iTunes account theft strikes close to home

iTunes account theft strikes close to home

By Susan Bradley

These days, even online security experts can get burned by identity thieves who strike at popular online services.

A recent attack on an iTunes account dramatically points at the need to regularly change passwords and manage online billing info.

Inconvenient? Absolutely. But one of the most-effective ways to prevent online fraud is to close down automated billing on all of your online accounts.

I know this from first-hand experience. It started May 25 at 11:01 p.m. I happened to be online and received an e-mail confirming my payment of $40.65 for videos, tunes, and movies at the Apple iTunes store. There was one problem: I hadn’t purchased anything from Apple since May 15!

Concerned, I went into my iTunes account to see what was up. Much to my surprise, my password no longer worked. I tried again but was locked out — was refused access.

Luckily, I could reset my password. Once logged in, I discovered that someone had just made another transaction — the newly purchased videos and music were awaiting download.

To put a complete halt to any additional, unauthorized charges, I immediately removed the billing option that automatically charged my bank account after each transaction. I also changed my user sign-in name.

Apple offers no help tracking down the perps

My next stop was Apple’s iTunes customer service, where I explained the situation and asked what had happened to my account. And that’s when the fun began.

Exactly how did someone gain access to my account? The e-mail I eventually received from Apple offered no explanation — just a recommendation that I change my password and contact my bank to remove the charges.

But I still wanted to know how someone had accessed my account. I checked my systems for unwanted password-sniffing programs but found nothing on two Windows 7 desktops, one Windows 7 laptop, and my MacBook Pro. Moreover, the content that someone had purchased was still in my iTunes download section. So what had the mystery purchaser gained by accessing my iTunes account? (There were no other fraudulent transactions using my bank account.)

As an IT professional who follows PC security issues, I took this event as a challenge. I tried to acquire the IP address of my identity thieves’ computers, which might tell me where they were located. This Apple would not provide, stating it could not release this information without a subpoena.

More Apple and AT&T security breaches

I researched the Web and quickly discovered I wasn’t alone. About a year ago, blogger Gary LaPointe suffered a similar fate. In late May 2010, others added similar experiences to his post. More reports also showed up in Mac forums and in a Facebook page devoted to iTunes issues. The problem spread as far as Japan, where a news story discussed local iTunes identity thieves.

Since May, there’s been more bad news for Apple. In a highly publicized incident, AT&T came under fire for a security breach affecting iPad 3G users. Hackers found a vulnerability in AT&T’s customer database and used it to harvest e-mail addresses. With that information, they then posted a list of notable iPad 3G users such as Diane Sawyer and my sister. AT&T sent apology e-mails to everyone who owned an iPad with 3G Internet access.

Apple’s woes didn’t stop there. On opening day for preorders for the iPhone 4, allegations by several tech sites — including a Gizmodo story — charged that the AT&T preorder site had inadvertently shared personal information among site users.

It should be noted that, although these latest breaches were AT&T’s problem, they still tarnish Apple.

Take control of your online services billing

The best way to protect yourself from online fraud and identity theft is not to leave your financial information in the hands of others. You’ve probably heard or read the following tips before, but now it’s more important than ever to implement them.

• Use a passphrase and not a password. For example, “This is my passw0rd and 1t’s for my use only!” and “Purple ducKs run awkWardly” are good passphrases; they make a sentence that’s either nonsensical or would never be obvious to a hacker.

  Add capital letters, numbers, special characters, and (where allowed) spaces to enhance your passphrase. iTunes, for instance, would not allow me to use a space within my passphrase.

• Don’t leave credit cards attached to online sites or services. Leaving a credit card number in a vendor’s database for automatic, recurring payments is enticingly convenient, but its security is no longer in your hands.
• If possible, have just one credit card that you use only for online purchases. If its number is stolen, you can cancel it with minimal impact on your daily, necessary purchases.
• Review your account reset information. Know how to reset your sign-in information quickly so that thieves cannot easily use your online habits or social-sites data to take over your account by resetting it to their own password and ID, as happened to me.
• Regularly review your online transactions, both in your online banking account and in paid sites and services you’ve recently used. In the case of iTunes, it can take up to 48 hours for a transaction confirmation e-mail to land in your inbox.

