and Apple did without checking anything, let alone the horribly broken grammar.

And to the guy who asked why you'd store your credit card anywhere, it's because he had to to use their services.

All your passwords are belong to us.