Spammers inundate Apple's new social media service Ping

Share this article:
Spammers reacted quickly to Apple's new social media service Ping, with reports of users being bombarded with junk messages.

Ping became available with Wednesday's iTunes 10 update, which also includes fixes for 13 flaws. The new service allows users to create a profile and “follow” friends or artists and share status updates, photos, album reviews and information about music purchases.

Sensing the popularity of the new service, criminals already have pounced. The problem for users is that Apple appears to not have implemented any spam or URL filtering protection in Ping, Chet Wisniewski, senior security adviser at Sophos, told SCMagazineUS.com on Friday.

Less than 24 hours after it launched, Ping was inundated by spam. The profiles for U2, Lady Gaga, Justin Bieber, Linkin Park have all been affected by the comment spam.

“Lady Gaga's profile is so clogged with spam that's about all that's in it,” Wisniewski said. “Any time you allow people to post a message, you are going to have spam problems. It's amusing to me that Apple would launch such a major service without considering that.”

Many of the spammed comments seen on Ping attempt to trick users into filling out affiliate marketing surveys with the lure of receiving a free iPhone 4 or other prize for their efforts, he said.

Another problem that could contribute to spam on Ping is the ease of creating a profile, Wisniewski said. The service does not require users to enter a credit card or other identification to participate.

Security experts have for some time warned that spammers aren't just distributing their unwanted messages via email anymore, he added. The comments sections on blogs and forums, as well as Facebook, Twitter and Web 2.0 platforms, are also a haven for spammers.

Apple likely anticipated its new platform would be abused, as it requires user's profile pictures be approved before they appear, Wisniewski said. Apple is likely also filtering for offensive content, so the company probably has a way to stop the spam.

An Apple spokesperson did not respond to a request for comment.

Despite Ping's security issues, researchers recommend users download the iTunes 10 update, as it also closes 13 security holes in WebKit, an engine that is used to render the iTunes interface. The vulnerabilities may allow an attacker to execute arbitrary code or cause a denial-of-service condition, according to an advisory posted by the US-CERT on Friday.

When users download the update, Ping is not enabled by default.

Share this article:
close

Next Article in News

Sign up to our newsletters

More in News

Cyber Command tests gov't collaboration in wake of attacks

The two-week exercise, "Cyber Guard 14-1," was completed this month.

Text message spammer settles charges filed by FTC

Text message spammer settles charges filed by FTC

Rishab Verma and his company agreed to settle charges filed by the FTC that Verma sent millions of spam text messages that deceitfully promised free merchandise.

Rhode Island hospital to pay $150K for past data breach

More than 12,000 patients' personal and health information was compromised in a breach at The Women & Infants Hospital of Rhode Island.