iTunes Connect Issue Logging Developers into Other Accounts

http://techcrunch.com/2015/01/29/itunes-connect-issue-logging-developers-into-other-accounts/

by sachalep • 11 years ago

66 16 11 years ago

fnayr• 11 years ago

Probably has to do with them trying to finally release the analytics they were supposed to release in Fall 2014.

mik3y• 11 years ago

Saw it firsthand, it was like account roulette for about 5-10 minutes. Then someone hit the big red button around 11:50a eastern.

Smells like something messed up in their session or caching layers..

charlesdm2• 11 years ago

That is one major (excuse my language) fuck up.

julien_c• 11 years ago

What were the security implications for an entity that has applications there?

Anything we should check or change as soon as iTunes Connect is back up?

Aqua_Geek• 11 years ago

Somebody mentioned that trying to perform actions on the apps would error out, so it seems more like an information leakage issue.

That being said, when it come back online I'm definitely going to go through all my apps.

xuki• 11 years ago

Check your users as well. Someone could have created an account.

charlesdm2• 11 years ago

The thought of someone creating a new user on your account like that is disturbing.

jobu• 11 years ago

Yeah, I wonder how many paid apps are now free.

k-mcgrady2• 11 years ago

It sounds like the only issue would be that you could potentially see unreleased apps. You couldn't access financial/payment records and couldn't access app details. You could just see the app dashboard. This is all according to reports I've read in the last hour or so.

crazycanuck• 11 years ago

You definitely could access app details. Not sure if you could change them - I didn't try - but here's the evidence: https://www.dropbox.com/s/qd0clsmx10h4tpd/Screenshot%202015-...

egads!

dham• 11 years ago

logged into another app. Then refreshed and got this.

'use strict'; define(function () { var itcApp = angular.module('itcApp', ['ngRoute', 'routeResolverServices', 'angularFileUpload', 'global_services', 'global_directives', 'global_filters', 'form_elements', 'ngCookies', 'angulartics', 'angulartics.adobe.analytics', 'ngSanitize', 'pasvaz.bindonce']); itcApp.config(['$routeProvider', 'routeResolverProvider', '$controllerProvider', '$compileProvider', '$filterProvider', '$provide', '$httpProvider', '$locationProvider', '$cookiesProvider', '$analyticsProvider', '$sceDelegateProvider', function ($routeProvider, routeResolverProvider, $controllerProvider, $compileProvider, $filterProvider, $provide, $httpProvider, $locationProvider, $cookiesProvider, $analyticsProvider, $sceDelegateProvider) { $routeProvider.when('/', { template: '<div></div>', controller: ['$window', function ($window) { $window.location.href = '/WebObjects/iTunesConnect.woa'; }] }).otherwise({ redirectTo: '/' }); }]); return itcApp; });

So they load all of Angular then redirect to another page?

stevebot• 11 years ago

god damn, and posting the images to twitter.

United857• 11 years ago

It's interesting to compare Apple and Google. Talent-wise, Apple has always been a "front-end" focused company, and they've now had several fiascos when they've started to get into "back-end"/cloud stuff (this, iCloud privacy leak, etc...)

In contrast, similarly Google had been a "back-end" focused company, and their first few versions of Android were horrible and clunky compared to iOS (but they've improved a lot).

eknkc• 11 years ago

It's such a bad fuck up that it would justify someone pulling power cables from all iTunes Connect servers to disable access.

crgt• 11 years ago

It's back up but it's still broken. When I log in with account X, I see the apps associated with account X. Within My Apps, and within Payments, I see the apps associated with account X. BUT. When I tap Sales & Trends, I see data for account Y. It's also one of mine, but it's associated with completely different Apple IDs and user names. I am able to navigate back and forth through the different sections of iTC and get a bizzaro merger of the two accounts. The Sales & Trends sections seems to be powered by https://reportingitc2.apple.com/? and that's when I end up on an incorrect account. Scary.

iTunes Connect Issue Logging Developers into Other Accounts

Related Stories