Bottom line: I no longer get the instant gratification of immediately downloading that 99-cent, must-have iPhone app. Now, I have to return to my desktop for every iTunes transaction; but in the long run, it will mean a safer online experience.

Remember that you have few rights with online transactions. Apple, for example, is not obligated to reverse the charges. You have to ask the bank that issued your credit card to remove them. It’s too bad that Apple seems to treat iTunes identity theft as the customers’ problem.

Susan Bradley recently received an MVP (Most Valuable Professional) award from Microsoft for her knowledge in the areas of Small Business Server and network security. She’s also a partner in a California CPA firm and writes the Windows Secrets Patch Watch column.

What's the best choice for a novice Linux user?

By Tracey Capen

It’s unlikely that Linux will ever be on every desktop PC, but there’s a growing and dedicated corps of PC users that find it far more than a curiosity.

Linux use ranges from simple desktop terminals to supercomputers, and advocates point to its flexibility and open-source coding as just some of the reasons it makes a superior development platform.

In his post, “I need help choosing a version of Linux,” Eric Findley wants to try this operating environment in diskless terminals. But he’s new to Linux, and he’s hoping other Lounge members can suggest the best version of the OS for his application. More»

The following links are this week’s most-interesting Lounge threads, including several new questions that you may be able to provide responses to:

☼ starred posts — particularly useful

If you’re not already a Lounge member, use the quick registration form to sign up for free. The ability to post comments and take advantage of other Lounge features is available only to registered members.

If you’re already registered, you can jump right in to today’s discussions in the Lounge.

The Lounge Life column is a digest of the best of the WS Lounge discussion board. Tracey Capen is technical editor of WindowsSecrets.com.

Outclassed by his canine exercise partner

By Stephanie Small You know what they say: imitation is the sincerest form of flattery. When someone copies your workout technique, it’s subtle proof that they admire your style. But is it just as rewarding when imitation (and admiration) comes on four paws? Watch as this well-toned dog exercises alongside its human workout partner. It may inspire your own pets! Play the video

Windows' primary disk-checking tool gets stuck

By Fred Langa Windows’ built-in disk-repair tool, chkdsk.exe, has come a long way over the years, but some disk problems are simply beyond its ability to remedy. When Windows’ disk check is not up to the task, third-party repair tools may be your ticket back to a healthy hard drive.

Chkdsk runs and then fails at every boot

Tom Vetterani’s PC has a disk error that Windows can’t fix.

• “This is my seemingly impassable issue at Windows start-up. I restart my computer and it notifies me it needs to run a file system check. It says the usual ‘checking file system on C:’ (file system is NTFS). Then it gives me a 10-second countdown to start the checking.

  “However, the check never starts. The countdown gets stuck on one second, but never begins the check (never being about one to two hours, which is how long I left it for). I forced shutdowns, rebooted, tried everything I can think of.

  “When I try to skip disk-checking by ‘pressing any button’ during the countdown, nothing happens and the countdown runs to one second and gets stuck again!”

Wow! That must be frustrating.

Windows’ chkdsk.exe is an odd tool. Crawling out of the primordial ooze that was early DOS, chkdsk could find and fix several types of errors that were all too common to disk structures based on the simple File Allocation Table (FAT) format.

As DOS evolved in the days of Windows 95 and later editions, chkdsk.exe was supplanted by the somewhat more-capable scandisk.exe. But when the NTFS (Windows NT’s “New Technology File System”) went fully mainstream in Windows 2000 and XP, an enhanced chkdsk retook center stage as Windows’ primary disk-repair tool. Chkdsk.exe remains a core element of Vista’s and Win7’s maintenance apps.

Chkdsk‘s default mode automatically finds and fixes simple disk errors, but you can activate several more-targeted and powerful repair modes via software switches — for example, command-line options such as

chkdsk D: /x /r

This command dismounts (deactivates) an NTFS-formatted D: drive; closes all open file handles to the drive to help prevent any software from interfering with the scan; fixes any errors found on the disk; and attempts to recover information from any bad sectors. This is far more than a plain-vanilla chkdsk command will do on its own.

Microsoft’s online XP Chkdsk documentation explains how it works, lists all seven available software switches, and provides information on how to use them.

