8 ms·

Man steals 620k photos from iCloud accounts from home without Apple noticing

237 points by radicaldreamer 5y ago

hamburgerwah 5y ago
I am no fan of apple but this man used phishing attacks to gain access to just 306 icloud accounts. That hardly seams a significant failing on apples part. He used the credentials of the victims so I'm not really clear how rate limiting should have played a role, you should be limited from accessing your own account?
- SilverRed 5y ago
  Apple has made leaps and bounds on security including having 2FA mandatory but none of it matters when the user is convinced they are speaking to someone from apple who is telling them to read out the 2FA code and provide their details. No warning in the world will help because the attacker will just say "Ok thats ok, that warning is just for untrusted people. Since I am an Apple employee, it is perfectly safe". These victims already trust the attacker so they will just do anything asked. I think the only solution here is to just block all logins outside of the users own country and to have local law enforcement crack down hard on any in country criminals. Apple can use the find my location to work out if any of the users devices are at or have been at a certain location. I can't imagine many situations where you leave all of your devices at home, leave the country and then try to log in.
- noptd 5y ago
  New device logins across 300+ accounts from the same IP in such a short time frame should raise a few red flags.
  - Tagbert 5y ago
    Was it really in a short time frame? It sounds like he was choosing some targets based on requests from other people. This sounds like he was doing this over quite a long time.
lph 5y ago
> 4,700 with iCloud user IDs and passwords How does this amount to only four felonies?! Our system is so abysmally bad at understanding crimes of scale, especially when they happen over the internet. If he burgled 4,700 houses, it would be a lot more than four felonies.
- IAmEveryone 5y ago
  That's because it's a lot scarier to meet someone in your apartment when you don't expect them than having you photos leaked. (With the latter, strictly speaking, being a subset of the former anyway)
masterof0 5y ago
Shouldn't it be "El Puente"?
vxNsr 5y ago
He used gmail addresses. Just goes to show how little ppl pay attention to the email address.
stereoradonc 5y ago
It was a missed opportunity to educate users about 2FA. All Apple's services offer the 2FA and it should be mandatory- it will take some time before users get used to it.
SevenSigs 5y ago
Apple + Privacy = 0
neonate 5y ago
https://archive.is/g854S https://archive.is/g854S
hk1337 5y ago
Any of the photos match to the CSAM database?
radicaldreamer 5y ago
I posted this link and I named it the way I did to draw attention to this in context of CSAM enforcement... this man could have easily uploaded any photos to these hacked iCloud accounts, which would've been synced down to end user devices. Apple didn't catch on to this, despite him not using VPN or Tor... it wasn't until the FBI investigated a public figure's hacked and posted photos that this came to light. [EDIT]: Not the FBI, but a private company noticed this (h/t codeecan)
- codeecan 5y ago
  Scary indeed, slight correction, not the FBI [initially]; > A California company that specializes in removing celebrity photos from the internet notified an unnamed public figure ... He was caught by random chance of this company.
  - not2b 5y ago
    If he was specifically going after famous women's accounts, I don't think it was so random, given that he went after hundreds of people and didn't cover his tracks at all. He was after celebrity photos, he was sloppy, people who try to defend against such attacks were going to catch him.
    - radicaldreamer 5y ago
      We've seen more decentralized and sophisticated attacks of the same type against iCloud ("the fappening" etc.) which were kept mostly private for years before being made public. The fact that those hacks quickly were flushed from the news cycle without a bunch of public lawsuits etc. makes me suspect Apple very proactively went out and made settlements with the more high profile victims of those hacks. Of course, I have no proof of this at all, so it's purely speculation, but it was odd to see almost nothing come out of those hacks.
      - threeseed 5y ago
        > without a bunch of public lawsuits Apple is not at fault here though. These people have clicked on a phishing email no different to a banking or retail one.
codeecan 5y ago
> he impersonated Apple customer support staff in emails that tricked unsuspecting victims into providing him with their Apple IDs and passwords > He gained unauthorized access to photos and videos of at least 306 victims across the nation > Investigators soon discovered that a log-in to the victim’s iCloud account had come from an internet address at Chi’s house Not very sophisticated, but very effective, glad they shut him down but we really need to teach basic internet security in schools.
- eli 5y ago
  This is a failure of the software community, not the users. I don’t think it’s reasonable to ask users to detect a halfway decent phishing attempt.
- SevenSigs 5y ago
  > but we really need to teach basic internet security in schools. I think you need to do that for people that are no longer in school... because most young people probably know not to give out their passwords
- glitcher 5y ago
