6 ms·

Hackers got access to Matt Honan's iCloud account by calling Apple Support

76 points by _frog 14y ago

jacques_chester 14y ago
There's a lot of verification steps that are bunk. Full name? Home address? Available from the electoral roll in Australia. Phone number? Look it up. Date of birth? Check with the Registrar of Births, Deaths and Marriages. Mother's maiden name? Ditto. Too many of these verification questions rely on shared secrets that ... aren't secrets.
- gojomo 14y ago
  ...and it's getting worse with all the extra 'security questions' random sites now ask. Why do I have to drop all these obscure-but-not-really-secret details into all these databases? Are they all guarding them as well as a salted-hased password? Do I now have to give them all unique fake answers lest it become another path-of-least-resistance for compromise?
  - suresk 14y ago
    They really are horrible. When I'm given a small list of questions to choose from, they generally fall into three buckets: - Completely non-applicable (I'm not married and don't have any kids or pets) - Transitory and inane (I don't really have a favorite meal or movie, and if I did, who is to say it will be the same forever?) - Rely on information that is relatively easily to figure out (birthplace, high school mascot, mother's maiden name, etc) Security questions alone should never be sufficient to reset a password or gain access to an account, and I'm not really sure they add a whole lot in other contexts either.
    - mmariani 14y ago
      I find them horrible as well. That's why when I'm given the opportunity to write my own questions I always do so. Then in this security theater I hopefully am a little bit safer than most people that just pick a question from a list. On a side note, one of these days I've got really scared when a reputable credit card company asked me for one of these security questions. WTF?!
  - meric 14y ago
    Whenever they give me the option to make up my own question, I go "What is the password you designated for answering secret questions on this site?".
  - nicholassmith 14y ago
    My bank does something that at first I thought was weird but I get a bit more, they ask me to confirm a specific purchase on a specific date. Or to who a payment of X amount was. At first I thought it was completely pointless, someone gets my bank statement then I'm done, but they only ask about the purchases since my last statement. Not saying that Apple should be asking 'what app did you buy on the 1st August?', but a small confirmation outside of the data you provide would probably be useful.
Zenst 14y ago
So question is now, what are Apple doing about it given the impact. Think they said it would take alot of forensic work to restore the iMac as well, I've got the popcorn ready to follow this one.
- taligent 14y ago
  The iMac is gone. The remote wipe would be equivalent to a format so you may be able to get some data back but most of it would be unusable. I don't think Apple can do much about not having a backup. What Apple probably needs to do is have a popup to remind people to backup when they switch on the Find My Mac feature. But I doubt they can do more than that.
  - fuzzleonard 14y ago
    Even if Apple could recover the data by doing so they would be admitting their remote wipe feature is worthless. I rather doubt they will add a "I see you have enabled Find My Mac--you better back up your system because we will give any random idiot who calls in access to wipe your hard drive. Thanks for choosing Apple!" popup, though.
    - r00fus 14y ago
      Useless? No, flawed, but if the guy has backups like most folks should - he'd have been fine. Apple even makes it easy with Time Machine - they can't be faulted for the wipe (I don't have this on my Mac - I just use disk+memory encryption). Apple can be faulted for allowing the security breach.
  - 0x0 14y ago
    On the iphone, the file system is always encrypted, and the encryption keys are stored on the device, themselves being encrypted with your PIN/passphrase. To perform a remote wipe, it only needs to zero out this single block containing the FS keys, making the whole FS unrecoverable since the keys are gone. I wonder if the same thing happens on Filevault2. In that case, Apple's only choice would be to rent some serious GPU time at NSA or something...
epaik 14y ago
It's easy to forget that social engineering is one of the oldest and easiest way for a hacker to get access to a system.
- mturmon 14y ago
  So true. Speculation in the original comment thread (http://news.ycombinator.com/item?id=4337938 http://news.ycombinator.com/item?id=4337938) included MITM attacks, keyloggers, sleeper programs left over from an earlier (known) breakin, brute force, etc. Most of the ideas batted around were technical in nature and somewhat advanced.
- eslaught 14y ago
  And also easy to forget that the level of verification required by most alternative authentication schemes is significantly weaker than the original login mechanism.