That documentation is XP-specific, but chkdsk works essentially the same in Vista and Win7. You can find additional troubleshooting help in “CHKDSK not completing,” a Microsoft Vista Answers forum thread, and in “Chkdsk runs every time Window 7 boots” in a similar Windows 7 Answers post.

But despite the improvements, chkdsk is still not the ultimate disk repair tool. If it’s your bad luck to encounter one of those more-stubborn errors, I suggest you try a disk diagnostic/repair utility such as Seagate’s free “SeaTools” (download site), which can work on many non-Seagate drives, too. Use the DOS version of SeaTools, if you can, to avoid any interference from your Windows-based software.

Still no joy? A commercial tool, Gibson’s $90 Spinrite (site) is perhaps the most-powerful disk-repair utility available to the general public. If a damaged disk and its data are capable of being repaired or recovered by software alone, Spinrite probably can do it.

One of those approaches should surely get your disk error-free again!

(P.S. I sure hope you have a complete and current backup of all the disk’s contents, especially now that the drive is showing signs of trouble!)

Change the size of the C: drive partition

Julie Crego’s C: partition is overstuffed.

• “My C: drive is full and so my system gets bogged down. I’ve cleaned up everything, and because it has less than 15% of free space, I cannot even defrag. I bought a second hard drive, hoping to move the data from the current D: partition (on the same hard drive as C:) and then expand the C: partition to the full drive. I used to have software that did, it but it’s outdated. Any suggestions on what to use to remove the partition?”

You’re on the right track and almost there, Julie.

If you’re using Win7 or Vista, Windows provides everything you need to add, remove, and resize most partitions. See, for example, the nicely illustrated HowToGeek.com article, “Resize a partition for free in Windows 7 or Vista.”

XP’s built-in disk-management tool isn’t quite so advanced. It lets you create or delete partitions but won’t let you resize an existing one. For that, you’ll need a third-party tool. Fortunately, there are dozens available, many of them listed on this thefreecountry.com site. (For more information on XP’s built-in partitioning tool, see Microsoft’s Support article 309000.)

A larger C: drive is just a few clicks away, Julie!

Network ‘improvement’ tool ruins connections

Dean tried a tool that promised to improve his Win7 networking speed. Instead, it trashed his networking setup.

• “I recently purchased a new Dell Studio XPS 9000 computer with Windows 7 Ultimate. It worked fine when I received it, but I thought the network connection was a bit slow so I ran an Internet speed tester on it. At the completion of the speed test, I allowed it to change some of the networking settings to improve the speed. What it actually did was make the computer impossible to connect to the Internet after that.

  “Unfortunately, the saved default settings were lost and I was not able to restore the original settings to the computer. Although I back up religiously, I did not back up prior to this fix and my existing backup was very outdated.

  “Now, three months later, almost every download is still corrupt, especially if it is 10 MB in size or larger. Images are often corrupt as well.

  “I have tried download managers, but they often do not help in this situation. I have also tried resetting WinSock and TCP/IP settings (netsh.exe), to no avail. Since both the older computers work on my network, I do not believe my router or any other part of the network is failing — only my tweak to improve Windows 7 seems to be the problem.

  “Any help you could provide, Fred, would be greatly appreciated.”

First, let’s try to prevent other readers from having the same problem. Earlier versions of Windows (including XP) can sometimes benefit from a deep-geek tweak of their internal networking parameters. But Win7 and Vista automatically adjust themselves to network conditions. This means they usually can set themselves up as well — or better — than manual or third-party tools can.

In short, with Win7 or Vista, you usually don’t need (and shouldn’t use) third-party network-tweaking tools.

OK, now on to the repair. You may be able to reset Win7’s network settings by following the steps in Microsoft’s “Setting up a home network” article. The article looks pretty shallow at first glance, but there’s good info if you drill down through the article’s many links.

Windowsnetworking.com also offers a nicely detailed walk-through of the Win7 network setup process in their article, “Windows 7: Understanding network administration and configuration.”

If still-stronger medicine is called for, sometimes the best and most-effective fix for any seriously hosed hardware subsystem or device (networking, video, audio, and such) is to make Windows completely forget all about the current device and to treat it as if it were a brand-new, freshly installed piece of hardware.

