iTunes Gift-Card Algorithm Hacked

According to a spate of recent reports, iTunes gift cards are selling for a song on Chinese Web sites, with $200 cards retailing for as little as $2.60. The illegal bargains are apparently the work of Chinese hackers who have successfully penetrated the iTunes gift-card system.

The card sharks were first reported by Outdustry, a music-industry consultancy that follows developments in China and other emerging markets. The biggest outlet for illegal cards is Taobao, a consumer-to-consumer shopping site that at any given time has thousands of iTunes cards for sale.

Stolen Vouchers

According to Outdustry’s report, no physical cards actually change hands. Instead, hackers use key generators to create gift-voucher codes. Once payment is sent through the Taobao site, a seller uses the built-in IM system to transmit the voucher code. Once the purchaser enters the voucher code in his or her iTunes Store account, the face value of the code is credited to the account and can be used to purchase iTunes products.

The practice is, of course, illegal, and anyone who uses a hacker-generated gift code runs the risk of not only finding the credit wiped out, but potentially more serious consequences ranging from the shutdown of their iTunes account (for violation of terms of service) to prosecution for theft.

In the interim, Michael Gartenberg, vice president of Interpret, says Apple will take steps to cut off the flow of fake vouchers.

“Look,” Gartenberg said, “it’s generally true that anything that can be hacked will be hacked. But there’s plenty that Apple can do to protect the value of its iTunes content. The first thing will be to change or reconfigure the algorithm so that the hacker key generator no longer works.”

Gartenberg said that while the hack is undoubtedly annoying to Apple, in the longer run it’s little more than an interesting blip…

Source