14 ms·
Apple Support Allowed Hacker Access to Reporter's iCloud Account
- kristofferR 14y agoI hope he sues Apple for this and wins, behavior like this shouldn't be allowed without consequences.
- _delirium 14y agoFrom iCloud's ToS, it looks like it'd depend on whether a court finds this to be either "failure to use reasonable skill and due care" or "gross negligence": APPLE SHALL USE REASONABLE SKILL AND DUE CARE IN PROVIDING THE SERVICE. THE FOLLOWING LIMITATIONS DO NOT APPLY IN RESPECT OF LOSS RESULTING FROM (A) APPLE'S FAILURE TO USE REASONABLE SKILL AND DUE CARE; (B) APPLE'S GROSS NEGLIGENCE, WILFUL MISCONDUCT OR FRAUD; OR (C) DEATH OR PERSONAL INJURY. [Blanket disclaimer of liability in all other cases follows.] I'd be curious if there is any good precedent on product liability for cloud services.
- jacques_chester 14y agoJust because a clause is in a contract, doesn't mean it has any effect. A lot of terms are flat out bluffing to scare off folk like you. This is why it is always a good investment to ask your lawyer.
- mistercow 14y agoThis is really, really important advice, and if more people understood it, corporations would have a lot less power over people than they currently do. You can open up just about any ToS and find a handful of unenforceable clauses they're hoping you won't realize are unenforceable.
- fl3tch 14y agoI suspect the vast majority of people never read the TOS and decide to sue, or not, for completely independent reasons.
- ams6110 14y agoIn general, I'd say that if you are getting a lawyer involved, you need to have fairly solid evidence of real loss of a value more than about $20,000, otherwise the fees are going to eat up any award you might eventually get (don't forget even if you get a favorable judgement the other side can appeal, and will if they have staff lawyers who are getting a salary either way).
- yalogin 14y agoI don't think I would label this horrible behavior on the part of Apple. When you provide customer service for something like iCloud things like these are bound to happen. This is a case of social engineering not some tech rep downloading plaintext passwords to a laptop and losing it. With a really targeted attack they are bound to be successful with some rep. Its a matter of when not if. Having said that they will improve their support with this. And the guy could end up suing Apple as well.
- ralfn 14y agoThe techrep shouldnt be allowed to reset your password. For all you know, that guy is your wife's ex. This reminds me of facebook and how all its employees were stalking people using the god password. They can and should follow bank protocol. Require an ID, make every action reversable ( like being able to undo a wipe ) and have both employee and requester on tape, with id's.
- myko 14y ago> This reminds me of facebook and how all its employees were stalking people using the god password. Wait what? Sorry to get off topic but when did this happen?
- moreati 14y agoPossibly referring to this story. http://online.wsj.com/article/SB10001424052702304898704577478483529665936.html http://online.wsj.com/article/SB1000142405270230489870457747... If so, the quote only says they could stalk people with the master password, not that they were.
- tedunangst 14y agoThis is the internet, we don't distinguish between could do and did do.
- ralfn 14y agoFacebook employees were able to login to any acount using the password "chucknorris". Including being able to read private messages of their friends, families, ex-girlfriends, etc This wasnt just true when facebook was a university startup, but even when they were already the largest social network in the US.
- feefie 14y agoI hope he sues Apple too. Not because I want any harm to come to Apple, but because I want Apple to have a significant financial incentive to push authorities to track down the villain.
- Nutella2 14y agoAnd more important, a significant financial incentive to correct their own obviously inadequate procedures.
- Jyaif 14y agoThe remote wipe part is extremely scary. How do you disable this on your mac?
- yankcrime 14y agoYou need to disable 'Find my Mac' under iCloud's settings: http://support.apple.com/kb/PH2697 http://support.apple.com/kb/PH2697
- kristofferR 14y agoSystem Preferences - iCloud - Find My Mac (remove the checkmark)
- prof_hobart 14y agoIs there any way to remove the wiping bit without removing the whole finding functionality? That bit is extremely useful, and if a hacker managed to get into my iCloud I wouldn't be that worried about them being able to locate it. But being able to wipe everything as well is a different matter.
- ConstantineXVI 14y agoIIRC it does the wipe via the recovery boot, so wiping that partition would kill it. BUT: you'd be hosed if you ever needed recovery, you wouldn't be able to use full-disk encryption, and there's likely other bits of the OS that would break in subtle and interesting ways without it there. Tread _very_ carefully.
- yen223 14y agoAs long as you have a recovery USB, you'll be fine.