It’s easy to do in all Windows versions. Under Control Panel/System, click on the Hardware tab. Next, open Device Manager, right-click the malfunctioning device, and select the Driver tab. Choose the Uninstall option and reboot. When Windows restarts, it will detect the device as new hardware and set it up from scratch. (See Figure 1.)

Figure 1. The Windows 7 Device Manager with one of the network cards selected and about to be uninstalled.

The specifics of accessing and using Device Manager vary a bit by Windows version. Here are links to the appropriate Microsoft instructions:

• Support article 283658, “How to manage devices in Windows XP”
• Windows Help & How-to page, “Open Device Manager” (Vista/Win7)

One of those approaches should do the trick for you, Dean!

More reader input on desktop icons that move

Here’s a nice tip from reader Peter Vincent:

• “Referencing the article, ‘Desktop icons move mysteriously on their own,’ in the May 20 issue:

  “Install a program like DesktopOK. It’s free and it works. It keeps track of settings for different resolutions.”

DesktopOK is available from SoftwareOK.com’s info/download page.

Nice find, Peter. Thanks!

Fred Langa is a senior editor of the Windows Secrets Newsletter. He was formerly editor of Byte Magazine (1987–91), editorial director of CMP Media (1991–97), and editor of the LangaList e-mail newsletter from its origin in 1997 until its merger with Windows Secrets in November 2006.

Rescue Windows with a bootable flash drive

By Lincoln Spector Using Windows system rescue CDs isn’t practical if your machine isn’t equipped with an optical drive. Fortunately, a clever solution may be sitting on your desk: take a flash drive you have at hand, add some software, and create a custom, USB-based, bootable Windows recovery toolkit!

Flash media offer speed and flexibility

That ultra-light netbook PC was great until some malicious code or innocent mistake hosed its operating system. A rescue CD could get it back up and running, but the tiny PC lacks an optical disk drive. Now what to do?

The one media connector found in all modern PCs is the USB port. If you don’t have an external CD/DVD drive sitting around (and most PC users don’t), one of the cheap and ubiquitous flash drives may be the best way to provide access to otherwise-inaccessible files and possibly fix the broken OS.

Even if you have an optical drive, booting off flash has considerable advantages over laser light. Flash media is faster and far more easily erased and rewritten, making it exceptionally flexible.

There’s just one catch: it’s more difficult to set up a Windows rescue system on flash drives than it is on optical media. You can’t simply double-click an .iso file and burn it onto the flash drive.

Most newer PCs can boot from USB storage devices such as flash drives. A look into your PC’s BIOS system menus should confirm whether you must change a setting so that your machine boots a flash drive. Look for two things: whether your system will boot from a flash drive, and the boot-order list. For the latter, make sure the flash drive is the first device.

A faithful Linux dog comes to the rescue

Unless Windows died right after a full-system backup, your first priority is recovering recently created or edited files. You need a way to boot the failed computer, get into your hard drive, and copy your precious data to external media.

Puppy Linux manages this chore faster and more easily than anything else I’ve seen. Ubuntu is a more-powerful version of Linux, but Puppy is the better choice for emergency-boot tools. It starts fast, runs fast, and is reasonably easy to use — especially if you know a lot about Windows but nothing about Linux.

Ironically, the common way to acquire Puppy Linux is to download its .iso file and burn it to an optical disc. To place it on a flash drive instead, start by going to the Pendrivelinux Universal USB Installer download page. Install the program and run it. Next, select the Linux Distribution pull-down menu and choose Puppy Linux (currently Lucid Puppy 5.0.1), as shown in Figure 1. Next, check Download the ISO (Optional). The rest of the installation is self-explanatory.

Figure 1. To put Puppy Linux on a flash drive, you need to use the Pendrivelinux Universal USB Installer.

It’s now time to plug your new rescue flash drive into the faulty PC and start it up with Puppy. Once you answer a few hardware questions, you’ll find yourself in a friendly GUI environment where you can now access your files and move them to a safer place.

If you’ve password-protected your data folders, don’t worry; Puppy will fetch them for you, anyway. However, if you encrypted them with Windows’ Encrypted File System, Puppy won’t be able to decrypt them (one of the many reasons I recommend against using EFS).

Pendrivelinux Universal USB Installer offers a lot more options than just Puppy. Consider devoting another flash drive to the Ultimate Boot Disc — a collection of free Linux and DOS utilities that can come in handy for all sorts of repairs.

