Comment by VxJasonxV | Hacker News Reader

Comment by VxJasonxV | Hacker News Reader

Hi everyone.

I registered bogusapple.com after a buddy of mine posted a screenshot of Little Snitch prompting iTunes' access to the domain. All credit for finding this snafu goes to gentmatt, and my bank account for allowing me the ability to frivolously buy a domain.

I don't believe that accessing this domain is built directly into the compiled code of apps, since (in my opinion) it did not happen close enough to a software update. I believe it is just some kind of a typo (bogus.apple.com?) for something used as part of the web page views that comprise the iTunes and the Mac App Store apps. I fully expect that this problem will quietly go away once they deploy new versions.

I picked up the domain just to see if any particularly exciting web requests were being made, and it's been fun to watch user agents, but as soon as Twitter, news sites, and forums got wind of it, it's pretty much impossible for me to discern any meaningful traffic anymore.

I suppose I could start filtering any requests with a referer, or ones not coming from *.apple.com. We'll see.

It's been a fun 13 hours.

Any questions?

Not a question but just a word of advice to be careful.

What you did could to a layperson be construed as intentionally exploiting a bug in their software with the result that you're now intercepting requests from unsuspecting customers of theirs, and getting data via your logs that in some countries falls under privacy laws.

Depending on how big of an embarrassment this turns out to be for them and how well funded their legal department is this might not turn out to be hassle-free for you.

That's a shame, since the first thing that occurred to me was thank goodness someone with nefarious intentions didn't buy the domain and attempt to pass it off as something Apple owned (and thereby users might trust).

He should get permission to host a bunch of #fakestevejobs content. (Parodic tribute stuff, of course.)

Well, it's not his fault Apple is sending traffic to the web site he owns.

If it is true that there is anything illegal with owning that domain and receiving traffic, then it is also true that a nefarious agent could "mistakenly" send a bunch of requests containing "private information" to the server of an enemy, then report the enemy's "illegal actions" to the authorities.

This is a great point, and it illustrates the absurdity of many other laws as well.

Right. If there's anything illegal going on here, it's Apple using its customers' computers to DDoS this guy's domain.

The main difference here is that he bought the domain after it was known Apple was sending requests to it.

But I do agree that any (hypothetical) legal ramifications would look bad for Apple.

This isn't how the law works. The law cares about intent.

In addition to user agents it would be useful to collect path strings and operations so if you're getting GET / or GET /something?option&option&option would be useful.

I did a quick scan (not very definitive) through the Xcode SDK and didn't see anything hard coded with this name but you never know.

Reminds me of this:

http://slashdot.org/story/99/12/25/114201/microsoft-hotmailp...

It looks like the details are here: http://www.doublewide.net/

How many hits have you got?

Legitimate ones? Hard to tell. Onlookers as a result of this coverage? Lots.

I don't really want to meaningfully count :).

On the Apple Community link, you state that you lack adequate logging of :443, could you not link bogusapple to localhost/dedicated server through the hosts file then boot up an Apache/whatever instance to log the access traffic?

I didn't want to pay for an SSL certificate that would pass SSL validation (read: not StartCom, not CACert, and I will never ever support GoDaddy). Domain registration fees aren't going to break the bank, SSL is another story. Not to mention the whole 'proving who I am' and other identity checks any worthwhile SSL agency employs.

Reply on news.ycombinator.com