- ben1040 14y ago>IIRC it does the wipe via the recovery boot, so wiping that partition would kill it. Isn't this not an option in relatively recent Macs, which have the recovery functionality baked into the EFI firmware and not as a partition on the disk? Newer Macs have that functionality out of the box, and a bunch from 2010 and early 2011 that did not originally ship with the recovery firmware ended up getting it later via update: http://support.apple.com/kb/HT4904 http://support.apple.com/kb/HT4904
- shawndumas 14y agoI am confused; did the hacker guess the security questions or obviate them? If the former it's not Apple's fault. If the latter; that's inexcusable.
- sp332 14y agoIf the Apple-chosen security questions are reasonably guessable, that's still Apple's fault.
- shawndumas 14y agoHere is the list; You tell me. Keep in mind though; you can answer anything you want. Use a 1password generated string for each and store the answers redundantly. That's what I did. --------------------------------- What was the first car you owned? Who was your first teacher? What was the first album you owned? Where was your first job? In which city were you first kissed? --- Which of the cars you’ve owned has been your favorite? Who was your favourite teacher? What was the first concert you attended? Where was your favourite job? Who was your best childhood friend? --- Which of the cars you’ve owned has been your least favorite? Who was your least favourite teacher? Where was your least favourite job? In which city did your mother and father meet? Where were you on January 1, 2000?
- RexRollman 14y agoThat's why I always give a ten character random string as answers to those questions.
- cschneid 14y agoI use the 1password pronounceable strings. Still plenty random, but you can say it over the phone to a customer service person if you ever do need.
- shawndumas 14y agoGreat idea: Updating my questions now...
- akeck 14y agoTo connect or not to connect? I have been debating the advantages and disadvantages of coupling both personal and work IT systems for some time now. If you tie your IT systems together, you can manage them more easily and efficiently. On the other hand, as in Mat's case, a single node failure can cause an entire system to collapse. For another example, consider fully automatic self-updating servers. Without safe-guards, a configuration bug can bring them all down within minutes. At this point, I think some coupling, but not total coupling, is best. Too little coupling won't allow enough productivity; too much increases your risk of system-wide failure.
- rogerchucker 14y agoDamn.. this is popcorn-worthy. Anti-Applites are gonna say "sue them!" and Fanboys are gonna post a rebuttal to each of those posts.
- ken 14y agoI'm sitting at home surrounded by a bunch of Apple hardware, and my first reaction is "This is why you shouldn't use iCloud!". This is also why I refused to connect my iOS device to an Exchange server at work (which grants remote-wipe capability). I don't think this is Apple versus non-Apple. I think this is everything-in-the-cloud versus everything-local.
- steve8918 14y agoIt seems logical that the easiest attack vector for any type of cloud storage is through social engineering. You're essentially protecting potentially valuable or incriminating data behind millions of dollars worth of firewalls, encryption and other technology... or a customer service representative paid $10-15/hr, if that. Depending on how valuable the data is to you, it might be easier to just pay off a CSR, and then fake a phone call where you pretend to convince that CSR that you are that person. The person will get fired, but probably won't go to jail unless they can prove collusion. And then they can either find a new job, or depending on which country the person is living in, they can live nicely off of the money for a while. I'm not sure how to solve this problem, except by having highly paid and specially trained CSRs that do the account resetting, or by never allowing resetting ever, and if you forget your password and your security questions, you're SOL. I have to admit this only makes me more leery of putting anything on cloud storage, although my own personal data is pretty useless to anyone, which is my only saving grace. Others who are more important might need to think twice about relying on these types of services.
- veeti 14y agoMaybe this is a great reason to stick with Google's cloud services.
- wklauss 14y agoThe fact that this happens doesn't have to do with any particular brand. Every company, Google included, is susceptible to this kind of social engineering attacks. Nothing is 100% safe. You can take every precaution possible and there will always be a weak link in the chain. Apple will double down in security now, especially regarding iCloud, but even doing so there is a chance that this will happen again. Same for Microsoft, Sony and, yes, Google. There's no magic solution other than being careful. And even with that security is always an illusion. Your door lock is easily opened, no matter how much money you put in it, the only thing preventing you from being robbed is that are more houses in your neighbourhood and that some of those could seem like an easier target.
- 14y ago
- libria 14y agoAre they saying Apple sent the password reset request to a different backup email entirely? Or that they reset the password to a requested password while one the phone? Even if someone had properly identified themselves as Mat Honan, neither of these should be permitted.
- rogerchucker 14y agoMat posted a screenshot of his Gmail inbox which showed an email about Apple's password reset. So I'm guessing the hackers had compromised Gmail account BEFORE they called up Apple tech support. Or maybe that email was just an attempt and didn't help anyway with the actual password retrieval. I'm confused about this...
- maxerickson 14y agoThe original blog post makes it quite clear that the .mac account was used to compromise the Gmail account. I think the screenshot is from after he regained control of the Gmail account.
- rogerchucker 14y agoOh... in that case, how can a .mac account be used to compromise a Gmail account - using Forgot Password?
