10 ms·
It seems logical that the easiest attack vector for any type of cloud storage is through social engineering. You're essentially protecting potentially valuable
by steve8918 14y ago
It seems logical that the easiest attack vector for any type of cloud storage is through social engineering. You're essentially protecting potentially valuable or incriminating data behind millions of dollars worth of firewalls, encryption and other technology... or a customer service representative paid $10-15/hr, if that.
Depending on how valuable the data is to you, it might be easier to just pay off a CSR, and then fake a phone call where you pretend to convince that CSR that you are that person. The person will get fired, but probably won't go to jail unless they can prove collusion. And then they can either find a new job, or depending on which country the person is living in, they can live nicely off of the money for a while.
I'm not sure how to solve this problem, except by having highly paid and specially trained CSRs that do the account resetting, or by never allowing resetting ever, and if you forget your password and your security questions, you're SOL.
I have to admit this only makes me more leery of putting anything on cloud storage, although my own personal data is pretty useless to anyone, which is my only saving grace. Others who are more important might need to think twice about relying on these types of services.
- veeti 14y agoMaybe this is a great reason to stick with Google's cloud services.
- wklauss 14y agoThe fact that this happens doesn't have to do with any particular brand. Every company, Google included, is susceptible to this kind of social engineering attacks. Nothing is 100% safe. You can take every precaution possible and there will always be a weak link in the chain. Apple will double down in security now, especially regarding iCloud, but even doing so there is a chance that this will happen again. Same for Microsoft, Sony and, yes, Google. There's no magic solution other than being careful. And even with that security is always an illusion. Your door lock is easily opened, no matter how much money you put in it, the only thing preventing you from being robbed is that are more houses in your neighbourhood and that some of those could seem like an easier target.
- cwisecarver 14y agoIf I got veeti's joke then I think what he was trying to say was that it's nearly impossible to get Google on the phone unless you're a corporate customer. If I didn't get his joke then I'm making it now. joke
- wklauss 14y agojoke's on me then :) But back to my point social engineering doesn't require voice. you can do it via email just as easily.
- chmars 14y agoAgain there is no Google mail support to speak of (even with Google Apps for Business in my experience).
- ThePherocity 14y agoSure there is. if you pay for your Google Apps account: http://support.google.com/a/bin/request.py http://support.google.com/a/bin/request.py
- chmars 14y agoThat's why I mentioned Google Apps for Business, that's the paid service you are referring too. There's support but it's still very difficult to get in contact with an actual human being. Social engineering via Google Apps support seems therefore highly unlikely to me. (I am a Google Apps for Business user and have had to contact Google Apps support a few times … the process has never been really pleasant.)
- swdunlop 14y agoIt was the first thing I thought. "Hah! Good luck getting Google to answer a phone.." Then I thought, "wait, was that a joke?"
- 14y ago
- yen223 14y agoI once had to reset the password of my stock trading account. All they needed for verification was my home address. I am also pretty leery of putting anything online.
- dennisgorelik 14y agoDidn't they call you back to your phone number prior to resetting your password?
- rogerchucker 14y agoThis _could_ be a lesson in not trusting cloud services where issues can be resolved by human intermediaries. Sounds a bit counter-intuitive but to me a bit more reassuring. But I could be wrong.
- libria 14y agoPerhaps what they need here is an optional 24-hour password reset delay. A user could only adjust this setting when properly logged in. Even if Apple gets social engineered, the user has 24 hours to notice the difference. Although it's extremely inconvenient to wait 1 full day to get back in, forgetting a password should be a rare circumstance .
- ralfn 14y agoNo. They just need to implement one of the common protocols. For example, they could just require ID.
- wallawe 14y agoIf you are willing to take the time to social engineer a CSR to get a password, you are likely willing to take the time to acquire a fake ID. They aren't hard to come by.
- ceol 14y agoThey still require additional effort. Right now, in my pajamas, without leaving my house or spending money, I can do exactly what that hacker did. I probably wouldn't even try it if I knew I would have to get a fake ID just to punish some Gizmodo employee for shits.
- ralfn 14y agoBesides: banks videotape their customers. We would have the culprit on video.
- ralfn 14y agoThe security of an ID is protected by the state. Screwing around with that is a federal, put your ass in prison, kind of breach, irregardless of your intention or the context.
- 14y ago
- ThePherocity 14y agoWhoa, wait, what? What occured was a simple confidence hack, not some industrial spy escapade. Anyway, to answer your initial point, two factor authentication helps with this problem, as you have to still have the security token to authenticate. And if the "Something you have" gets stolen, then you need a manager to work through it to get you set up again, and all resets are heavily monitored and audited.
- steve8918 14y agoMy point wasn't that this particular incident was some great case of industrial espionage. But it's a rather easy slippery slope to that outcome. But what if your website is secured behind an Amazon EC2 or Linode CSR? Isn't Instagram and Netflix run at least in part on EC2? I have no clue what the security schemes are for either of those service providers, but if they allow CSRs to change passwords, then it's the same thing. If the CSRs can be paid off, or fooled over a phone call, then it might be cheaper to just do that if they want to inflict potentially millions of dollars worth of damage to a rival. Having the security of your entire business behind a single CSR or a cell phone is the equivalent of millions of dollars worth of Cisco firewalls being outdone by a $20 wifi-router plugged into the internal network.
- ThePherocity 14y agoYea, that's all protected by multifactor authentication. Front line CSR's don't need a raise over this. Maybe they have other reasons, sure. But not this.
