6 ms·

Have we collectively forgotten about: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_pho

Have we collectively forgotten about: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot... ?

smoldesu 5y ago
> Apple claimed in a press release that access was gained via spear phishing attacks. Ah, because American celebrities spend so much of their time clicking through junk mail and seeing where it goes. Makes plenty of sense.
- yumaikas 5y ago
  Spear phishing, by design, is intended to not look like junk mail. Maybe it's designed to look like it came from an agent? Maybe like it was from someone they had hired to take care of their pets, or kids? If you're constantly busy (and it is my understanding that many celebrities are busy, at a bare minimum), and you don't want to think too hard about a particular thing, then a spear phishing attack could quite easily hit you, if your guard isn't up, and you don't consider technology to be a battelground.
  - smoldesu 5y ago
    Sounds like a security oversight on Apple's behalf then. iCloud should have 2FA enabled by default if it's so easy to trick the subconscious user into handing over credentials. Furthermore, it's already been confirmed that iCloud had multiple exploits allowing for brute-force and injection attacks[0] at the same time that the hacks happened, so it's definitely more feasible that an unpatched, full-disclosure exploit was abused instead of a couple hundred interns all clicking on the same spam email at the same time. [0] https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-attack-hacker-exploits-painfully-obvious-password-flaw-1481623 https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-a...
    - acdha 5y ago
      You might want to read up on the history: this is a key part of why Apple needed up the default experience because hectoring users about using strong passwords, not sharing them, etc. hasn’t worked. A lot of what we take for granted now was contentious at the time and it’s taken years to improve the balance in a user-friendly manner — and pointing out that they acted on problems years ago seems more like a positive than supporting whatever point you think you’re making.
- reaperducer 5y ago
  Considering the celebrities involved, I find this entirely likely. Heck, corporate CEOs get nailed by spearfishing. There was an article on HN just a couple of years ago showing that even many CIOs can't tell a real e-mail from a fake one.
  - acdha 5y ago
    Or CISOs, or analysts. Technically proficient users are _more_ likely to spot a problem but nobody is immune — it’s just a question of how much someone wants to spend targeting you.
- Retric 5y ago
  There isn’t a second set of technology used by American celebrities. Smartphones are used by just about everyone and email is part of that. Spearfishing looks like legitimate emails to most people which is why it works.
- pdimitar 5y ago
  Of all the good reasons to criticize Apple, you picked the most bogus one. Congratulations, that's an achievement. :D You severely overestimate celebrities' technical prowess -- and underestimate their naivete. They live in their own bubble of trust and laughs and fun and parties; and if somebody crafts a message that looks to be from their agent or a friend celebrity they absolutely WILL click on it and will give their data willingly. None of us has the entire picture of course, but after knowing a few local celebrities 10+ years ago, I can definitely believe they are that gullible so as to make a spear-phishing attack successful.
  - acdha 5y ago
    And, let’s be clear, this is true for almost everyone — even most HN commenters. Companies have spent years training people to expect email from bizarre domains, with random attachments or HTML links which point to gibberish tracking URLs, etc. Spam filters have gotten better but by far the best protection move has been widespread U2F/FIDO deployment.
  - smoldesu 5y ago
    It sounds like they're just like everyone else then: in which case, even more users were vulnerable, and Apple has even more incentive to secure their system. Is there anything I'm missing here?
    - pdimitar 5y ago
      Nothing, except for the fact that people hate managing passwords with a passion and take the risk for their accounts willingly (I've had the heated table discussions to prove it). For them it's all about the tradeoff between "how much energy must I invest?" and "how much do I care if I lose this account?". Most of the people I knew only enabled 2FA on their Gmail because they really couldn't afford to lose it. Everything else they were very meh about. They even had 000000 as their online banking PIN... <facepalm> Password managers only started gaining prominence after biometric authentication allowed you to access your passwords with your finger or face. So yeah, celebrities are users like all others -- if not slightly worse even. I am pretty sure every corp like Apple, Google, Facebook, Microsoft et. al. would love to enforce maximum security but they also have to be very careful not to alienate their users. One good example is Google who will pester you for 2FA and recovery codes but never truly force you; they prefer to ban your account for suspicious activity instead (happened to one guy I knew some 3-4 years ago because his drunk friends tried to breach his Gmail account from several different phones). So I get it, you don't like Apple, but as I have snarkily remarked above: it's for the wrong reasons. (I don't like them either but it's for completely other reasons.)
- procinct 5y ago
  Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out. There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. https://youtu.be/Z20XNp-luNA https://youtu.be/Z20XNp-luNA
danaris 5y ago
Forgotten about the time celebrities got their passwords compromised by social engineering attacks, something there's no reasonable way for Apple to prevent? No, but why on earth would it be relevant?
GeekyBear 5y ago
Have you forgotten that more Google accounts were phished than iCloud accounts in Celebgate? >According to court filings, Collins stole photos, videos and sometimes entire iPhone backups from at least 50 iCloud accounts and 72 Gmail accounts. https://www.washingtonpost.com/news/the-intersect/wp/2016/03/16/the-shockingly-simple-way-the-nude-photos-of-celebgate-were-stolen/ https://www.washingtonpost.com/news/the-intersect/wp/2016/03...
- flixic 5y ago
  I don't remember reading any articles about leaked Google accounts. Media is really distorting the reality when it covers every little misstep by Apple, and ignore much larger issues when it happens to other companies.
- OldGoodNewBad 5y ago
  You remembered the whataboutism! Pretty cool post.