  I agree that better education around Internet security is needed, especially for basic phishing attacks like this. OTOH, I believe Apple could be doing more to deter and/or detect this type of broad access, especially with the lack of sophistication behind this scheme! I feel like even Netflix does a better job at alerting me to access from a new device, and they aren't storing any of my personal photos.
  - arsome 5y ago
    Yeah, Netflix is actually annoying with it - I was using my "ultra low security" password which is in... probably every public password dump around for years, got dozens of logins, just ignored them til someone finally tried to change it and I had to reset it.
  - shuckles 5y ago
    If you have two factor enabled, which is required for many iCloud features, every single Apple device you own will receive an alert with the location of login before you can reveal the 2FA code, even for iCloud logins. What more would you like to see?
jeroenhd 5y ago
It's kind of funny. When you look into cyber security, the papers are all about controlled rate limiting, advanced anomaly detection, client fingerprinting, the likes, but in practice, very little companies will actually pick out abuse like this. This creep didn't need advanced tooling, exploits or deep knowledge of the backing system. All he needed was a basic phishing scam to work well enough, and the official iCloud software (either from his browser or his computer). All the supposedly advanced algorithms that often arbitrarily ban accounts by mistake managed to miss some random dude behind his laptop, shamelessly leaking private pictures. My heart goes out to this man's victims.
- deleted 5y ago
  [deleted]
- fny 5y ago
  You mean like this? EDIT: DO NOT TRY WHAT FOLLOWS IT IS AN EXAMPLE OF A SCAM. Wow! XYZ is smart enough to block your password so others can't see it! ╍⡵ⱇ⪞‾╴⧊↧Ⓗ⥔⋾⁅ I can see it, but you can't. Try it!!!! An unbelievable number of people fell for this on Myspace and Facebook in the early days.
  - vincentmarle 5y ago
    Uz)j>q5k*n</:bHh
  - abacadaba 5y ago
    Edit: just tried this it DOES NOT work, don't do it
    - detaro 5y ago
      if you actually did, you should change your password now. And pick a more secure one. (not going to try if what you posted actually works...)
      - fny 5y ago
deleted 5y ago
[deleted]
gigatexal 5y ago
“I’m remorseful… but I have a family” he says hoping this doesn’t “ruin” his life. Fuck this guy. He knew what he was doing. He should have all the consequences both those from the court and professionally: who’s going to hire him now? Maybe someone in infosec but likely not ever again in tech.
- SilverRed 5y ago
  This should really be treated as theft on a massive scale. It's similar to if he broke in to 300 peoples houses. Probably even worse.
- radicaldreamer 5y ago
  A friend once pointed out that it's likely a majority of "amateur" porn is likely private content from hacked or stolen accounts and wasn't posted by the any of the parties depicted. He mentioned this when a bunch of stories were coming out about GeekSquad and other IT help as a service companies stealing data or acting as data harvesters for the FBI/DEA etc.
  - throwawayboise 5y ago
    I don't really understand why people even make their own porn, but that aside, I really don't understand why they would save it in the cloud.
    - gowld 5y ago
      Defaults are powerful.
    - CoryAlexMartin 5y ago
      If I take a photo or a video on my iPhone, it's uploaded to iCloud automatically, and afaik there is no way to remove it from iCloud while still keeping it in the photo library on the device without opting out of iCloud Photos entirely.
    - Rietty 5y ago
minsc__and__boo 5y ago
>Investigators soon discovered that a log-in to the victim’s iCloud account had come from an internet address at Chi’s house in La Puente, Bossone said. The FBI got a search warrant and raided the house He goes through the trouble of phishing so many accounts and photos, only to access them directly from his own residence?
- oh_sigh 5y ago
  Sure. All he did was a social engineering by sending people an email asking for their password. There is no indication that he is actually technically competent.
brutal_chaos_ 5y ago
Isn't "stealing" inaccurate here? Copies were made, sure, but nothing was removed from their possession.
- npteljes 5y ago
  Merriam-Webster says that stealing can be "to take (something) without right and with an intent to keep", which is absolutely what happened here.
- koolhaas 5y ago
  What word do you use when someone unrightfully gains possession of something that isn’t theirs? Btw a lot of words in English have multiple meanings, and transform meaning over time, which can be confusing sometimes. For example, in baseball you steal a base, which was being protected by the other team, but you don’t remove the base from the field and run off with it. I think steal works better than copy here, more accurately conveying meaning and intention, and unjust access.
  - Permit 5y ago
    I think the reason "steal" can feel strange here is that we've spent the last 15 years arguing that copyright infringement is "not stealing" because the original creator has not been deprived of anything. The phrase "not stealing" is almost exclusively used in this context on HN: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=%22not%20stealing%22&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
    - koolhaas 5y ago
