Feed on
Posts
Comments

Warning: This article may give information on how to obtain data stored in your Apple account. Also, I’ve no idea if the given information is still valid or if Apple has changed its method to cancel accounts.

Apple ID security riskBack in August 2011 I visited the Black Hat security conference in Vegas and decided to create a second Apple ID with an US prepaid credit card. With this account I was able to test iTunes Match, a service that was not available in Europe at this time.

Later back in Europe I decided to cancel this account as I no longer needed it and the amount of money charged on my prepaid credit card was expended anyway.

As there is no “click here to cancel your account” button, you have to contact Apple by mail. I have included the original mails at the end of this article. I got the response that the account has been canceled so I was fine with that.

To my surprise I received a mail from Apple that my contact email address has been successfully changed a few minutes later. What happened was that Apple didn’t really cancel my account, they just added “_canceled” to my email address:

user@domain.de became user_canceled@domain.de

This may work fine for most users, but I am the owner of the used mail domain and I receive any mail that is sent to this domain, regardless of what is in front of the @ sign.

Of course I tried to login with this new address. And after changing the password, which was possible using email, I was able to login and see all of my personal data. Two years later, I can even download purchased apps on my iDevices with this account.

I see a huge security risk here as anyone can create a free email address thats equal to an canceled Apple ID and add a “_canceled” to it. As your data is not deleted by Apple, its then visible to the new “owner”.

Here is the original conversation.

Dear Apple Support,

please delete my iTunes Account (including all information and iTunes Match data).

• My billing address for this account:

Mr. Kai Lippok
3570 Las Vegas Blvd.
Las Vegas, NV, 89109-8924
Phone.: 702 7317110

As well as one of the following:

• The last four digits of my credit card used for this iTunes Store account:

9845

Please confirm the deletion of this account. Thanks in advance,

Kai Lippok

Hello Kai,

Thanks for writing in today! My name is **** with the iTunes Store and I’ll be assisting you with your request. I see that you are wanting to cancel your account. I can imagine how anxious you must be to get this matter resolved so you can get this account cancelled.

Kai, I apologize in advance for the length of this email, but per policy, I am obligated to fully inform you of the effects of canceling an account. Please note that if your account is canceled you will no longer be able to redownload or upgrade Apps that you have purchased or authorize new computers to play content you have previously purchased. Although account cancellation is something I can help you with, I would like to offer some alternative resolutions for your issue. There are a couple of options that will allow you to retain full access to the items you purchased that have digital-rights management (DRM) while preventing your account from being used to make additional purchases.

1) You can remove your billing information from your account at any time so that it can’t be used to make purchases. By doing this, you retain the ability to authorize computers to play the items with DRM that you have purchased with the account and you will still have the account open in case you decide to use it later. Using this option also allows you to update and re-download applications that you have already purchased with your iTunes Store account. The instructions in this article can help you with removing the billing information while keeping the account open:

iTunes Store: Changing Account Information
http://support.apple.com/kb/HT1918

2) The iTunes Store can disable your account, which will prevent it from being used to make purchases. You will still be able to play the items you purchased with the account but you will not be able to re-download or update Apps that you have purchased.

Kai, it is also possible to cancel the account, but you may lose the ability to play the items with DRM that you already purchased from the iTunes Store. For example, if your computer is repaired, you may not be able to reauthorize the computer to play your DRM purchases after the repair. Also, you wouldn’t be able to authorize computers that were not already authorized before you canceled the account. If you purchased content on an iOS device and want to sync the content to a computer, but you have not yet authorized the computer for the account, you will not be able to sync the content to the unauthorized computer.

Additionally, you will be unable to re-download or update Apps that you have previously purchased. If you create a new account in the future you will not be able to play any of the DRM items purchased with the canceled account and you will not be able to re-download or update Apps without having to purchase the Apps again. You can’t reactivate the canceled account.

Kai, in addition, if your account name is also your Apple ID, then canceling the account will change the registration information for any product that you’ve registered with that Apple ID. This can make it difficult to sign in to other Apple websites that ask for an Apple ID and password.

You should not cancel the account if you want to be sure you can continue to use your iTunes Store purchases that have DRM as well as update and re-download already purchased applications. I recommend either removing your billing information or disabling the account as described above.