thornofmight 14y ago
At the very least Apple should pay to have professional forensics restore the lost data.
- thatjoshguy 14y ago
  OS X has dead simple automatic backup built in. In fact, whenever you plug in a compatible hard drive, Time Machine will prompt you to enable. Apple has already done everything they should.
- gcr 14y ago
  Why should they treat this person any different than their other paying customers? The remote wipe isn't the root issue here.
  - thornofmight 14y ago
    Isn't the root issue the fact that Apple's lax security allowed the hacker to do the remote wipe?
feefie 14y ago
"Wow. Okay. So I've confirmed with both the hacker and Apple how this happened. Was via a phone call to Apple tech support." There should be enough of a trail to track down the hacker and have him charged, right? The call to Apple would be logged by at least the telephone company, wouldn't it?
- fuzzleonard 14y ago
  You subpoena the phone company for that kind of information when terrorism is involved. This is more like having your bicycle stolen. There is not going to be a CSI team, fingerprinting, detectives, interrogations or high-speed car chases. Apple's call center probably has the CLID of the caller logged, but equally probably that person called from a prepaid cell phone.
  - iamdave 14y ago
    There is not going to be a CSI team, fingerprinting, detectives, interrogations or high-speed car chases. Sure, probably not from the police. But I will put down the rest of my year's salary that Apple will be investigating like all hell how this happened and taking all kinds of steps to make sure this never happens again. Whether or not it actually will is a different story.
    - fauigerzigerk 14y ago
      I would expect so, but catching the guy who did this isn't necessarily part of it.
  - feefie 14y ago
    In my country police put out unlocked "bait bikes", walk away, and then arrest anyone who takes it. Then they show the footage on the news. Sometimes the plain clothes police officer hasn't even left the camera frame and someone is already on the bike riding off. If they'll spend resources doing that (which I think is good) then they should spend resources catching someone that maliciously destroyed a year's worth of laptop data. If he was a developer and his code was on that laptop, at $150 per hour, 8 hours a day, 5 days a week, for 52 weeks the financial cost is much more than a bike. Sure the victim should have a backup, but an eggshell skull is no defense.
deleted 14y ago
[deleted]
celerity 14y ago
This is just a good reminder to treat all cloud services out of your control as semi-public.
cageface 14y ago
The really annoying thing about this is that it's going to be that much more difficult now to persuade Apple support to intervene in legitimate cases now that they've been burned this badly in public. Hackers (in the pejorative sense of the term) and software pirates really are the scum of the earth.
- k-mcgrady 14y ago
  Off topic but I'm curious why you specified software pirates as 'the scum of the earth'? Also, why specifically software pirates and not all pirates?
  - tedivm 14y ago
    Real pirates prevent global warming.
- antihero 14y ago
  As opposed to, for instance, rapists, war criminals, and corrupt politicians?
  - cageface 14y ago
    People abusing the information networks are disproportionately damaging because they empower those that are just looking for excuses to turn the whole internet into one big surveillance machine.
    - antihero 14y ago
      No, they are unnecessary, if those who are in power want it to happen, they will find a way, regardless of our actions.
tzs 14y ago
Suppose a Mac has multiple drives. Say, two internal drives and an external drive. Does remote wipe just wipe the boot drive, just the internal drives, or all the drives?
rogerchucker 14y ago
Wait a bloody minute... if you are calling about iCloud password, wouldn't Apple's tech support automatically suspect why the caller isn't going to iforgot.apple.com instead? I mean it doesn't make sense if the person calling says "Oh I badly need the iCloud password, but I don't have access to a browser". On the other hand, if the person said "yes yes I tried iforgot.apple.com but I can't seem to remember any of my security answers/email address used", then that should naturally raise suspicion in the mind of the Apple tech support person, right??
- lallysingh 14y ago
  Nope, lots and lots of apple customers who aren't techs.
rogerchucker 14y ago
I'm totally lost now.. look at the last line on the screenshot of Mat's Gmail inbox. Seems like they reset the password through iforgot.apple.com since instructions were emailed? Or was that just an attempt?
drivebyacct2 14y ago
I find it hilarious that Apple wants to store my File Vault decryption key and hide it behind three security questions.
lostlogin 14y ago
How?

