7 ms·

Where the Apple accounts that hackers are threatening to wipe came from

113 points by MandieD 10y ago

djrogers 10y ago
Great analysis Troy! It's good to see real data to back up the most likely (and least worrisome) scenario.
peterwwillis 10y ago
The standard hacker stereotype is of kids in basements, which the author seems to propose here, but most hackers who commit crimes are in their 20s-30s. (I have no direct evidence of this except the majority of public arrest/sentencing of cyber criminals, and generally people in the blackhat and organized crime scenes are not teens) The bravado thing is less a factor of being young, and more that a ton of cyber criminals have comically inflated egos.
- eridius 10y ago
  Most hackers would also recognize that demanding ransom from Apple in exchange for not wiping accounts isn't likely to be very effective and may have some negative consequences (e.g. being caught and getting beaten half to death by their victims). I have no trouble believing that the culprits here are likely to be pretty young.
  - ProblemFactory 10y ago
    The threat of wiping accounts was silly in the first place. The hackers have user passwords, not access to Apple infrastructure. So they log in as the users, delete files from iCloud... and Apple restores files from yesterday's backup. They could cause a lot of hassle for the users and Apple customer support, but not wipe accounts.
    - 0x0 10y ago
      Or they issue a "lost device - remote wipe" via find my iphone / find my mac. No restoring from that for mat: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking... It's a shame you can't have Find My Mac active without also allowing remote wipe. So I disabled Find My Mac for myself.
      - valuearb 10y ago
        Did you just link to a 5 year old story?
        yjftsjthsd-h 10y ago
        Has the situation changed?
  - peterwwillis 10y ago
    Most hackers don't commit crimes, because most of them aren't stupid. But some are. (I have known those stupid people, and they were in their 30s, did really stupid shit, and are now doing time) I would posit that most people engaged in cyber crime are not hackers, from the botnet owners who literally paid for and downloaded a tool with instructions, to the people who install skimmers, to carding merchants, people running protection rackets, email scammers, etc. A small number of people actually "hack" into a system using any form of advanced skill in order to do things like extract accounts like those in the article.
    - openasocket 10y ago
      > Most hackers don't commit crimes What definition of hacker are you using here? I know we're on Hacker News, but in the cybersecurity context hacker refers to someone who hacks into a system, which would mean hackers commit crimes by definition. EDIT: I pasted the wrong thing
      - peterwwillis 10y ago
        No, in a cybersecurity context a hacker is merely someone who knows about or is involved in security hacking. This includes, for example, researchers and government employees. It also means people who self identify as a hacker, and again, they usually don't commit crimes. The vast majority of DefCon attendees, for example, don't commit crimes, and then there's all the corporate shills at BlackHat.
- comex 10y ago
  > (I have no direct evidence of this except the majority of public arrest/sentencing of cyber criminals, and generally people in the blackhat and organized crime scenes are not teens) According to Wikipedia, the ages of the people arrested in connection with LulzSec were (sorted): 16 17 18 19 19 20 21 21 23 24 24 29. Plenty of teen representation there, and even low 20s is still pretty young. (Those ages are at the time of arrest, but most of the arrests were in 2011, the same year LulzSec was founded, so they would have been about the same age when they committed the crimes - albeit likely younger when they first got into the 'scene'.) Similarly, Lizard Squad: 16 17 17 22. (Main activities were in 2014; ages adjusted based on the number of years between then and the news articles specifying the ages.) Neither of those groups were terribly sophisticated (mainly performing DDoS attacks), but neither is the person(s) in the present case, who just culled passwords from old leaks and got the media to make a fuss. Anyway, getting arrested ≠ committing crimes. To get arrested, you have to (a) go after a high-profile target and (b) successfully attack them (where DDoS counts as an attack). Lots of kids do things like DoSing personal rivals (and their Minecraft servers), which is definitely a crime but unlikely to result in an arrest. The younger, the more petty...
  - astrodust 10y ago
    There's also an element here that should be studied in more detail: These are arrests, not participants. What if the older hackers are just better at not getting caught and it's the kids that make mistakes that get them busted?
    - openasocket 10y ago
      Yes and no. LulzSec and Lizard Squad belong to a very specific subset of hackers: people who hack big targets simply because they enjoy it. People in this group tend to be relatively unskilled, and less emotionally mature, hence skew younger. And they also are a lot more likely to end up in the news, and in people's imaginations. The majority of hackers in the modern day do what they do for financial gain. Among that group things are more even. But the skilled hackers, those that develop and use 0days, will skew older because it takes time and experience to reach that level.
janwillemb 10y ago
It took me some time to parse the title. Isn't the original - clickbaity - title better?
- nartz 10y ago
  Error: Still can't parse.
- glandium 10y ago
  The only difference between the titles is "Here's", which doesn't make much difference to make it more parseable. Took a while, but finally got it: "where the Apple accounts (hackers are threatening to wipe) came from" Interestingly, now that I parsed it, I can't see why it took so long. That said, "where the Apple accounts that hackers are threatening to wipe came from" would likely have been more obvious.
  - simonbarker87 10y ago
    Yeah, it definitely needs the "that" added in, took me a couple of minutes to work out what the title meant
- janwillemb 10y ago
  I can't edit my entry, but the title is better now.
nodesocket 10y ago
Password reuse is still a huge problem. Even my friends who are somewhat savvy (not professionally in tech) don't know what a password manager is or use one.
- Osiris 10y ago
  There have been lots of attempts to fix this problem. The latest one is the W3C Web Authentication draft spec. I hope we get to the point where authentication doesn't rely on the human memory at all.
- rhcom2 10y ago
  The response I get from even savvy tech people is like I just told them they really should be flossing more.
  - astrodust 10y ago
    It's like when a dentist tells you that it's ideal to brush three times a day after meals, plus once more in the evening.
    - mirimir 10y ago
      Sure, but then an honest dentist told me that what's most important is flossing and brushing before bed. So what's the analogous tl;dr for account management? Don't use passwords like "mysecretpassword", and don't reuse them?
      - literallycancer 10y ago
        "Use a password manager" is the tl;dr already.
        mirimir 10y ago
        Sure, but http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-leaking-passwords/ http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-... So maybe, "use a local password manager"?
jacquesm 10y ago
How come the twitter account of these assholes is still operational? Twitter should not allow their platform to be used by self professed criminals.
- CamperBob2 10y ago
  Ask any cop how much easier his job is since YouTube came along.
smaili 10y ago
According to the article, Football95 is the top password. Anyone happen to know why the reference to 95? I can't quite remember anything particularly special about that year to make it a common password for people.
- dragonwriter 10y ago
  IME, its not uncommon for people to include the two-digit form of their birth year in usernames or passwords.
- deleted 10y ago
  [deleted]
- bigtimeidiot 10y ago
  I thought the same thing. In fact, many of the top 10 passwords look odd to me: dthomas? disneyI (capital "I")? conrad76? I have a hard time believing these are legitimately the most common passwords. Compare that to a list like this: http://www.iflscience.com/technology/the-most-commonly-hacked-passwords-in-2016-were-painfully-obvious/ http://www.iflscience.com/technology/the-most-commonly-hacke....
  - draw_down 10y ago
    Yes, the top passwords being so specific is a key point in TFA.
  - r00fus 10y ago
    From that link - can someone explain this one to me? 20. 3rjs1la7qe Seems like a word but not sure which language. Only interesting password in the list.
    - CamelCaseName 10y ago
      Perhaps Arabic? My Arabic is very poor, so I cannot make out what it's saying. https://en.m.wikipedia.org/wiki/Arabic_chat_alphabet https://en.m.wikipedia.org/wiki/Arabic_chat_alphabet

