6 ms·

I posted this link and I named it the way I did to draw attention to this in context of CSAM enforcement... this man could have easily uploaded any photos to th

I posted this link and I named it the way I did to draw attention to this in context of CSAM enforcement... this man could have easily uploaded any photos to these hacked iCloud accounts, which would've been synced down to end user devices. Apple didn't catch on to this, despite him not using VPN or Tor... it wasn't until the FBI investigated a public figure's hacked and posted photos that this came to light. [EDIT]: Not the FBI, but a private company noticed this (h/t codeecan)

codeecan 5y ago
Scary indeed, slight correction, not the FBI [initially]; > A California company that specializes in removing celebrity photos from the internet notified an unnamed public figure ... He was caught by random chance of this company.
- not2b 5y ago
  If he was specifically going after famous women's accounts, I don't think it was so random, given that he went after hundreds of people and didn't cover his tracks at all. He was after celebrity photos, he was sloppy, people who try to defend against such attacks were going to catch him.
  - radicaldreamer 5y ago
    We've seen more decentralized and sophisticated attacks of the same type against iCloud ("the fappening" etc.) which were kept mostly private for years before being made public. The fact that those hacks quickly were flushed from the news cycle without a bunch of public lawsuits etc. makes me suspect Apple very proactively went out and made settlements with the more high profile victims of those hacks. Of course, I have no proof of this at all, so it's purely speculation, but it was odd to see almost nothing come out of those hacks.
    - threeseed 5y ago
      > without a bunch of public lawsuits Apple is not at fault here though. These people have clicked on a phishing email no different to a banking or retail one.
spac 5y ago
https://twitter.com/matthew_d_green/status/1429963141568401422 https://twitter.com/matthew_d_green/status/14299631415684014...
- radicaldreamer 5y ago
  Absolutely: https://twitter.com/matthew_d_green/status/1429983703460204544 https://twitter.com/matthew_d_green/status/14299837034602045... I assume each upload is tagged with device ID which first uploaded it etc. but maybe that can be spoofed as well?
  - radicaldreamer 5y ago
    There's no real reason to assume this is true, because Apple's systems didn't detect hundreds of accounts being accessed from a single, home IP...
- shuckles 5y ago
  This Twitter account continues to debase discourse about the child safety proposals with FUD. It posted incorrect information about the proposal before launch and has continued with useless speculation. How many of the hypothesized threat models which don’t pan out has he formally redacted? If you are worried about the security of iCloud, then that can be read as more reason to prefer client side scanning. Of course the tweets are ambiguous about logical implications so you can’t engage with them directly.
  - noptd 5y ago
    And I could say that this HN account has been baselessly dismissing valid concerns about the proposal and providing non sequiturs to assert why nobody should be concerned since it was announced. However, stating my opinion as fact in an attempt to invalidate someone else's perspective on the matter would be debasing discourse so I wouldn't do that. None of us should.
    - shuckles 5y ago
Tagbert 5y ago
If Apple were to do what many recommend and do CSAM scanning in the cloud like other providers, would that change this attack vector?
- dathinab 5y ago
  no Edit: No if they use the same algorithm, but they could use other algorithm which are less abusable and no one would know the hashes in the database, so Yes I guess?
- threeseed 5y ago
  It's only an attack vector in the minds of people who haven't given it more than 10 seconds of thought. Apple knows the sync dates of all of the photos that are uploaded. So unless someone has hacked your account and has been directly trickle feeding CSAM for years (without you noticing) then it's going to look suspicious. A big dump of lots of CSAM at one particular timestamp is a pretty easy thing to spot. And then in this case they aren't hacking the phone but the account which means Apple is going to notice a set of photos coming from an IP address they haven't seen used from that account before.
  - thephyber 5y ago
    > A big dump of lots of CSAM at one particular timestamp is a pretty easy thing to spot. Only if that system / heuristic has been built. The same could have been said about Apple’s systems for identifying bulk account hijacks, but Apple didn’t, which I suppose is the value of this story. And companies aren’t allowed to Just inspect content once they identify CSAM. It is kryptonite for criminal liability. Companies are required to turn it over to the feds quickly and to try not to disturb metadata. I suspect your line of thought would work given full ability to inspect (and some assumptions about what an IP change actually proves), but in practice Apple still hasn’t gotten the basics around account hijacks/fraud sorted out, so I’m hesitant to cheer them on as they try to quickly jump into the deep screaming “think of the children!”.
    - mulmen 5y ago
Jtsummers 5y ago
> I named it the way I did to draw attention to this in context of CSAM enforcement... From the site guidelines: > Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize. Just a reminder because if a mod ends up viewing this they will probably change the title back to the original.
threeseed 5y ago
Comments like are so bizarre to me. Google, Microsoft etc we know for a fact do server side scanning of photos for CSAM. Apple should be assumed to do the same. So what exactly is the difference if this is done client or server side. The person being hacked would still be investigated by the FBI.
- thephyber 5y ago
  The problem with the US statute for CSAM is that possession is illegal, not just intentional creation/collection/distribution. The person being hacked has technically broken the law, even if they don’t get prosecuted. I don’t know how often unintentional possessors are prosecuted, but the US system of prosecution makes it easy for an innocent to get railroaded by threats of massive charges and comparatively leanient plea deals, combined with punitive sentencing for those who reject the plea bargain. Think Aaron Schwartz, but without any intent to violate the law. > The person being hacked would still be investigated by the FBI As someone with family in the FBI (one on a relevant team) and a local LEO that was deputized to do this work for the US Marshals, that doesn’t reassure me. The best forensics employees in the FBI with enough resources can identify that there was a hack and that the account owner is innocent. We live in a world of scarcity where that much effort is not always invested. I think the client-side versus server side is more about relative trade offs of who owns the client device (and what “ownership” means) and whether the equivalent server side search is technologically feasible (might not be if the client encrypts with a key only the client owns, as some have speculated about Apple’s future plans).
  - timdev2 5y ago
    What strict-liability statute are you referring to?
    - thephyber 5y ago
      This HN comment suggests that you are right that there is no strict-liability statute for CSAM: https://news.ycombinator.com/item?id=28235669 https://news.ycombinator.com/item?id=28235669 IANAL so I am very likely wrong. US Code 18 Sec 2252 seems to state that possessing or looking at CSAM material requires that the action is done “knowingly”.
tyingq 5y ago
We'll call it "The Trappening".
gsibble 5y ago
The fact Apple missed logins to hundreds of accounts over time from a single ip registered probably to Spectrum or Verizon ISP is a little suspect. Then again, there are probably public ips with a nat with thousands of iphones behind it at times. This might be a really hard one to detect even though it's sloppy.
- xenadu02 5y ago
  Companies regularly NAT many thousands of users behind a single public IP. Additionally non-profits, schools, and others often provide WiFi for their guests/students using a supposedly residential internet account or their ISP doesn't segment basic business IPs from residentials. In any case flagging multiple accounts logging in from a single public IP is not as useful a signal as you might think.
  - shuckles 5y ago
    Given that the accused was arrested in 2007 for similar sex crimes while a Geek Squad employee, one must imagine that he’s been up to this for years.
- meibo 5y ago
  Apple itself is currently obsoleting IP-based account theft heuristics with their iCloud VPN, so they might have stopped relying on it internally already :)