Put a copy of Windows XP on a flash drive

BartPE is a special version of Windows XP that can be loaded from a CD. (PE stands for Preinstalled Environment.) With some extra steps, you can also load BartPE onto a flash drive and use it to boot your ailing PC.

BartPE isn’t a perfect environment. You can’t, for example, run a system restore or edit the Windows Registry — at least not the Registry on the PC’s hard drive. But it does let you run various diagnostic tools that come with Windows, as well as most Windows-based portable restoration apps. (See Figure 2.)

Figure 2. BartPE’s portable Windows environment lets you boot PCs with a broken Windows OS and run the diagnostic software of your choice.

Because Microsoft won’t let Bart Lagerweij, the creator of BartPE, give away Windows code, you must have a valid Windows XP (SP1 or greater) CD. And that, of course, means you’ll need a computer with a working CD drive to build the bootable flash drive.

You’ll find detailed instructions on creating a BartPE flash drive on the Robvdb PEBuilder information site. (You’ll also find a good selection of BartPE-compatible programs there.) Rather than repeat the instructions here, I’ll add two comments that will make the job easier:

• Insert your Windows XP disc into the drive at the beginning, and remove it when the job is done.
• When instructed to “Extract PEBuilder (pebuilder3110a.zip) into a location and folder of your choice,” create a folder directly off the root (C:) drive and give it a short, one-word name without spaces (such as C:PEBuilder).

Once you’ve created your flash-based boot drive, add the portable Windows repair utilities you need — Hijack This and Recuva, for example — onto it. You can’t do that with a CD.

Build the Windows 7 System Repair undisc

Windows 7 is the first Microsoft operating system since ME that allows you to create an emergency boot disc. It’s meant to be a CD, but you can turn it into a flash drive as well.

The Windows 7 System Repair disc has all the same repair tools found on the Win7 installation DVD. You can use it to test your RAM, repair boot problems, and turn back the clock via System Restore or Win7’s image backup tool. All the repair disc lacks is the files necessary for installing the operating system.

To create the flash recovery drive, you have to start with a Windows 7 machine with a working DVD drive. But once created, the flash drive can boot any optical-free PC.

The first step is to create a System Repair CD. Click the Start orb, type system repair, select Create a System Repair Disc, and follow the prompts. When it’s finished, boot from the CD just to make sure it works properly.

Next, restart your Win7 system normally and make sure the Repair CD is still in a drive. Plug in a 256MB or larger flash drive, click the Start orb, type diskpart, and press Enter. A black box will pop up that looks very much like DOS.

At the command prompt, type list disk for a list of all your physical drives — hard and flash, internal and external. Identify your flash drive; it’s probably Disk 1, but if you’re not sure, look in the size column. It will probably be in megabytes instead of gigabytes.

Enter the command select disk {n}, where {n} is the flash drive’s disk number. For instance, if it’s Disk 1, type select disk 1.

Back at the prompt, type the following commands, pressing the Enter key after each command. One of them (and you can probably guess which one) will involve a longish wait.

• clean
• create partition primary
• select partition 1
• active
• format fs=fat32
• active
• assign
• exit

Once the window closes, open Windows Explorer and set it up so that all of your files are visible. Select Organize, then Folder and search options. Click the View tab, select Show hidden files and folders, and uncheck Hide protected operating system files. (You can change these back later, and you probably should change back the second one.)

Now simply drag and drop all the files from the CD to the flash drive. This technique will work with any CD or DVD that boots into Windows 7 or Vista PE, including an actual Windows 7 installation DVD. (For that, you’ll need a larger flash drive — about 4GB will do.)

Whether on disc or flash, the right tools can make recovery from an unbootable PC — well, not easy, but at least a whole lot less difficult.

Lincoln Spector writes about computers, home theater, and film and maintains two blogs: Answer Line at PCWorld.com and Bayflicks.net.

New iPhone OS is not always an easy update

By Susan Bradley Apple usually has relatively pain-free updates, but the latest iPhone operating system, iOS4, is causing headaches. The phones most affected are those connecting to Microsoft Exchange servers, but those synching with Gmail also have problems.