      I think it’s context dependent, just like other uses of the word steal. With copyright infringement, internet communities have come to agreement that it is not stealing, so avoiding the use of the word in that context is important. In baseball it’s not, and neither with identity theft. With illegally obtained private photos, never intended to be shared or released to the world, is there a better word? It’s such a different scenario, the only similarity I see is both involve files on a computer.
at_a_remove 5y ago
I have been thinking about "nudes" (which I will use as a shorthand to describe digital images of a person sans clothing, almost always taken by that person) in terms of cultural evolution. A couple of years ago I mentioned, on HN, that I knew Jenni, of JenniCam, before the "cam," back when she was just experimenting with this new digital camera device. And then they became more and more available. For a brief time there was a kind of explosion of said nudes. I could be on Yahoo Chat and women would just send them, unsolicited, and I think that was the era of people not realizing that nudes can get around, like any other secret, once you let go of them. My guess is that probably came to an end roughly ten years ago or so, and people now hold onto them tightly, which is probably much more reasonable. People still take nudes, and pass them on, but I think there is a level of discretion that has increased, although I know some women who mention being pestered for such by men they know. Still, these images are on cameras and cloud storage and such, and for the life of me I do not get the hunger that drives such a risky behavior as getting into hacked iCloud accounts versus, I don't know, average sources of free nudes? Poor judgment of course abounds in so many reported crimes but ... how does one even trawl more than half a million photos for nudes? Was he planning on going through them individually? Was he going to make a neural net to scan for skin? I just find the whole thing a little baffling in this day and this age.
- deleted 5y ago
  [deleted]
- IAmEveryone 5y ago
  I get the impression this trend has peaked. For a while, young people stopped going topless on the beach, for example, for fear of photos appearing online. In the last years, it's been making a comeback. I believe it's both a sense that there's so much out there, chances are rather low someone you know will come across any photo. And that it just doesn't matter. I am absolutely certain you wouldn't be able to hurt someone with sending their work colleagues a topless photo you found, but rather risk your own job if you're found.
- lotsofpulp 5y ago
  >and for the life of me I do not get the hunger that drives such a risky behavior as getting into hacked iCloud accounts versus, I don't know, average sources of free nudes? I presume the hunger is more about having access to something you are not supposed to have access to, or were not given access to. "Everything in human life is really about sex, except sex. Sex is about power.”
mataug 5y ago
As always humans are the weakest link when securing systems. This reminds me of this thread https://news.ycombinator.com/item?id=28279326 https://news.ycombinator.com/item?id=28279326 Where the attacker was able to trick Tmobile / Sprint customer service into providing a PUK number.
- rootusrootus 5y ago
  My wife and I had our USAA account 'hacked' in much the same way. Someone called the support line repeatedly, pretending to be my wife, got denied repeatedly. Until one time they didn't. Convinced the teller to reset the password on the account and tell them the login name. All the security in the world doesn't matter if the human with the keys is an idiot. In the end, in our case, USAA gave us a detailed rundown of how they failed, and then turned up to 11 the security questions my wife had to answer. Every single call she had to give a password, pin code, and then answer the questions that are sourced from Experian(or some other credit bureau) intended to prove identity through knowledge. Every time. They punished us for a mistake they fully admitted was their employee's fault. Nah, I'm not bitter at all. Ultimately, though, it will be one of the reasons I move my account away from USAA.
admn2 5y ago
Doesn't icloud have built in 2FA from an unrecognized device?
- judge2020 5y ago
  Yes, and it's heavily pushed. But if this scam really goes that deep in manipulation/phishing: > but he managed to get victims to give him the iCloud passwords he needed to download their data. Then he might have been able to get victims to allow his access.
- fortuna86 5y ago
  I had the same thought.
  - SilverRed 5y ago
    If someone has given their email and password to an attacker, they won't think twice about giving the 2FA code as well.
silurian 5y ago
Interesting but not mentioned in article. What are the odds? Today: > Hao Kuo Chi, 40, of La Puente, has agreed to plead guilty to four felonies then also a Hao Kuo Chi who was 26 in March 2007. from 2007 https://www.latimes.com/archives/la-xpm-2007-apr-12-me-geeksuit12-story.html https://www.latimes.com/archives/la-xpm-2007-apr-12-me-geeks... > The suit, filed in Los Angeles County Superior Court on behalf of Sarah Vasquez, 22, and her mother, Natalie Fornaciari, 46, both from city of Industry, alleges that Geek Squad technician Hao Kuo Chi, 26, placed his cellphone in Vasquez’s bathroom during a computer service call March 4 and recorded her showering.