113 points by MandieD 10y ago

Great analysis Troy! It's good to see real data to back up the most likely (and least worrisome) scenario.

The standard hacker stereotype is of kids in basements, which the author seems to propose here, but most hackers who commit crimes are in their 20s-30s. (I have no direct evidence of this except the majority of public arrest/sentencing of cyber criminals, and generally people in the blackhat and organized crime scenes are not teens) The bravado thing is less a factor of being young, and more that a ton of cyber criminals have comically inflated egos.

eridius 10y ago
Most hackers would also recognize that demanding ransom from Apple in exchange for not wiping accounts isn't likely to be very effective and may have some negative consequences (e.g. being caught and getting beaten half to death by their victims). I have no trouble believing that the culprits here are likely to be pretty young.
- ProblemFactory 10y ago
  The threat of wiping accounts was silly in the first place. The hackers have user passwords, not access to Apple infrastructure. So they log in as the users, delete files from iCloud... and Apple restores files from yesterday's backup. They could cause a lot of hassle for the users and Apple customer support, but not wipe accounts.
  - 0x0 10y ago
    Or they issue a "lost device - remote wipe" via find my iphone / find my mac. No restoring from that for mat: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking... It's a shame you can't have Find My Mac active without also allowing remote wipe. So I disabled Find My Mac for myself.
    - valuearb 10y ago
      Did you just link to a 5 year old story?
      - yjftsjthsd-h 10y ago
        Has the situation changed?
- peterwwillis 10y ago
  Most hackers don't commit crimes, because most of them aren't stupid. But some are. (I have known those stupid people, and they were in their 30s, did really stupid shit, and are now doing time) I would posit that most people engaged in cyber crime are not hackers, from the botnet owners who literally paid for and downloaded a tool with instructions, to the people who install skimmers, to carding merchants, people running protection rackets, email scammers, etc. A small number of people actually "hack" into a system using any form of advanced skill in order to do things like extract accounts like those in the article.
  - openasocket 10y ago
    > Most hackers don't commit crimes What definition of hacker are you using here? I know we're on Hacker News, but in the cybersecurity context hacker refers to someone who hacks into a system, which would mean hackers commit crimes by definition. EDIT: I pasted the wrong thing
    - peterwwillis 10y ago
      No, in a cybersecurity context a hacker is merely someone who knows about or is involved in security hacking. This includes, for example, researchers and government employees. It also means people who self identify as a hacker, and again, they usually don't commit crimes. The vast majority of DefCon attendees, for example, don't commit crimes, and then there's all the corporate shills at BlackHat.
comex 10y ago
> (I have no direct evidence of this except the majority of public arrest/sentencing of cyber criminals, and generally people in the blackhat and organized crime scenes are not teens) According to Wikipedia, the ages of the people arrested in connection with LulzSec were (sorted): 16 17 18 19 19 20 21 21 23 24 24 29. Plenty of teen representation there, and even low 20s is still pretty young. (Those ages are at the time of arrest, but most of the arrests were in 2011, the same year LulzSec was founded, so they would have been about the same age when they committed the crimes - albeit likely younger when they first got into the 'scene'.) Similarly, Lizard Squad: 16 17 17 22. (Main activities were in 2014; ages adjusted based on the number of years between then and the news articles specifying the ages.) Neither of those groups were terribly sophisticated (mainly performing DDoS attacks), but neither is the person(s) in the present case, who just culled passwords from old leaks and got the media to make a fuss. Anyway, getting arrested ≠ committing crimes. To get arrested, you have to (a) go after a high-profile target and (b) successfully attack them (where DDoS counts as an attack). Lots of kids do things like DoSing personal rivals (and their Minecraft servers), which is definitely a crime but unlikely to result in an arrest. The younger, the more petty...
- astrodust 10y ago
  There's also an element here that should be studied in more detail: These are arrests, not participants. What if the older hackers are just better at not getting caught and it's the kids that make mistakes that get them busted?
  - openasocket 10y ago
    Yes and no. LulzSec and Lizard Squad belong to a very specific subset of hackers: people who hack big targets simply because they enjoy it. People in this group tend to be relatively unskilled, and less emotionally mature, hence skew younger. And they also are a lot more likely to end up in the news, and in people's imaginations. The majority of hackers in the modern day do what they do for financial gain. Among that group things are more even. But the skilled hackers, those that develop and use 0days, will skew older because it takes time and experience to reach that level.

