How a respected security researcher stole millions from Apple

AppleInsider

A security researcher was thanked by Apple in OS patch notes just days after being indicted in a scheme that allowed him to steal millions of dollars worth of Apple products, gift cards, and services.

Noah Roskin-Frazee, a security researcher affiliated with ZeroClicks Lab, has been praised by Apple for identifying software vulnerabilities. However, he has recently come under scrutiny for exploiting a vulnerability that enabled him to steal a whopping $2.5 million worth of iPhones, Macs, and gift cards.

According to 404Media, Roskin-Frazee found a vulnerability in Toolbox, a backend system that Apple uses to place orders on hold. While on hold, orders can still be edited.

He, along alleged co-conspirator Keith Latteri, used a password reset tool to gain access to an employee account of a third-party company that helped Apple with customer support. Once they accessed the employee credentials, they accessed Apple's systems and placed fraudulent orders for Apple products.

The pair started the scheme in December 2018 and continued until at least March 2019.

The two would create and manipulate orders, adding products like iPhones and Macs and changing the cost to zero. They also would order gift cards that could be used in Apple stores or resold.

While they used false names and drop shipping addresses for the physical products, one extended AppleCare for two years for himself and his family.

Apple thanks Roskin-Frazee

Perhaps one of the most interesting things to come out of the story is that two weeks after Roskin-Frazee was arrested, Apple thanked him publicly on its website.

There's big business in software vulnerabilities -- both in finding them and exploiting them.

Jamf Threat Labs recently worked out a proof-of-concept post-exploitation tampering technique that makes an iPhone behave like it is in Lockdown Mode when it isn't.

Even the Apple Vision Pro isn't safe. A day before its release, a security researcher claimed to create a kernel exploit for visionOS, opening the way towards a potential jailbreak and malware creation.



Read on AppleInsider

NuclearDave

Yep, thanks for stealing 2.5 million from us....I guess Apple can afford the hit if it makes their security a bit tighter?

ihatescreennames

I’d love to know how they were caught. Makes me wonder if it was greed that did them in. If they had kept the orders to 1 each per year, maybe ordering 1 each of all the newly release products, would anyone have noticed?

pulseimages

I can only read the story if I select the comments otherwise all I see are these symbols: />

Andy.Hardwake

pulseimages said:

I can only read the story if I select the comments otherwise all I see are these symbols: />

Same here, iPhone XS iOS 17.3.

tenthousandthings

ihatescreennames said:

I’d love to know how they were caught. Makes me wonder if it was greed that did them in. If they had kept the orders to 1 each per year, maybe ordering 1 each of all the newly release products, would anyone have noticed?

The article suggests they were identified when one of them used the scheme to extend AppleCare for himself and his family.