I am no fan of apple but this man used phishing attacks to gain access to just 306 icloud accounts. That hardly seams a significant failing on apples part. He used the credentials of the victims so I'm not really clear how rate limiting should have played a role, you should be limited from accessing your own account?

SilverRed 5y ago
Apple has made leaps and bounds on security including having 2FA mandatory but none of it matters when the user is convinced they are speaking to someone from apple who is telling them to read out the 2FA code and provide their details. No warning in the world will help because the attacker will just say "Ok thats ok, that warning is just for untrusted people. Since I am an Apple employee, it is perfectly safe". These victims already trust the attacker so they will just do anything asked. I think the only solution here is to just block all logins outside of the users own country and to have local law enforcement crack down hard on any in country criminals. Apple can use the find my location to work out if any of the users devices are at or have been at a certain location. I can't imagine many situations where you leave all of your devices at home, leave the country and then try to log in.
noptd 5y ago
New device logins across 300+ accounts from the same IP in such a short time frame should raise a few red flags.
- Tagbert 5y ago
  Was it really in a short time frame? It sounds like he was choosing some targets based on requests from other people. This sounds like he was doing this over quite a long time.

lph 5y ago

> 4,700 with iCloud user IDs and passwords How does this amount to only four felonies?! Our system is so abysmally bad at understanding crimes of scale, especially when they happen over the internet. If he burgled 4,700 houses, it would be a lot more than four felonies.

IAmEveryone 5y ago
That's because it's a lot scarier to meet someone in your apartment when you don't expect them than having you photos leaked. (With the latter, strictly speaking, being a subset of the former anyway)

masterof0 5y ago

Shouldn't it be "El Puente"?

vxNsr 5y ago

He used gmail addresses. Just goes to show how little ppl pay attention to the email address.

stereoradonc 5y ago

It was a missed opportunity to educate users about 2FA. All Apple's services offer the 2FA and it should be mandatory- it will take some time before users get used to it.