MS Exchange ActiveSync hit by iPhone connections

While iPhone4 news reports have focused on the long lines at AT&T and Apple stores, iPhone users and ActiveSync admins are more concerned about synchronization problems. As a Microsoft Exchange Team blog notes, there’s a workaround patch to help iPhones using the new iOS4 operating system.

(The blog also noted that Google apps such as Gmail were affected because Google uses a portion of ActiveSync. But the Gmail problem now appears to be fixed.)

Problems aside, moving up to iOS4 is a long process. I’ve updated three phones, and each time it’s taken about 10 to 30 minutes to download the iOS4 upgrade, plus another 20 minutes to update the phone. (See Figure 1.)

Figure 1. Updating your iPhone to iOS4 is not a quick-and-easy process. It can take over 30 minutes, as the iTunes download status bar (circled in yellow) indicates.

WindowsSecrets reader Ken Haynes reports that updaters are seeing a significant drop in OS performance. However, I haven’t notice this slowdown, and I like the sorted e-mail and folder options that the new OS provides.

► What to do: Should your phone slow to a crawl after the update, you can roll it back to the prior operating system by following instructions on the Lifehacker blog, “How to downgrade your iPhone 3G[S] from iOS4 to iOS3.1.3.”

If you sync to Exchange and have already upgraded to iOS4, find out what your e-mail administrator prefers: should you leave your phone as is, roll back to the previous iPhone OS, or merely install the workaround patch for the time being?

Adobe updates come out ahead of schedule

Adobe has released Acrobat and Reader versions 9.3.3 ahead of the planned July 13 security release. This update completes the updates discussed in Adobe’s June 4 security bulletin.

Adobe Acrobat 8 is not vulnerable and does not need an update.

► What to do: There have been real attacks exploiting the security flaws in Acrobat and Reader, so update as soon as you can. If you’re running Adobe 9, you should already have received a prompt to accept version 9.3.3. If not, launch Adobe Acrobat or Reader and click on Help and Check for Updates.

Firefox gets a quick fix for a problem plug-in

Who knew that so many people play Farm Town on Facebook? There are reports of Firefox suddenly slowing down after the most-recent update — and the culprit is the Farm Town plug-in. Consequently, Mozilla released Firefox 3.6.6 as a fix.

► What to do: Farm Town may not be the only plug-in that degrades Firefox’s performance; install Firefox 3.6.6 (download page) as soon as you can.

Which version of .NET do you really need?

One of the common .NET questions I get is, “What is it?” The next question is, “Do I need it?”

The answer to the first question is easy: .NET is a platform developers use to build business applications and other solutions such as support and help apps. But explaining whether you need it is much harder.

I need .NET 1.1 on my Windows Small Business Server (SBS) 2003 boxes for the Remote Web Workplace application I use. I need .NET 2 for my Windows Software Update Servers. And I need .NET 2 for several versions of QuickBooks I have installed. Moreover, several computers I set up lately have OEM applications that use .NET such as HP Solution Center and HP Health Service.

But chances are, you don’t have anything that has been built on .NET4, the most-recent .NET to be offered up. So, I recommend you don’t install it until you have to — app vendors will bundle the update with their product when they release it.

► What to do: If you’re offered updates for .NET 1, 2 or 3, update it. But pass on .NET 4.

2254596
Microsoft Security Essential gets an update

In the near future, you may see an update for Microsoft Security Essentials (MSE). The upgrade failed — with a cryptic error code — the first time I tried it. (See Figure 2.) It directed me to reboot my computer, but instead I just waited a bit and tried installing the update again. That did the trick!

Figure 2. The most-recent update for Microsoft Security Essentials does not always install easily on the first try.

Other MSE users reported failed update installations on the Microsoft Security Essentials forum. Fortunately, several solutions were posted in the thread.

► What to do: You may have to first uninstall the earlier version of MSE and then install the update. In any case, get the upgrade as soon as it’s offered in order to keep your anti-malware signatures up-to-date. Or go to the MSE download page and get it immediately. Find more information in MS Support article 2254596.

The Patch Watch column reveals problems with patches for Windows and major Windows applications. Susan Bradley has been named an MVP (Most Valuable Professional) by Microsoft for her knowledge in the areas of Small Business Server and network security. She’s also a partner in a California CPA firm.