Have we collectively forgotten about: https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_photos https://en.wikipedia.org/wiki/ICloud_leaks_of_celebrity_phot... ?

smoldesu 5y ago

> Apple claimed in a press release that access was gained via spear phishing attacks. Ah, because American celebrities spend so much of their time clicking through junk mail and seeing where it goes. Makes plenty of sense.

yumaikas 5y ago
Spear phishing, by design, is intended to not look like junk mail. Maybe it's designed to look like it came from an agent? Maybe like it was from someone they had hired to take care of their pets, or kids? If you're constantly busy (and it is my understanding that many celebrities are busy, at a bare minimum), and you don't want to think too hard about a particular thing, then a spear phishing attack could quite easily hit you, if your guard isn't up, and you don't consider technology to be a battelground.
- smoldesu 5y ago
  Sounds like a security oversight on Apple's behalf then. iCloud should have 2FA enabled by default if it's so easy to trick the subconscious user into handing over credentials. Furthermore, it's already been confirmed that iCloud had multiple exploits allowing for brute-force and injection attacks[0] at the same time that the hacks happened, so it's definitely more feasible that an unpatched, full-disclosure exploit was abused instead of a couple hundred interns all clicking on the same spam email at the same time. [0] https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-attack-hacker-exploits-painfully-obvious-password-flaw-1481623 https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-a...
  - acdha 5y ago
    You might want to read up on the history: this is a key part of why Apple needed up the default experience because hectoring users about using strong passwords, not sharing them, etc. hasn’t worked. A lot of what we take for granted now was contentious at the time and it’s taken years to improve the balance in a user-friendly manner — and pointing out that they acted on problems years ago seems more like a positive than supporting whatever point you think you’re making.
reaperducer 5y ago
Considering the celebrities involved, I find this entirely likely. Heck, corporate CEOs get nailed by spearfishing. There was an article on HN just a couple of years ago showing that even many CIOs can't tell a real e-mail from a fake one.
- acdha 5y ago
  Or CISOs, or analysts. Technically proficient users are _more_ likely to spot a problem but nobody is immune — it’s just a question of how much someone wants to spend targeting you.
Retric 5y ago
There isn’t a second set of technology used by American celebrities. Smartphones are used by just about everyone and email is part of that. Spearfishing looks like legitimate emails to most people which is why it works.
pdimitar 5y ago
Of all the good reasons to criticize Apple, you picked the most bogus one. Congratulations, that's an achievement. :D You severely overestimate celebrities' technical prowess -- and underestimate their naivete. They live in their own bubble of trust and laughs and fun and parties; and if somebody crafts a message that looks to be from their agent or a friend celebrity they absolutely WILL click on it and will give their data willingly. None of us has the entire picture of course, but after knowing a few local celebrities 10+ years ago, I can definitely believe they are that gullible so as to make a spear-phishing attack successful.
- acdha 5y ago
  And, let’s be clear, this is true for almost everyone — even most HN commenters. Companies have spent years training people to expect email from bizarre domains, with random attachments or HTML links which point to gibberish tracking URLs, etc. Spam filters have gotten better but by far the best protection move has been widespread U2F/FIDO deployment.
- smoldesu 5y ago
  It sounds like they're just like everyone else then: in which case, even more users were vulnerable, and Apple has even more incentive to secure their system. Is there anything I'm missing here?
  - pdimitar 5y ago
    Nothing, except for the fact that people hate managing passwords with a passion and take the risk for their accounts willingly (I've had the heated table discussions to prove it). For them it's all about the tradeoff between "how much energy must I invest?" and "how much do I care if I lose this account?". Most of the people I knew only enabled 2FA on their Gmail because they really couldn't afford to lose it. Everything else they were very meh about. They even had 000000 as their online banking PIN... <facepalm> Password managers only started gaining prominence after biometric authentication allowed you to access your passwords with your finger or face. So yeah, celebrities are users like all others -- if not slightly worse even. I am pretty sure every corp like Apple, Google, Facebook, Microsoft et. al. would love to enforce maximum security but they also have to be very careful not to alienate their users. One good example is Google who will pester you for 2FA and recovery codes but never truly force you; they prefer to ban your account for suspicious activity instead (happened to one guy I knew some 3-4 years ago because his drunk friends tried to breach his Gmail account from several different phones). So I get it, you don't like Apple, but as I have snarkily remarked above: it's for the wrong reasons. (I don't like them either but it's for completely other reasons.)
procinct 5y ago
Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out. There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. https://youtu.be/Z20XNp-luNA https://youtu.be/Z20XNp-luNA

danaris 5y ago

Forgotten about the time celebrities got their passwords compromised by social engineering attacks, something there's no reasonable way for Apple to prevent? No, but why on earth would it be relevant?

GeekyBear 5y ago

Have you forgotten that more Google accounts were phished than iCloud accounts in Celebgate? >According to court filings, Collins stole photos, videos and sometimes entire iPhone backups from at least 50 iCloud accounts and 72 Gmail accounts. https://www.washingtonpost.com/news/the-intersect/wp/2016/03/16/the-shockingly-simple-way-the-nude-photos-of-celebgate-were-stolen/ https://www.washingtonpost.com/news/the-intersect/wp/2016/03...

flixic 5y ago
I don't remember reading any articles about leaked Google accounts. Media is really distorting the reality when it covers every little misstep by Apple, and ignore much larger issues when it happens to other companies.
OldGoodNewBad 5y ago
You remembered the whataboutism! Pretty cool post.