SevenSigs 5y ago

Apple + Privacy = 0

neonate 5y ago

https://archive.is/g854S https://archive.is/g854S

hk1337 5y ago

Any of the photos match to the CSAM database?

radicaldreamer 5y ago

I posted this link and I named it the way I did to draw attention to this in context of CSAM enforcement... this man could have easily uploaded any photos to these hacked iCloud accounts, which would've been synced down to end user devices. Apple didn't catch on to this, despite him not using VPN or Tor... it wasn't until the FBI investigated a public figure's hacked and posted photos that this came to light. [EDIT]: Not the FBI, but a private company noticed this (h/t codeecan)

codeecan 5y ago
Scary indeed, slight correction, not the FBI [initially]; > A California company that specializes in removing celebrity photos from the internet notified an unnamed public figure ... He was caught by random chance of this company.
- not2b 5y ago
  If he was specifically going after famous women's accounts, I don't think it was so random, given that he went after hundreds of people and didn't cover his tracks at all. He was after celebrity photos, he was sloppy, people who try to defend against such attacks were going to catch him.
  - radicaldreamer 5y ago
    We've seen more decentralized and sophisticated attacks of the same type against iCloud ("the fappening" etc.) which were kept mostly private for years before being made public. The fact that those hacks quickly were flushed from the news cycle without a bunch of public lawsuits etc. makes me suspect Apple very proactively went out and made settlements with the more high profile victims of those hacks. Of course, I have no proof of this at all, so it's purely speculation, but it was odd to see almost nothing come out of those hacks.
    - threeseed 5y ago
      > without a bunch of public lawsuits Apple is not at fault here though. These people have clicked on a phishing email no different to a banking or retail one.

codeecan 5y ago

> he impersonated Apple customer support staff in emails that tricked unsuspecting victims into providing him with their Apple IDs and passwords > He gained unauthorized access to photos and videos of at least 306 victims across the nation > Investigators soon discovered that a log-in to the victim’s iCloud account had come from an internet address at Chi’s house Not very sophisticated, but very effective, glad they shut him down but we really need to teach basic internet security in schools.

eli 5y ago
This is a failure of the software community, not the users. I don’t think it’s reasonable to ask users to detect a halfway decent phishing attempt.
SevenSigs 5y ago
> but we really need to teach basic internet security in schools. I think you need to do that for people that are no longer in school... because most young people probably know not to give out their passwords
glitcher 5y ago
I agree that better education around Internet security is needed, especially for basic phishing attacks like this. OTOH, I believe Apple could be doing more to deter and/or detect this type of broad access, especially with the lack of sophistication behind this scheme! I feel like even Netflix does a better job at alerting me to access from a new device, and they aren't storing any of my personal photos.
- arsome 5y ago
  Yeah, Netflix is actually annoying with it - I was using my "ultra low security" password which is in... probably every public password dump around for years, got dozens of logins, just ignored them til someone finally tried to change it and I had to reset it.
- shuckles 5y ago
  If you have two factor enabled, which is required for many iCloud features, every single Apple device you own will receive an alert with the location of login before you can reveal the 2FA code, even for iCloud logins. What more would you like to see?

jeroenhd 5y ago

It's kind of funny. When you look into cyber security, the papers are all about controlled rate limiting, advanced anomaly detection, client fingerprinting, the likes, but in practice, very little companies will actually pick out abuse like this. This creep didn't need advanced tooling, exploits or deep knowledge of the backing system. All he needed was a basic phishing scam to work well enough, and the official iCloud software (either from his browser or his computer). All the supposedly advanced algorithms that often arbitrarily ban accounts by mistake managed to miss some random dude behind his laptop, shamelessly leaking private pictures. My heart goes out to this man's victims.

