Over at Macworld, Lex Friedman does an excellent job running down the strange story of a Russian hacker who figured out how to trick iOS such that users could make some in-app purchases for free. Apple should be able to fix the problem, but it’s an interesting example of the classic “man in the middle” attack because, in this case, the man in the middle is the user, rather than some bad guy.

Security firm Kaspersky is reporting that a Trojan horse application called “Find and Call” somehow made it past Apple’s App Store approval process and was downloaded by a number of users before Apple woke up and pulled it. A similar piece of malware was also posted to — and pulled from — Google Play’s Android marketplace. Needless to say, if you downloaded this app but haven’t tried it yet, delete it immediately, before it can steal your contacts and spam them with SMS text messages. Clearly, Apple’s approval team blew it here, but at least they were able to pull the app fairly quickly. Whether the company will go further in removing the app from devices remains to be seen.

In an MIT Technology Review article reprinted on Mashable, David Talbot covers the emerging privacy concerns surrounding Apple’s storage of questions addressed to Siri. Apple says that the recordings are used only for Siri’s operation and to help improve understanding and recognition, but privacy wonks worry that the voiceprints could be used to identify the speakers. Where should the privacy line be drawn between providing services that require storage of personal information and worrying about Big Brother?

Bob Boilen, host of NPR’s All Songs Considered, writes that he has deleted 25,000 songs from his iTunes library, reclaiming 200 GB. Instead, he’ll be relying on iTunes Match. Let’s hope he kept a backup or two, just in case.

Security is one of those topics you wish would just disappear — because then no one would need to think about it. But until that happens, we’ll end up trying to explain just what’s going on and how you can protect yourself, as happens in this discussion Adam has with Tech Night Owl host Gene Steinberg.

We frequently harp on not only keeping data backups, but also on ensuring that your backups are good. (That’s why Adam Engst has designated every Friday the 13th as International Verify Your Backups Day.) It’s inconvenient to lose some recent files or email messages, but a good backup policy is even more essential for larger projects — like an entire movie. Two people involved explain how Pixar nearly lost a year’s worth of work on the movie “Toy Story 2” after someone accidentally entered rm * (the Unix command to delete all files) and the company discovered their backup had been compromised. The film’s salvation came from an unexpected source.