codeecan 5y ago

Scary indeed, slight correction, not the FBI [initially]; > A California company that specializes in removing celebrity photos from the internet notified an unnamed public figure ... He was caught by random chance of this company.

not2b 5y ago
If he was specifically going after famous women's accounts, I don't think it was so random, given that he went after hundreds of people and didn't cover his tracks at all. He was after celebrity photos, he was sloppy, people who try to defend against such attacks were going to catch him.
- radicaldreamer 5y ago
  We've seen more decentralized and sophisticated attacks of the same type against iCloud ("the fappening" etc.) which were kept mostly private for years before being made public. The fact that those hacks quickly were flushed from the news cycle without a bunch of public lawsuits etc. makes me suspect Apple very proactively went out and made settlements with the more high profile victims of those hacks. Of course, I have no proof of this at all, so it's purely speculation, but it was odd to see almost nothing come out of those hacks.
  - threeseed 5y ago
    > without a bunch of public lawsuits Apple is not at fault here though. These people have clicked on a phishing email no different to a banking or retail one.

spac 5y ago

https://twitter.com/matthew_d_green/status/1429963141568401422 https://twitter.com/matthew_d_green/status/14299631415684014...

radicaldreamer 5y ago
Absolutely: https://twitter.com/matthew_d_green/status/1429983703460204544 https://twitter.com/matthew_d_green/status/14299837034602045... I assume each upload is tagged with device ID which first uploaded it etc. but maybe that can be spoofed as well?
- radicaldreamer 5y ago
  There's no real reason to assume this is true, because Apple's systems didn't detect hundreds of accounts being accessed from a single, home IP...
shuckles 5y ago
This Twitter account continues to debase discourse about the child safety proposals with FUD. It posted incorrect information about the proposal before launch and has continued with useless speculation. How many of the hypothesized threat models which don’t pan out has he formally redacted? If you are worried about the security of iCloud, then that can be read as more reason to prefer client side scanning. Of course the tweets are ambiguous about logical implications so you can’t engage with them directly.
- noptd 5y ago
  And I could say that this HN account has been baselessly dismissing valid concerns about the proposal and providing non sequiturs to assert why nobody should be concerned since it was announced. However, stating my opinion as fact in an attempt to invalidate someone else's perspective on the matter would be debasing discourse so I wouldn't do that. None of us should.
  - shuckles 5y ago