deleted 5y ago
[deleted]
fny 5y ago
You mean like this? EDIT: DO NOT TRY WHAT FOLLOWS IT IS AN EXAMPLE OF A SCAM. Wow! XYZ is smart enough to block your password so others can't see it! ╍⡵ⱇ⪞‾╴⧊↧Ⓗ⥔⋾⁅ I can see it, but you can't. Try it!!!! An unbelievable number of people fell for this on Myspace and Facebook in the early days.
- vincentmarle 5y ago
  Uz)j>q5k*n</:bHh
- abacadaba 5y ago
  Edit: just tried this it DOES NOT work, don't do it
  - detaro 5y ago
    if you actually did, you should change your password now. And pick a more secure one. (not going to try if what you posted actually works...)
    - fny 5y ago

deleted 5y ago

[deleted]

gigatexal 5y ago

“I’m remorseful… but I have a family” he says hoping this doesn’t “ruin” his life. Fuck this guy. He knew what he was doing. He should have all the consequences both those from the court and professionally: who’s going to hire him now? Maybe someone in infosec but likely not ever again in tech.

SilverRed 5y ago
This should really be treated as theft on a massive scale. It's similar to if he broke in to 300 peoples houses. Probably even worse.
radicaldreamer 5y ago
A friend once pointed out that it's likely a majority of "amateur" porn is likely private content from hacked or stolen accounts and wasn't posted by the any of the parties depicted. He mentioned this when a bunch of stories were coming out about GeekSquad and other IT help as a service companies stealing data or acting as data harvesters for the FBI/DEA etc.
- throwawayboise 5y ago
  I don't really understand why people even make their own porn, but that aside, I really don't understand why they would save it in the cloud.
  - gowld 5y ago
    Defaults are powerful.
  - CoryAlexMartin 5y ago
    If I take a photo or a video on my iPhone, it's uploaded to iCloud automatically, and afaik there is no way to remove it from iCloud while still keeping it in the photo library on the device without opting out of iCloud Photos entirely.
  - Rietty 5y ago

minsc__and__boo 5y ago

>Investigators soon discovered that a log-in to the victim’s iCloud account had come from an internet address at Chi’s house in La Puente, Bossone said. The FBI got a search warrant and raided the house He goes through the trouble of phishing so many accounts and photos, only to access them directly from his own residence?

oh_sigh 5y ago
Sure. All he did was a social engineering by sending people an email asking for their password. There is no indication that he is actually technically competent.

brutal_chaos_ 5y ago

Isn't "stealing" inaccurate here? Copies were made, sure, but nothing was removed from their possession.

npteljes 5y ago
Merriam-Webster says that stealing can be "to take (something) without right and with an intent to keep", which is absolutely what happened here.
koolhaas 5y ago
What word do you use when someone unrightfully gains possession of something that isn’t theirs? Btw a lot of words in English have multiple meanings, and transform meaning over time, which can be confusing sometimes. For example, in baseball you steal a base, which was being protected by the other team, but you don’t remove the base from the field and run off with it. I think steal works better than copy here, more accurately conveying meaning and intention, and unjust access.
- Permit 5y ago
  I think the reason "steal" can feel strange here is that we've spent the last 15 years arguing that copyright infringement is "not stealing" because the original creator has not been deprived of anything. The phrase "not stealing" is almost exclusively used in this context on HN: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=%22not%20stealing%22&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
  - koolhaas 5y ago
    I think it’s context dependent, just like other uses of the word steal. With copyright infringement, internet communities have come to agreement that it is not stealing, so avoiding the use of the word in that context is important. In baseball it’s not, and neither with identity theft. With illegally obtained private photos, never intended to be shared or released to the world, is there a better word? It’s such a different scenario, the only similarity I see is both involve files on a computer.