- maxerickson 14y agoYeah, one of the Gmail account recovery mechanisms is some process involving another email address.
- moreati 14y agoAIUI the .mac account was the backup email address of the Gmail account. So 1. The attacker compromised the .mac account. 2. The attacker used the I forgot my password feature of Gmail - to get an account reset email for the gmail account sent to the .mac account.
- yesimahuman 14y agoCreepy. Well, this book by Kevin Mitnick is still very relevant I guess: http://www.amazon.com/The-Art-Deception-Controlling-Security/dp/0471237124 http://www.amazon.com/The-Art-Deception-Controlling-Security...
- rogerchucker 14y agoEverybody should read the account of an opposite situation with Apple tech support and password retrieval: http://www.pcworld.com/businesscenter/article/260414/how_did_apple_allow_hackers_to_access_icloud_account.html http://www.pcworld.com/businesscenter/article/260414/how_did...
- wklauss 14y agoIts a good interesting piece but in this case could easily be that the employee in Mat's case didn't follow correct procedure or was not familiar with it (new employee?). Even if he knew the procedure for this cases there are all kinds of possible explanations: maybe the hacker pay him, maybe himself is the attacker, etc...
- rogerchucker 14y agoI totally agree that customer support is a very inconsistent department. I was just hoping Apple would have stringent training for these reps to all follow the strictest possible security checks. Who knows...
- tambourine_man 14y agoThe thought hadn't cross my mind, but after reading this post it got me thinking: Sensa So, let's get this straight...a hacker "decides" to hack the account of a semi-high profile tech guy and then after committing several serious crimes like fraud that could land him in jail for an extended period of time repeatedly contacts the person he hacked when he must know that Apple will surely pursue this matter? I smell a rat... http://forums.macrumors.com/showthread.php?p=15405091#post15405091 http://forums.macrumors.com/showthread.php?p=15405091#post15...
- mapgrep 14y agoWhat are you even alleging? What is the rat?
- tambourine_man 14y agoI'm not alleging, I'm quoting a comment from MacRumors that got my attention. The fact that a hacker would repeatedly contact its victim and that Gizmodo has reasons for not being particularly found of Apple (after the lost iPhone incident) was not something I had though of at first, but did strike me as odd.
- mapgrep 14y agoHonan no longer works at Gizmodo. It says so right in the OP, along with the name of his new employer. So... ?? You say that post "got you thinking." Got you thinking what?
- deleted 14y ago[deleted]
- jws 14y agoWe frequently see articles about well connected or influential people like reporters getting preferential support from large companies. This might be the dark side of special response.
- dennisgorelik 14y agoI wonder if attacker will be caught and would end up in jail. All password change requests like that must be carefully recorded and are probably very traceable. Considering public nature of this exploit, Apple might put quite some effort to carefully investigate the incident.
- elmuchoprez 14y agoThe kid who hacked Sarah Palin's email got a year in jail. He was convicted of "the felony of anticipatory obstruction of justice by destruction of records and a misdemeanor of unauthorized access to a computer." [wikipedia] The guy who hacked Honan is certainly guilty of the misdemeanor (which could wind you up in jail) and depending on what he erased and how they want to interpret his motives, he could be guilty of the same felony.
- greedo 14y agoSocial Engineering will usually win out as long as a person is in the loop. It's just not feasible to expect a poorly paid CSR to be able to cope with this type of threat. In the end, a company has to constantly weigh the cost of strong protections versus the risk, and what this exposure will cost them in terms of customer goodwill as well as any civil penalties that may arise.
- seagreen 14y agoCan iCould be enabled remotely? I know it shouldn't be able to, but could it?
- stephenhess 14y agoLarge amounts of personal data are collected by data brokers like Intelius, Spokeo and Whitepages - which makes this easier to pull off. It's fairly trivial to find answers to questions like "What's your DOB?" or "What's your billing address" by looking in one of these places. Most data brokers will have opt-out pages where you can request removal of your data - though they don't make it easy. There are also services that help with this: MyPrivacy (reputation.com/myprivacy) which I work on and Safe Shepherd (safesheperd.com).
- MarkMc 14y agoWhy isn't this part of every password-reset procedure? "We'll mail a reset code to the postal address you gave when you created your account" This would mean that the attacker would have to commit mail fraud, which (a) is quite difficult; and (b) carries heavy penalties in law.
- ghshephard 14y agoOne problem is I have no idea what physical address Apple has for me, but I'm sure I have moved at least three times (as many as five) since I gave them that address. A better solution is require a notarized physical mail in the event of password changes for high-security accounts. Everything else just goes to your email account.
- petitmiam 14y agoI had this problem with a website from the Australian Government. I was actually trying to login to update my address, but I didn't know the password. For that though, I was able to visit a store front and update it after providing ID. I guess Apple could do a similar thing.