Tagbert 5y ago

If Apple were to do what many recommend and do CSAM scanning in the cloud like other providers, would that change this attack vector?

dathinab 5y ago
no Edit: No if they use the same algorithm, but they could use other algorithm which are less abusable and no one would know the hashes in the database, so Yes I guess?
threeseed 5y ago
It's only an attack vector in the minds of people who haven't given it more than 10 seconds of thought. Apple knows the sync dates of all of the photos that are uploaded. So unless someone has hacked your account and has been directly trickle feeding CSAM for years (without you noticing) then it's going to look suspicious. A big dump of lots of CSAM at one particular timestamp is a pretty easy thing to spot. And then in this case they aren't hacking the phone but the account which means Apple is going to notice a set of photos coming from an IP address they haven't seen used from that account before.
- thephyber 5y ago
  > A big dump of lots of CSAM at one particular timestamp is a pretty easy thing to spot. Only if that system / heuristic has been built. The same could have been said about Apple’s systems for identifying bulk account hijacks, but Apple didn’t, which I suppose is the value of this story. And companies aren’t allowed to Just inspect content once they identify CSAM. It is kryptonite for criminal liability. Companies are required to turn it over to the feds quickly and to try not to disturb metadata. I suspect your line of thought would work given full ability to inspect (and some assumptions about what an IP change actually proves), but in practice Apple still hasn’t gotten the basics around account hijacks/fraud sorted out, so I’m hesitant to cheer them on as they try to quickly jump into the deep screaming “think of the children!”.
  - mulmen 5y ago

Jtsummers 5y ago

> I named it the way I did to draw attention to this in context of CSAM enforcement... From the site guidelines: > Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize. Just a reminder because if a mod ends up viewing this they will probably change the title back to the original.

threeseed 5y ago

Comments like are so bizarre to me. Google, Microsoft etc we know for a fact do server side scanning of photos for CSAM. Apple should be assumed to do the same. So what exactly is the difference if this is done client or server side. The person being hacked would still be investigated by the FBI.

thephyber 5y ago
The problem with the US statute for CSAM is that possession is illegal, not just intentional creation/collection/distribution. The person being hacked has technically broken the law, even if they don’t get prosecuted. I don’t know how often unintentional possessors are prosecuted, but the US system of prosecution makes it easy for an innocent to get railroaded by threats of massive charges and comparatively leanient plea deals, combined with punitive sentencing for those who reject the plea bargain. Think Aaron Schwartz, but without any intent to violate the law. > The person being hacked would still be investigated by the FBI As someone with family in the FBI (one on a relevant team) and a local LEO that was deputized to do this work for the US Marshals, that doesn’t reassure me. The best forensics employees in the FBI with enough resources can identify that there was a hack and that the account owner is innocent. We live in a world of scarcity where that much effort is not always invested. I think the client-side versus server side is more about relative trade offs of who owns the client device (and what “ownership” means) and whether the equivalent server side search is technologically feasible (might not be if the client encrypts with a key only the client owns, as some have speculated about Apple’s future plans).
- timdev2 5y ago
  What strict-liability statute are you referring to?
  - thephyber 5y ago
    This HN comment suggests that you are right that there is no strict-liability statute for CSAM: https://news.ycombinator.com/item?id=28235669 https://news.ycombinator.com/item?id=28235669 IANAL so I am very likely wrong. US Code 18 Sec 2252 seems to state that possessing or looking at CSAM material requires that the action is done “knowingly”.

tyingq 5y ago

We'll call it "The Trappening".

gsibble 5y ago

The fact Apple missed logins to hundreds of accounts over time from a single ip registered probably to Spectrum or Verizon ISP is a little suspect. Then again, there are probably public ips with a nat with thousands of iphones behind it at times. This might be a really hard one to detect even though it's sloppy.

xenadu02 5y ago
Companies regularly NAT many thousands of users behind a single public IP. Additionally non-profits, schools, and others often provide WiFi for their guests/students using a supposedly residential internet account or their ISP doesn't segment basic business IPs from residentials. In any case flagging multiple accounts logging in from a single public IP is not as useful a signal as you might think.
- shuckles 5y ago
  Given that the accused was arrested in 2007 for similar sex crimes while a Geek Squad employee, one must imagine that he’s been up to this for years.
meibo 5y ago
Apple itself is currently obsoleting IP-based account theft heuristics with their iCloud VPN, so they might have stopped relying on it internally already :)