Note that if you have purchased any iTunes Plus content from the iTunes Store, or if you have upgraded any of your DRM purchases to iTunes Plus, canceling your iTunes Store account will not affect your ability to play the iTunes Plus items on existing, new, or repaired computers.

Kai, if you would like the iTunes Store to disable or cancel the account, please reply to this email specifying if you would like it disabled or canceled and include the following information. This is necessary for security purposes.

– The name of the account you are trying to cancel

– The billing address listed on the account

…as well as one of the following:

– the last four digits of the credit card used for your iTunes Store account
– or the order number of your most recent purchase
– or the name of any item you’ve purchased using this account

Upon receiving your response, Apple will verify your information, disable (or cancel) your account, and send you an email confirmation.

Kai, please be sure to let me know if you have any other questions or concerns. I’ll be more than happy to assist you with whatever you need. Thank you for being the most awesome part of Apple. Have a wonderful day.

Sincerely,

****
iTunes Store/Mac App Store Customer Support

Please Note: I work Thursday – Monday 8:30AM – 5:00PM EST

Thank you for allowing me the opportunity to assist you. You may receive an AppleCare survey email: any feedback you provide would be greatly appreciated.

Hi ****,

thanks for your answer. I would like my Account to be canceled.

• Account name:

****@****.de

• My billing address for this account:

Mr. Kai Lippok
3570 Las Vegas Blvd.
Las Vegas, NV, 89109-8924
Phone.: 702 7317110

• The last four digits of my credit card used for this iTunes Store account:

9845

Thanks,

Kai

Hello again Kai,

**** here again with the iTunes Store and I’ll be assisting you with your request again. I see that you have sent the information I requested. I can imagine how anxious you must be to get this matter resolved so you can get this account cancelled.

Kai, I was unable to cancel your account as the credit card number you provided did not match our records. Our records indicate that there is currently not a credit card on this account. If you could please provide one of the following:

– the order number of any authorized purchase
– the answer to the security question listed on the account

Kai, please be sure to let me know if you have any other questions or concerns. I’ll be more than happy to assist you with whatever you need. Thank you for being the most awesome part of Apple. Have a wonderful day.

Sincerely,

****
iTunes Store/Mac App Store Customer Support

Please Note: I work Thursday – Monday 8:30AM – 5:00PM EST

Thank you for allowing me the opportunity to assist you. You may receive an AppleCare survey email: any feedback you provide would be greatly appreciated.

Hi ****,

this is a order number: MGYK6L9G7H

Thanks,

Kai

Hello again Kai,

**** here again with the iTunes Store and I’ll be assisting you with your request again. I see that you have sent the rest of the information I have requested. I can imagine how anxious you must be to get this matter resolved so you can finally have this account cancelled.

Kai, thank you for providing the information I requested. At your request, the account “****@****.de” has been canceled.

You may sign up for a new account in the future, but even with the new account, you won’t be able to authorize additional computers to play any of your previous iTunes Store purchases that are protected by digital-rights management (DRM). Additionally, you will not be able to re-download or update apps that were previously purchased without purchasing the Apps again.

Kai, it’s possible that you also won’t be able to reauthorize a computer to play the DRM purchases if the computer is repaired. You will continue to be able to play any iTunes Plus purchases you may have made, however.

Thank you for taking the time to explore iTunes. I hope in the future you’ll decide to open another account and purchase from the iTunes Store once again.

Kai, please be sure to let me know if you have any other questions or concerns. I’ll be more than happy to assist you with whatever you need. Thank you for being the most awesome part of Apple. Have a wonderful day.

Sincerely,

****
iTunes Store/Mac App Store Customer Support

Please Note: I work Thursday – Monday 8:30AM – 5:00PM EST

Thank you for allowing me the opportunity to assist you. You may receive an AppleCare survey email: any feedback you provide would be greatly appreciated.

Follow-Up: 181506994

Hello again,

I wanted to send a quick note to see if you are still experiencing any difficulties with the iTunes Store. Resolving your issue is important to me, so please don’t hesitate to reply if you need any further assistance.

Sincerely,

****
iTunes Store/Mac App Store Customer Support

Please Note: I work Thursday – Monday 8:30AM – 5:00PM EST

Thank you for allowing me the opportunity to assist you. You may receive an AppleCare survey email: any feedback you provide would be greatly appreciated.

4 Responses to “Security risk with canceled Apple IDs?”

Leave a Reply