76 points by _frog 14y ago

There's a lot of verification steps that are bunk. Full name? Home address? Available from the electoral roll in Australia. Phone number? Look it up. Date of birth? Check with the Registrar of Births, Deaths and Marriages. Mother's maiden name? Ditto. Too many of these verification questions rely on shared secrets that ... aren't secrets.

gojomo 14y ago
...and it's getting worse with all the extra 'security questions' random sites now ask. Why do I have to drop all these obscure-but-not-really-secret details into all these databases? Are they all guarding them as well as a salted-hased password? Do I now have to give them all unique fake answers lest it become another path-of-least-resistance for compromise?
- suresk 14y ago
  They really are horrible. When I'm given a small list of questions to choose from, they generally fall into three buckets: - Completely non-applicable (I'm not married and don't have any kids or pets) - Transitory and inane (I don't really have a favorite meal or movie, and if I did, who is to say it will be the same forever?) - Rely on information that is relatively easily to figure out (birthplace, high school mascot, mother's maiden name, etc) Security questions alone should never be sufficient to reset a password or gain access to an account, and I'm not really sure they add a whole lot in other contexts either.
  - mmariani 14y ago
    I find them horrible as well. That's why when I'm given the opportunity to write my own questions I always do so. Then in this security theater I hopefully am a little bit safer than most people that just pick a question from a list. On a side note, one of these days I've got really scared when a reputable credit card company asked me for one of these security questions. WTF?!
- meric 14y ago
  Whenever they give me the option to make up my own question, I go "What is the password you designated for answering secret questions on this site?".
- nicholassmith 14y ago
  My bank does something that at first I thought was weird but I get a bit more, they ask me to confirm a specific purchase on a specific date. Or to who a payment of X amount was. At first I thought it was completely pointless, someone gets my bank statement then I'm done, but they only ask about the purchases since my last statement. Not saying that Apple should be asking 'what app did you buy on the 1st August?', but a small confirmation outside of the data you provide would probably be useful.

Zenst 14y ago

So question is now, what are Apple doing about it given the impact. Think they said it would take alot of forensic work to restore the iMac as well, I've got the popcorn ready to follow this one.

taligent 14y ago
The iMac is gone. The remote wipe would be equivalent to a format so you may be able to get some data back but most of it would be unusable. I don't think Apple can do much about not having a backup. What Apple probably needs to do is have a popup to remind people to backup when they switch on the Find My Mac feature. But I doubt they can do more than that.
- fuzzleonard 14y ago
  Even if Apple could recover the data by doing so they would be admitting their remote wipe feature is worthless. I rather doubt they will add a "I see you have enabled Find My Mac--you better back up your system because we will give any random idiot who calls in access to wipe your hard drive. Thanks for choosing Apple!" popup, though.
  - r00fus 14y ago
    Useless? No, flawed, but if the guy has backups like most folks should - he'd have been fine. Apple even makes it easy with Time Machine - they can't be faulted for the wipe (I don't have this on my Mac - I just use disk+memory encryption). Apple can be faulted for allowing the security breach.
- 0x0 14y ago
  On the iphone, the file system is always encrypted, and the encryption keys are stored on the device, themselves being encrypted with your PIN/passphrase. To perform a remote wipe, it only needs to zero out this single block containing the FS keys, making the whole FS unrecoverable since the keys are gone. I wonder if the same thing happens on Filevault2. In that case, Apple's only choice would be to rent some serious GPU time at NSA or something...

epaik 14y ago

It's easy to forget that social engineering is one of the oldest and easiest way for a hacker to get access to a system.

mturmon 14y ago
So true. Speculation in the original comment thread (http://news.ycombinator.com/item?id=4337938 http://news.ycombinator.com/item?id=4337938) included MITM attacks, keyloggers, sleeper programs left over from an earlier (known) breakin, brute force, etc. Most of the ideas batted around were technical in nature and somewhat advanced.
eslaught 14y ago
And also easy to forget that the level of verification required by most alternative authentication schemes is significantly weaker than the original login mechanism.

