5 ms·

I'll confess, I honestly didn't even consider the possibility that the hacker just social-engineered Apple support. I mean, Mitnick wrote an entire book about t

I'll confess, I honestly didn't even consider the possibility that the hacker just social-engineered Apple support. I mean, Mitnick wrote an entire book about that kind of stuff, and the whole HBGary thing went down in sort of the same way, but ... still, to be able to call up the support department of a major technology (!) company, in 2012, pretending to be someone else and get access to their account that way? Apple didn't send a text message to his number-on-file? They didn't try a callback? Were there any challenge-response questions at all? That's absurd. This should make every iCloud user reeeeeaally nervous.

Tloewald 14y ago
On the positive side, perhaps the publicity will cause Apple to tighten up. They have demonstrated that they are serious about security.
- tomflack 14y ago
  Have they? (Honest question.)
  - uxp 14y ago
    I would argue that yes, they have. They removed the copy on their website that claimed that "Macs don't get PC Viruses"[1]. They disabled automatic execution of Java Applets in response to Flashback[2]. The introduction of Gatekeeper and the App Store model shows their intention for reducing the vectors average users can install random software (which reduces rogue installations like Flashback). ASLR is fully implemented in Lion now, and the inclusion of FileVault 2 suggests they are aware of and trying to mitigate offline attacks[3] Regardless if you think this is enough, it does show that they are doing something. For every couple steps forward in closing a security issue, issues such as this article show that more could be done. Security is hard, no OS or company will ever be Perfectly Secure(tm). Apple is not "doing nothing". Claiming that they aren't is an uneducated answer, claiming that they could do more and be more transparent about it is a more valid argument. [1] http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ [2] http://support.apple.com/kb/HT5242 http://support.apple.com/kb/HT5242 [3] http://www.securitynewsdaily.com/960-apple-mac-osx-lion-security.html http://www.securitynewsdaily.com/960-apple-mac-osx-lion-secu...
    - sidewalksuper 14y ago
      I would also argue that with iOS, they have the safest (big) mobile OS available as well. ASLR and DEP have long been implemented and with iOS 6 they are also implementing Kernel ASLR. Almost everything is sandboxed and there are no known viruses out there (for devices that haven't been jailbroken). Jailbreaks are still possible (like you said nothing is perfectly secure), but have been slowed down to a point where hackers wait for a big OS release, before they decide to burn the exploits.
- reinhardt 14y ago
  I don't know, I have mixed feelings about this. It's akin to building even more inscrutable captchas or tightening up airport security measures every time a new breach happens. At best it might close one particular loop hole but at what cost and incovenience to millions of people and billions of transactions? I had the misfortune to lock myself out of my bank account once or twice and the process for unlocking it was so dreadful (a 30 minutes interrogation with questions like "when and where did I make my last ATM transaction") that since then I keep the required sensitive info in a GPG encrypted file so that I never have to call them again. Other equally frustrated but less tech savvy customers are probably doing the same with post-it notes. Is this an improvement?
  - omgbear 14y ago
    Sure - you need physical access to get to someone's post-its. Might as well install a keylogger then.
  - orbitingpluto 14y ago
    I was out of town and went to make a large cash purchase. (The retailer added a very hefty 10% for using debit or credit cards.) So I ran into the problem of a daily cash withdrawal at the ATM. I also did not have anything with me other than an ATM card and a Credit card with me (No ID). Turned out the bank didn't even ask for my ID when I went in. I just explained my situation and they just handed over a couple thousand... Security at the bank seems discretionary at best.
    - rogerbinns 14y ago
      > Security at the bank seems discretionary at best No, it is a cost benefit decision. Do you know they don't check the signature on cheques or credit card transactions? Heck I bet if you mail in a change of address they will go ahead and do it, possibly sending something to your old address. The reality is that fraud is at low levels compared to legitimate transactions. Putting in lots of extra hoops just makes the legitimate transactions harder, and chances are it won't affect those trying to commit fraud since they have a wide variety of things to try while tellers don't (eg fake id in this case). In this specific case, anyone coming into the branch is on security cameras inside and out. TV shows, the Internet and technology make it increasingly easier to match up the footage with real people. And the bank doesn't bear the full costs of any investigation since they are passed off to the police/FBI. If you ran the bank would you add a dollar in expenses and one minute per transaction that has a 10% chance of catching fraud, and fraud occurs one in every 25,000 transactions? Would you have the same measures in every branch across the country or have their expense and severity proportional to the amount of fraud that does actually happen at any location? Despite what we see in films and TV shows, bank robbery is pitiful way to not make money: http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbing-Banks-Really-Doesnt-Pay.aspx http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbin... http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-stats-show-lu.html/ http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-sta...
- encoderer 14y ago
  I have no idea if this is related, but just now I attempted to purchase an app on the Mac AppStore and, after authenticating, I was given a prompt to re-enter my password and: Improve Apple ID Security - To help ensure the security of your Apple ID, choose three security questions and answers. Just random because I don't have challenge responses on record, or immediate low-hanging fruit in response to this breach?
  - _djo_ 14y ago
    Probably just a result of having no challenge responses on record. I experienced something similar a couple of months ago.
ams6110 14y ago
This should make every user of every online service really nervous. It sort of makes the Google/Facebook model of "it's impossible to actually talk to a human" look good.
- tuxidomasx 14y ago
  Indeed, but even companies who don't offer a phone-based customer support service can be susceptible to basic social engineering. When Facebook was still granting new users access by checking that their email matched a school's domain, I was able to make accounts at multiple schools by sending a forged email (claiming to originate from the school domain) to Facebook support saying something like: "I never received the confirmation email. Will you please activate my account at fakename@targetschool.edu?" And it worked 90% of the time. I wonder how many websites nowadays would be susceptible to a targeted and personalized forged email to customer service (especially since emails are frequently used to prove account ownership).
  - fullfilldreams 14y ago
    Journalist blames Apple tech for allowing iCloud hack and for more details you can go here: http://goo.gl/Gi4B1 http://goo.gl/Gi4B1
- sigkill 14y ago
  You know, as much as I laughed at your comment I think you have a point here. The long times it takes for them to even answer a mail (if at all) would probably give a heads-up to anything fishy going on in your account. Secondly, unless your account is actually worth the wait, they would probably try to attack an easier target instead of Google or Facebook.
  - caller9 14y ago
    Security through support obscurity?
    - ralfn 14y ago
hexagonal 14y ago
"Humans are the security hole that can never be patched." Social engineering will always work.
- ansgri 14y ago
  There was an article about HFT recently [0] that mentioned a case where social influence is of small importance: the game is played beyond human capabilities even when really needed. [0] http://news.ycombinator.com/item?id=4339531 http://news.ycombinator.com/item?id=4339531
guylhem 14y ago
Never considered? Try to call them someday if you forget your passwords, you'll see how easy it is. My solution at the moment is to remove every passwords from icloud. There're some nice scripts online - just did that and blogged about it on http://en.blog.guylhem.net/post/28778777551/icloud-remove-keychain-passwords http://en.blog.guylhem.net/post/28778777551/icloud-remove-ke... It's obvious it can't be trusted until 2-way auth is implemented. hell - if I manage to forget my password and loose my cellphones and homephone numbers, I WANT my icloud data to be gone for good!
ghshephard 14y ago
A good social engineering attack knows more about me than I do. They know my first pet, my mother's maiden name, and where all my banking records are. Lots of ways of getting that. Notice - the call was because the guys _phone_ was inoperable. A call back could go to a burner, and Apple would be none the wiser. Very few, if any, defenses against social engineering, other than (A) Not allowing it, or (B) Requiring a Notarized-registered-letter of identification to start the process. I'm a fan of using Notaries for password resets. Particularly to my email account, as it's the most valuable thing I own. Double-notarize in the event of two-factor resets. Make it a HUGE burden. Lock me out of email for a week or two if required, but don't give anyone access to my email.
niels_olson 14y ago
My father-in-law told me yesterday about a novel he's reading. The thief wanted to test the target's security system, so he threw clods of dirt over the fence until security came out and investigated. For a week. Then he threw cats over (good luck finding a pissed off cat in the middle of the night). Then they declared the alarm dysfunctional and posted a sign in the security shack: until further notice, disregard alarms between 0300 and 0500. Makes you wonder if offering accessible customer service, at scale, eventually it's not even the guy on the phone that's the problem. The policy person cries uncle.
- TwoBit 14y ago
  People have been doing this for years to steal cars. Set off its alarm every night till the owner disables it.
nikcub 14y ago
> Apple didn't send a text message to his number-on-file? "Sir, we are just going to need to send an SMS to your phone number" "Ok which number is that.. " "it is the 065 488 48.." "..that is my old work phone, which I no longer have access to" Works all the time. The tip with social engineering is to ask for a little at a time. You don't call up and say "I don't have my phone, email, password, and nor do I know my mothers maiden name.. please let me into my account" You take it all a step at a time and give it a narrative, just like a real user in the predicament would (and I have been in the predicament and called Apple). Works almost every time.

