1

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know.

The iTunes account is only for a very old iPad which has no iOS update anymore. I never bought any app or even entered the iTunes account username and password in the last two years. A few months ago I tried to buy an iPhone 6s Plus and did use this account to login browsers in computers, but those are computers at home with updated antivirus and Windows updates. Any clue, and what should I do for protection and cleanup?

15
  • I would make sure you choose a more secure password. I'm surprised at this though since generally you have to answer security questions to download music from a different device than is recognized. For Apple anyway.
    – RoraΖ
    Feb 12 '16 at 14:21
  • The stolen one was in-app purchase, so may be not security questions would be needed?
    – Annie
    Feb 12 '16 at 14:22
  • Possibly. If you have access to your account I would ensure that your security questions are up to date, and your password has been changed to something secure.
    – RoraΖ
    Feb 12 '16 at 14:30
  • How could this happen? My original password was pretty long already like 12 digits.
    – Annie
    Feb 12 '16 at 14:35
  • Did you use the same password somewhere else?
    – Philipp
    Feb 12 '16 at 14:48
2

You said that you are worried that your notebook might be infected in addition to worrying about your iTunes/Apple account being compromised. That, in combination with the fact that I always assume the worst will be the basis/context for my answer to you.

I always assume the worst as I stated so here is what I would do:

1) Wipe your notebook; if you suspect any kind of compromise or any kind of malicious infection at all then your safest bet is to wipe it and start over. Are there other options here such as trying different scans to try to "potentially" find the compromise? Sure. Could it take forever, and possibly not yield fruitful results? More than likely.

2) Change your iTunes/AppleID password right away. Create another string of randomly generated characters that include the usual: uppers, lowers, special characters, and numbers. May I suggest a password manager? If for nothing else, use the password manager to generate a random password as most of them have this capability built-in to them now.

3) Update your security questions on the account to completely different questions and answers than before.

4) Turn on Apple's two-factor authentication. This is purely OPTIONAL, however it's a great additional layer of security nonetheless.

5) Practice safe browsing and computing habits going forward. I know this is pretty broad and generalized, but the more you're aware of what sites and services you visit and use and their practices as well as their reputation while online, or even offline for that matter, the safer you'll stay in the long run.

These are just the general overview items. Please let me know if you'd like any more in-depth.

7
  • Thanks for your sharing. How do you personal protect your computers Brad? What do you use other thank keep point 5 in mind?
    – Annie
    Feb 12 '16 at 15:07
  • Things like using a virtual machine (VM) for online banking or other sensitive online activities that involve your PII or financial information, using multiple layers of antimalware defense like you already do (using Avast and Malwarebytes is a great start) but try adding to your layers by using EMET (if you run Windows which I assume you do), Secunia and Windows Firewall just to name a few for extra defense. Also, add some DNS/web filtering to your arsenal by using a company like OpenDNS on your home router/firewall. These are just a few suggestions, so make sure to do your own research. Feb 12 '16 at 15:52
  • Thanks for the suggestion. Should I use Orbit or Malwarebytes? Just Avast would not protect stuff like keylogging?
    – Annie
    Feb 12 '16 at 16:28
  • Avast and Malwarebytes would be my recommendation. They do two different (somewhat similar in some ways) types of scanning which is good because it allows for versatility. Feb 12 '16 at 17:17
  • Thanks but Malwarebytes free version doesn't provide free real time protection.....
    – Annie
    Feb 12 '16 at 21:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.