at_a_remove 5y ago

I have been thinking about "nudes" (which I will use as a shorthand to describe digital images of a person sans clothing, almost always taken by that person) in terms of cultural evolution. A couple of years ago I mentioned, on HN, that I knew Jenni, of JenniCam, before the "cam," back when she was just experimenting with this new digital camera device. And then they became more and more available. For a brief time there was a kind of explosion of said nudes. I could be on Yahoo Chat and women would just send them, unsolicited, and I think that was the era of people not realizing that nudes can get around, like any other secret, once you let go of them. My guess is that probably came to an end roughly ten years ago or so, and people now hold onto them tightly, which is probably much more reasonable. People still take nudes, and pass them on, but I think there is a level of discretion that has increased, although I know some women who mention being pestered for such by men they know. Still, these images are on cameras and cloud storage and such, and for the life of me I do not get the hunger that drives such a risky behavior as getting into hacked iCloud accounts versus, I don't know, average sources of free nudes? Poor judgment of course abounds in so many reported crimes but ... how does one even trawl more than half a million photos for nudes? Was he planning on going through them individually? Was he going to make a neural net to scan for skin? I just find the whole thing a little baffling in this day and this age.

deleted 5y ago
[deleted]
IAmEveryone 5y ago
I get the impression this trend has peaked. For a while, young people stopped going topless on the beach, for example, for fear of photos appearing online. In the last years, it's been making a comeback. I believe it's both a sense that there's so much out there, chances are rather low someone you know will come across any photo. And that it just doesn't matter. I am absolutely certain you wouldn't be able to hurt someone with sending their work colleagues a topless photo you found, but rather risk your own job if you're found.
lotsofpulp 5y ago
>and for the life of me I do not get the hunger that drives such a risky behavior as getting into hacked iCloud accounts versus, I don't know, average sources of free nudes? I presume the hunger is more about having access to something you are not supposed to have access to, or were not given access to. "Everything in human life is really about sex, except sex. Sex is about power.”

mataug 5y ago

As always humans are the weakest link when securing systems. This reminds me of this thread https://news.ycombinator.com/item?id=28279326 https://news.ycombinator.com/item?id=28279326 Where the attacker was able to trick Tmobile / Sprint customer service into providing a PUK number.

rootusrootus 5y ago
My wife and I had our USAA account 'hacked' in much the same way. Someone called the support line repeatedly, pretending to be my wife, got denied repeatedly. Until one time they didn't. Convinced the teller to reset the password on the account and tell them the login name. All the security in the world doesn't matter if the human with the keys is an idiot. In the end, in our case, USAA gave us a detailed rundown of how they failed, and then turned up to 11 the security questions my wife had to answer. Every single call she had to give a password, pin code, and then answer the questions that are sourced from Experian(or some other credit bureau) intended to prove identity through knowledge. Every time. They punished us for a mistake they fully admitted was their employee's fault. Nah, I'm not bitter at all. Ultimately, though, it will be one of the reasons I move my account away from USAA.

admn2 5y ago

Doesn't icloud have built in 2FA from an unrecognized device?

judge2020 5y ago
Yes, and it's heavily pushed. But if this scam really goes that deep in manipulation/phishing: > but he managed to get victims to give him the iCloud passwords he needed to download their data. Then he might have been able to get victims to allow his access.
fortuna86 5y ago
I had the same thought.
- SilverRed 5y ago
  If someone has given their email and password to an attacker, they won't think twice about giving the 2FA code as well.

silurian 5y ago

Interesting but not mentioned in article. What are the odds? Today: > Hao Kuo Chi, 40, of La Puente, has agreed to plead guilty to four felonies then also a Hao Kuo Chi who was 26 in March 2007. from 2007 https://www.latimes.com/archives/la-xpm-2007-apr-12-me-geeksuit12-story.html https://www.latimes.com/archives/la-xpm-2007-apr-12-me-geeks... > The suit, filed in Los Angeles County Superior Court on behalf of Sarah Vasquez, 22, and her mother, Natalie Fornaciari, 46, both from city of Industry, alleges that Geek Squad technician Hao Kuo Chi, 26, placed his cellphone in Vasquez’s bathroom during a computer service call March 4 and recorded her showering.