Apple store fake app stole man's life savings in Bitcoin
washingtonpost.com
washingtonpost.com
I personally used "The Great Suspender" for years until it was bought out and the rug was pulled out from under me.
I do think Apple's requirements are higher than Android for publishing apps, but I would not risk that much money on a mobile device ecosystem. If you're transferring $600,000 worth of BTC, purchase a one-time use laptop and use wallet.trezor.io as your web wallet. This laptop should only be used for this workload and kept offline / powered off otherwise.
The transaction is set up on the web wallet, the hardware wallet shows you the details on it's own screen, and you can sign on the hardware wallet.
They are pissed off about GPU prices being high and all the crime and the environmental impact Bitcoin causes they can get together to undermine the network. If gamers started a mining pool not for profit but to take down the network I can see it happening. First start mining with smaller cryptocurrencies, the money goes to encrypted wallets that no one controls then start posting fake transactions with that money to clog up the network.
As publicity gets more people to join the project, they can then start performing 51% attacks to further undermine the network. At some point that crypto will be worthless and they can move on to a bigger one then just repeat until they get up to bitcoin. But as the mainstream media picks up the story I don't think they would even need to get to Bitcoin as everything will collapses.
Conclusion: Better Environment, Less Financial Fraud, LOWER GPU prices. Someone start the project and call it "Gamers VS Crypto" or something like that.
https://www.theverge.com/2021/4/21/22385859/apple-app-store-...
In fact YOU (well, I mean Apple) cannot have it both (other) ways. It's not fair to arbitrarily remove legitimate apps, lock down the devices, under the guise of user safety but in the end fail to actually provide the level of security at all that people now expect and paid the price of the device not being GP.
If Apple is so sure of their measures they should also cover (i.e. pay up) any damages when fraudulent or dangerous apps do make it to the store or are not removed in a timely fashion. The fees they siphon off from app revenue should probably go there.
The argument is rather that the AppStore is not secure at all, but a) we still cannot sideload apps and b) legitimate apps get kicked off for no good reason, etc.
The problem is false security and false expectations.
Arguably it's easier for a user today to accidentally download a scammy app from the app store than it would ever be to do when sideloading. The latter would always come with the expectation and warning that it's not vetted by anyone, so the user and/or community will invest the time to make sure the download is legitimate.
Negligence and simply the size of the Appstore is more likely at play.
Two systems for two different use cases.
https://ec.europa.eu/info/business-economy-euro/banking-and-...
We are not speaking about hacking here, simply about banks failing. Bank which failed, it happened 10 years ago, who knows when the next crash is happening...
> Bank which failed, it happened 10 years ago
For what it's worth, governments have gotten progressively better at regulating banks in a way to make such failures increasingly unlikely. We have a similar system in Canada, with protection capped at 100k CAD. The last time they had to pay out was 1996. Failures were frequent in 80s and 90s, and then they just stopped. Not by miracle, but by regulation. The government had learned how to avoid failure instead of allowing it to happen and reimbursing the stakeholders.
https://www.cdic.ca/about-us/our-history/history-of-failures...
1. A fraudster obtains your credentials and steals money from your bank account: The bank reverses the entire transaction and makes you whole. You get your whole money back, no matter the amount.
2. The bank goes out of business: Worst case scenario, the bank has no assets, the government reimburses you up to 100k CAD/100k EUR/250k USD depending on the country the bank is located in. A lot of times, bankruptcies are due to liquidity issues, not insolvency, so you would get back most of your money, even above the caps here, eventually. Also, because the government is not just the insurer, but also the regulator, it has gotten much better at avoiding bankruptcy and this does not happen often these days (at least in Canada).
I am not sure what failure mode you are concerned about: one where fraudsters steal so much money that the bank goes under, like tens or hundreds of billions of dollars? And the transactions are somehow irreversible?
To a first approximation, they are impervious to theft (registered to me personally and accessible via treasurydirect.gov) and devaluation (indexed to grow with inflation).
Indexed to grow with CPI, which is a wild guess[1] since 1980.
[1]: http://www.shadowstats.com/alternate_data/inflation-charts
But also, this is hilarious nitpicking from fans of digital "currency" that can't be used to buy anything or even moved for less than a 20 dollar transaction fee. [0]
I'll put treasury bonds up against bitcoin as a stable store of value all day. How much are you up? Getting nervous to sell, or gonna HODL strong?
[0] https://ycharts.com/indicators/bitcoin_average_transaction_f...
Any new technology has (incorrect) underlying old assumptions, so there are always people utilizing them and abusing them.
In 1981 if you were talking to a girl you never met on the phone, then chances are she was actually a girl. In 2001 if you were talking to a 'girl' online in text, then chances are you are being catfished on the internet.
In 2021, if you are just doing video and audio verification in a similar situation, chances are you are being catfished by Machine Learning [1].
Technology scams (as opposed to Social engineering scams) are an indication of how radically different new technology is from the assumptions people have about it (for instance, all the old ladies who are being still scammed by Indian call centers out of their life savings).
1. https://www.news18.com/news/buzz/japanese-influencer-posing-...