janwillemb 10y ago

It took me some time to parse the title. Isn't the original - clickbaity - title better?

nartz 10y ago
Error: Still can't parse.
glandium 10y ago
The only difference between the titles is "Here's", which doesn't make much difference to make it more parseable. Took a while, but finally got it: "where the Apple accounts (hackers are threatening to wipe) came from" Interestingly, now that I parsed it, I can't see why it took so long. That said, "where the Apple accounts that hackers are threatening to wipe came from" would likely have been more obvious.
- simonbarker87 10y ago
  Yeah, it definitely needs the "that" added in, took me a couple of minutes to work out what the title meant
janwillemb 10y ago
I can't edit my entry, but the title is better now.

nodesocket 10y ago

Password reuse is still a huge problem. Even my friends who are somewhat savvy (not professionally in tech) don't know what a password manager is or use one.

Osiris 10y ago
There have been lots of attempts to fix this problem. The latest one is the W3C Web Authentication draft spec. I hope we get to the point where authentication doesn't rely on the human memory at all.
rhcom2 10y ago
The response I get from even savvy tech people is like I just told them they really should be flossing more.
- astrodust 10y ago
  It's like when a dentist tells you that it's ideal to brush three times a day after meals, plus once more in the evening.
  - mirimir 10y ago
    Sure, but then an honest dentist told me that what's most important is flossing and brushing before bed. So what's the analogous tl;dr for account management? Don't use passwords like "mysecretpassword", and don't reuse them?
    - literallycancer 10y ago
      "Use a password manager" is the tl;dr already.
      - mirimir 10y ago
        Sure, but http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-leaking-passwords/ http://www.darknet.org.uk/2017/03/lastpass-chrome-extension-... So maybe, "use a local password manager"?

jacquesm 10y ago

How come the twitter account of these assholes is still operational? Twitter should not allow their platform to be used by self professed criminals.

CamperBob2 10y ago
Ask any cop how much easier his job is since YouTube came along.

smaili 10y ago

According to the article, Football95 is the top password. Anyone happen to know why the reference to 95? I can't quite remember anything particularly special about that year to make it a common password for people.

dragonwriter 10y ago
IME, its not uncommon for people to include the two-digit form of their birth year in usernames or passwords.
deleted 10y ago
[deleted]
bigtimeidiot 10y ago
I thought the same thing. In fact, many of the top 10 passwords look odd to me: dthomas? disneyI (capital "I")? conrad76? I have a hard time believing these are legitimately the most common passwords. Compare that to a list like this: http://www.iflscience.com/technology/the-most-commonly-hacked-passwords-in-2016-were-painfully-obvious/ http://www.iflscience.com/technology/the-most-commonly-hacke....
- draw_down 10y ago
  Yes, the top passwords being so specific is a key point in TFA.
- r00fus 10y ago
  From that link - can someone explain this one to me? 20. 3rjs1la7qe Seems like a word but not sure which language. Only interesting password in the list.
  - CamelCaseName 10y ago
    Perhaps Arabic? My Arabic is very poor, so I cannot make out what it's saying. https://en.m.wikipedia.org/wiki/Arabic_chat_alphabet https://en.m.wikipedia.org/wiki/Arabic_chat_alphabet