thornofmight 14y ago

At the very least Apple should pay to have professional forensics restore the lost data.

thatjoshguy 14y ago
OS X has dead simple automatic backup built in. In fact, whenever you plug in a compatible hard drive, Time Machine will prompt you to enable. Apple has already done everything they should.
gcr 14y ago
Why should they treat this person any different than their other paying customers? The remote wipe isn't the root issue here.
- thornofmight 14y ago
  Isn't the root issue the fact that Apple's lax security allowed the hacker to do the remote wipe?

feefie 14y ago

"Wow. Okay. So I've confirmed with both the hacker and Apple how this happened. Was via a phone call to Apple tech support." There should be enough of a trail to track down the hacker and have him charged, right? The call to Apple would be logged by at least the telephone company, wouldn't it?

fuzzleonard 14y ago
You subpoena the phone company for that kind of information when terrorism is involved. This is more like having your bicycle stolen. There is not going to be a CSI team, fingerprinting, detectives, interrogations or high-speed car chases. Apple's call center probably has the CLID of the caller logged, but equally probably that person called from a prepaid cell phone.
- iamdave 14y ago
  There is not going to be a CSI team, fingerprinting, detectives, interrogations or high-speed car chases. Sure, probably not from the police. But I will put down the rest of my year's salary that Apple will be investigating like all hell how this happened and taking all kinds of steps to make sure this never happens again. Whether or not it actually will is a different story.
  - fauigerzigerk 14y ago
    I would expect so, but catching the guy who did this isn't necessarily part of it.
- feefie 14y ago
  In my country police put out unlocked "bait bikes", walk away, and then arrest anyone who takes it. Then they show the footage on the news. Sometimes the plain clothes police officer hasn't even left the camera frame and someone is already on the bike riding off. If they'll spend resources doing that (which I think is good) then they should spend resources catching someone that maliciously destroyed a year's worth of laptop data. If he was a developer and his code was on that laptop, at $150 per hour, 8 hours a day, 5 days a week, for 52 weeks the financial cost is much more than a bike. Sure the victim should have a backup, but an eggshell skull is no defense.

deleted 14y ago

[deleted]

celerity 14y ago

This is just a good reminder to treat all cloud services out of your control as semi-public.

cageface 14y ago

The really annoying thing about this is that it's going to be that much more difficult now to persuade Apple support to intervene in legitimate cases now that they've been burned this badly in public. Hackers (in the pejorative sense of the term) and software pirates really are the scum of the earth.

k-mcgrady 14y ago
Off topic but I'm curious why you specified software pirates as 'the scum of the earth'? Also, why specifically software pirates and not all pirates?
- tedivm 14y ago
  Real pirates prevent global warming.
antihero 14y ago
As opposed to, for instance, rapists, war criminals, and corrupt politicians?
- cageface 14y ago
  People abusing the information networks are disproportionately damaging because they empower those that are just looking for excuses to turn the whole internet into one big surveillance machine.
  - antihero 14y ago
    No, they are unnecessary, if those who are in power want it to happen, they will find a way, regardless of our actions.

tzs 14y ago

Suppose a Mac has multiple drives. Say, two internal drives and an external drive. Does remote wipe just wipe the boot drive, just the internal drives, or all the drives?

rogerchucker 14y ago

Wait a bloody minute... if you are calling about iCloud password, wouldn't Apple's tech support automatically suspect why the caller isn't going to iforgot.apple.com instead? I mean it doesn't make sense if the person calling says "Oh I badly need the iCloud password, but I don't have access to a browser". On the other hand, if the person said "yes yes I tried iforgot.apple.com but I can't seem to remember any of my security answers/email address used", then that should naturally raise suspicion in the mind of the Apple tech support person, right??

lallysingh 14y ago
Nope, lots and lots of apple customers who aren't techs.

rogerchucker 14y ago

I'm totally lost now.. look at the last line on the screenshot of Mat's Gmail inbox. Seems like they reset the password through iforgot.apple.com since instructions were emailed? Or was that just an attempt?

drivebyacct2 14y ago

I find it hilarious that Apple wants to store my File Vault decryption key and hide it behind three security questions.

lostlogin 14y ago

How?