- MarkMc 14y agoApple already prompts me to agree to new terms and conditions every few months. Surely it wouldn't be too difficult to add '...and is this still your address?'
- dinkumthinkum 14y agoBecause it's very inconvenient. I'm not judging, just answering. :)
- Zenst 14y agoIn all fairness to Apple and any support desk, it ain’t hard to bypass a control system were one human talks to another exchanging information that is mostly in the public domain or bypassed using emotional based social engineering (sounding as if in a panic and your mother is in hospital for example). Support is human. I helped a friend set-up a account with some provider the other day and one of the security question was the classic choice of mothers maiden name, favourite colour or favourite number. All of which are hardly secure as they can be obtained or educated-guessed a lot easier than most, but that’s another discussion. He wanted his favourite football player's name, so I told him pick mothers maiden name and use your favourite football players name. He knows this, and even if somebody who knew his mothers maiden name would still fail on that security check. What could Apple do; And they will do something I suspect. Well they could add voice recognition to there support call system or/and add preregister calling numbers only (excluding device phone numbers already to cover losing said device) like your office phone. But they will step up-to the plate and hopefully turn this around, any good tech company will do that (even if it is going oops and we added password salts now - they evolve). The whole aspect about all this that concerned me was how you can have what you perceive as a cloud backup that can then be taken away as well as your copy of the data. That is a lesson for the user more than Apple though. But will be reassuring to find out they have a backup system and maybe also concerning. That is a individuals perception of thought for them to ascertain for themselves, everybody is different. I might also add that the chap who initial got hacked and subsequently also had his twitter accounts hacked said in a tweet that he is leaving the hacked tweets in the same way he does not go about removing scars on his body. Shows a insightful mindset and in many ways shows that pride was not a part of this and in that we would probably not of read about this had he been burdened by pride. Respect has to be noted there for him stepping up and going, this happened before he found out how it had been done and without knowing it was not an act of his own doing.
- emergencynap 14y agoOne of the main issues with the Apple ID is the ease of use vs security. Tying the remote wipe functionality with the ability to purchase low cost content (the primary use case for the Apple ID) is always going to have one group of users unhappy. I frequently want to quickly purchase a song on my iPhone. I also, frequently tell my friends my password so they can do the same. How many of you have typed your Apple ID password on your Apple TV with others watching? I wouldn't really ask my friends to exit the room to type in a super secure and long password with many characters groups (one that should be required for remote wipe functionality). How many users keep their password secure knowing the main place they enter it is on their iOS device? For the many every day Apple users I know, they set their passwords to something easy so they don't have to hit their keyboard too many times when entering them. If Apple, can separate the two authentication functions as they do with OS X and FileVault it would go a long way to preventing these types of rare but high impact events. Another suggestion would be to separate the remote wipe into two phases, erasing the keys and cleaning up the data. The initialization vectors (seed) do present a bit of a problem but I think the FileVault solution is more than adequate. If the encryption keys and the key escrow system is cleared remotely, that would leave me comfortable that my data is still secure. If we really trust our crypto algorithms, then erasing data and removing the encryption keys should really be no different. Users that do not have iOS data protection and OS X FileVault turned on, cannot be considered any level of secure anyway. And even with that data protection turned on, there are still many issues due to each app needing to implement security properly. It would be really great to see Apple improve their App Store to really audit the security of each application more than they do today. Most of the work lies with Apple but it is a hard problem that will take time. I think Apple is going in the right direction by centralizing on iCloud rather than the PC as the central hub. This will give them a lot more flexibility and agility to move quicker and deliver secure results to the masses.
- wd7 14y agoAbsolutely. Forcing users to input their password each time they buy something from iTunes, or log into iCloud in the browsers, encourages simpler passwords. To have a single account in control of everything from buying a $1 song to remote-wiping a computer is madness.
- jsmcallister 14y agoHopefully the article on Honan's experience will open some eyes and make everyone take the security of their personal accounts more seriously. The money in your bank is insured, your online presence is not, and there is a huge imbalance in how consumers address security for each. Some hackers don't want money or notoriety - they just want to watch the world burn.
- baldfat 14y agoSarah Palin Hack was basically the same. People don't figure what is available online gives the answers to their questions.
- epo 14y agoI don't believe that things happened as they are being presented. This is (ex-)Gizmodo we're talking about, people who have a long standing grudge with Apple. In the middle of a 'major crisis' this guy finds time to type up a story, on a computer? He can still access work machines to submit? And then the hacker is kind enough to tell him what happened? And oddly, there is no mention of involving the police or the FBI? This episode is either an inside job or a complete fabrication. My prediction is it will fall apart within the week, rather like Gizmodo's exclusive story based on the purchase of stolen prototype equipment.