People who say bitcoin can never work because people fall for scams don't understand what the technology can do and don't understand where the technology is going. All of these problems are very solvable.
If I etransfer (Canada) someone money and that person up and disappears I am out that money, a bank will do absolutely nothing. You can file a police report but those chances are also basically zero.
Same with cash, if I give someone cash or take cash out and don't store it properly I lose the whole thing.
There isn't really an undo process except credit cards.
What cryptocurrency can do is separate the owner of the value (the individual) from the provider of the security (the custodian).
In theory you can have an account where both you and your bank must sign a transaction to move funds. This adds an additional layer of security. The bank can't steal your funds without your digital signature and you can't do something stupid without the bank's approval.
It hasn't happened yet in a meaningful way. But it is possible.
This is basically the model of Casa, except they're never custodian because they only hold 1-of-N signing keys, where N is 3 or 5, and creating a transaction requires a quorum.
The advantage is some redundancy in your signing device setup, and also protection against theft by geographically distributing your keys, while still maintaining sovereignty of your funds. It also allows them to assist you in recovering access to your funds if one of your own signing keys is lost, but they never have the ability to move your funds on their own.
The tradeoff compared with maintaining your own multisig setup is a reduction in privacy, since they can see your transaction history. This is still far more preferable than letting a custodian hold "your money" for you. I believe it's the best model for the vast majority of the public to hold Bitcoin.
They also push a "seedless" model to prevent the exact attack described in the article. Nothing prevents the user from keeping backups of one (or more) of your seed phrases, it's merely a suggestion.
disclosure: I used to work at Casa and hold a tiny bit of equity, and I continue to be a satisfied customer
All crypto needs is a insurance program that offers protection and guarantees your money.
It will take time but it's inevitable at some point with banks and large companies signing up.
So did the scammers automate this then? Scraped the login details and then automatically logged into the real platform and transferred the BTC out?
What about 2FA? How did the scammers get around that?
Also, the article mentioned you can change your app after you submitted it to the Appstore without requiring another approval? i.e. did they change the logo without Apple noticing?
I'm sure the fake app asked him to export the keys and he just did it without realizing they could just grab the money.
I've never used a trezor before so I had to look it up:
When considering the security in entering our passwords, in Trezor wallets, the password is entered via the keyboard of the connected device, making it vulnerable for attackers to read it.
However, in Ledger wallets, the password is linked to another PIN which is entered using the normal keys.
"The app was a fake, designed to trick people into thinking it was a legitimate app."
Same app, different user:
"He wanted to make sure his investment was secure, so he purchased a Trezor Model T hardware wallet and downloaded an app on his iPhone called Trezor, which asked for his seed phrase. The app didn’t connect to his Trezor wallet, and he figured it didn’t work."
NEVER TYPE A SEED PHRASE INTO AN ONLINE DEVICE. That is never required during normal operation of any hardware wallet, that's the whole point of using one.
The whole point of a hardware wallet is to keep the credentials (private keys / seed phrase) locked up in there, and be safe from any malicious wallet app.
Entering his credentials in the app destroyed the security of his hardware wallet.
https://www.theverge.com/2021/4/21/22385859/apple-app-store-...
He made a bundle in the cryptocurrency game whose #1 rule is "no rules", and then got beat.
Another nail in Bitcoin's coffin.
This kind of trick, however, would have fooled most people since you’d expect Apple’s devices and store to be safe (relatively to everything else)
This is why many people, especially those who are older, prefer avoiding cryptocurrency as an investment, as it has a lot of complex functions and a learning curve to set up one.
Apple deliberately degrades the performance and functionality of web apps in the sole browser allowed on the IOS platform (Safari, all other browsers are a wrapper around it), slow walk and introduce bugs into standards such as WebRTC, and make it very difficult to install apps as a PWA in order to funnel everyone (50% of phone users in the U.S.) into the App Store, and ban all other app installation methods.
And, when they introduce new features like privacy nutrition labels, it's always so that they can force even more users into their walled garden, and strengthen proprietary apps like iMessage, and build up their ads business. It's like "nobody but us", where "us" is Apple.
So, yes, if they are holding out that all of this app review process is to benefit and protect the users, and the users get scammed because their app review process is apparently incapable of catching these obviously scam apps, then Apple should make the users whole.
0. Apple says its App Store is ‘a safe and trusted place.’ https://www.washingtonpost.com/technology/2019/11/22/apple-s...
If Apple was somehow deemed responsible for policing crypto-scams, the only rational thing to do would be to ban Crypto apps.
Agreed. Actually, they could probably jack it up to 90% if not for the inevitable lawsuits from state Attorneys General..
> If Apple was somehow deemed responsible for policing crypto-scams, the only rational thing to do would be to ban Crypto apps.
This might be true if the only scam apps were crypto related.
Apple's quest for control over the apps translates to a quest for increased control over their users;
Just as with Google's ability to control search results, when Apple can control how you work, which apps you can install, and even what you say in those apps, they ultimately control how and what you think.
That's a pretty powerful position for two of the most powerful companies in the world. It becomes self-perpetuating and people will automatically suppress any evidence that their opinions are being shaped.
[1] https://www.theverge.com/2021/4/21/22385859/apple-app-store-...