- thaumaturgy 14y agoI'll confess, I honestly didn't even consider the possibility that the hacker just social-engineered Apple support. I mean, Mitnick wrote an entire book about that kind of stuff, and the whole HBGary thing went down in sort of the same way, but ... still, to be able to call up the support department of a major technology (!) company, in 2012, pretending to be someone else and get access to their account that way? Apple didn't send a text message to his number-on-file? They didn't try a callback? Were there any challenge-response questions at all? That's absurd. This should make every iCloud user reeeeeaally nervous.
- Tloewald 14y agoOn the positive side, perhaps the publicity will cause Apple to tighten up. They have demonstrated that they are serious about security.
- tomflack 14y agoHave they? (Honest question.)
- uxp 14y agoI would argue that yes, they have. They removed the copy on their website that claimed that "Macs don't get PC Viruses"[1]. They disabled automatic execution of Java Applets in response to Flashback[2]. The introduction of Gatekeeper and the App Store model shows their intention for reducing the vectors average users can install random software (which reduces rogue installations like Flashback). ASLR is fully implemented in Lion now, and the inclusion of FileVault 2 suggests they are aware of and trying to mitigate offline attacks[3] Regardless if you think this is enough, it does show that they are doing something. For every couple steps forward in closing a security issue, issues such as this article show that more could be done. Security is hard, no OS or company will ever be Perfectly Secure(tm). Apple is not "doing nothing". Claiming that they aren't is an uneducated answer, claiming that they could do more and be more transparent about it is a more valid argument. [1] http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ [2] http://support.apple.com/kb/HT5242 http://support.apple.com/kb/HT5242 [3] http://www.securitynewsdaily.com/960-apple-mac-osx-lion-security.html http://www.securitynewsdaily.com/960-apple-mac-osx-lion-secu...
- moe 14y agoI'm not sure how to solve this problem It's easily solved, banks and other institutions have been doing it for years. The solution is trivial, too: Require physical ID. In order to open a bank account you have to either show up in person, or provide equivalent proof (e.g. PostIdent). Why should it be different with cloud-services whose stated goal is to silo all your life's data? Why are they excused on lax security?
- wklauss 14y agoPhysical IDs can be faked.
- viraptor 14y agoIsn't that an area that cannot be controlled at all? There are government issued IDs and if a normal company cannot trust them, then there's no way out. Biometric identification can be the last unbreakable protection, but that's also only valid until you find someone who, for example, lost/damaged his eyes in an accident and is up for scamming the company you're targeting. I mean, there's a reasonable limit of what companies may want to check, but once those proofs can be faked, it's not their responsibility to fix the issue anymore. (PS. some countries have more restrictions than others too - for example in Poland you need two IDs with a photo to get any kind of mobile plan on a contract - that leaves plenty of ways to verify your identity)
- elmuchoprez 14y agoIt's a question of how closely the ID can be inspected for accuracy. When I go to the store and buy beer, they want to see my license. They always make me take it out, which means the clerk can feel it, and the "feel" will often give away a fake to someone who has handled thousands of legit IDs. Next, they look at the pic on the ID and then look at me to make sure they at least kinda match. Nobody is really holding them up for a side-by-side, but you at least kind of have to look like the guy on the ID, which immediately limits the pool of people who could be faking my identity. Then, assuming it feels right and looks like me, they scan the ID and verify a record of that ID card with the state, which simply confirms that the state issued such an ID. Between those three things, the system is actually pretty secure. But when you ask someone to scan in and email a copy of the front of their license as proof of ID, all three of those "checks" are eliminated.
- loceng 14y agoDidn't everyone learn this lesson from Hackers?
- atirip 14y ago"I'm not sure how to solve this problem" Easy. CSR has exactly the same screen as you do. With the same security questions as you have. In this case it seems, those questions were never asked. You design CSR frontend where they must themselves answer those questions before proceed. You may pay off that CSR, but she/he does not know answers to those questions so she/he can not do a thing. If you forgot answer to those questions, alert is escalated, which needs two together CSR's + their supervisor to unlock your account + you must make Facetime call + whole process gets documented carefully. What did I miss?
- ChuckMcM 14y agoThat is an interesting approach. Given the retail presence Apple has the opportunity to ask you to go to an Apple store in person and talk with service personnel there. One could easily put a picture on file (every Apple device has a camera now) of the owner, and the two bits of information: 1) You have the device with you 2) You are the same person as the picture of the owner Would set a reasonably high bar to cross.
- teach 14y agoI suspect there are a LOT of places in the United States that are a few hours' drive from the closest Apple store.
- draebek 14y agoI agree, I bet there are a ton of Apple users for whom going to an Apple store could be a real pain. However, they could make it an optional account security feature. (Then they just have to handle "you got hacked? Well, that's your fault for turning down our free enhanced security feature!")
- switch007 14y agoHR can screen for people that have been bankrupt, and (probably a lot trickier) personalities that might be susceptible to taking bribes.
- dinkumthinkum 14y agoTake two people, one went bankrupt 10 times, one never, both make minimum wage. Offer them a $10 million dollar bribe. Is one really less likely to be bribed than the other?
- switch007 14y agoI didn't mean to imply it was a good method but rather make the point that HR are actually doing this.
- maxerickson 14y agoSo people protecting $11 million probably shouldn't use such a weak check. What about people protecting $500?
- fossuser 14y agoThis entire thing reminds me of the mud puddle test. (http://blog.cryptographyengineering.com/2012/04/icloud-who-holds-key.html http://blog.cryptographyengineering.com/2012/04/icloud-who-h...) In fact that entire blog post is pretty on point.