Tloewald 14y ago

On the positive side, perhaps the publicity will cause Apple to tighten up. They have demonstrated that they are serious about security.

tomflack 14y ago
Have they? (Honest question.)
- uxp 14y ago
  I would argue that yes, they have. They removed the copy on their website that claimed that "Macs don't get PC Viruses"[1]. They disabled automatic execution of Java Applets in response to Flashback[2]. The introduction of Gatekeeper and the App Store model shows their intention for reducing the vectors average users can install random software (which reduces rogue installations like Flashback). ASLR is fully implemented in Lion now, and the inclusion of FileVault 2 suggests they are aware of and trying to mitigate offline attacks[3] Regardless if you think this is enough, it does show that they are doing something. For every couple steps forward in closing a security issue, issues such as this article show that more could be done. Security is hard, no OS or company will ever be Perfectly Secure(tm). Apple is not "doing nothing". Claiming that they aren't is an uneducated answer, claiming that they could do more and be more transparent about it is a more valid argument. [1] http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ [2] http://support.apple.com/kb/HT5242 http://support.apple.com/kb/HT5242 [3] http://www.securitynewsdaily.com/960-apple-mac-osx-lion-security.html http://www.securitynewsdaily.com/960-apple-mac-osx-lion-secu...
  - sidewalksuper 14y ago
    I would also argue that with iOS, they have the safest (big) mobile OS available as well. ASLR and DEP have long been implemented and with iOS 6 they are also implementing Kernel ASLR. Almost everything is sandboxed and there are no known viruses out there (for devices that haven't been jailbroken). Jailbreaks are still possible (like you said nothing is perfectly secure), but have been slowed down to a point where hackers wait for a big OS release, before they decide to burn the exploits.
reinhardt 14y ago
I don't know, I have mixed feelings about this. It's akin to building even more inscrutable captchas or tightening up airport security measures every time a new breach happens. At best it might close one particular loop hole but at what cost and incovenience to millions of people and billions of transactions? I had the misfortune to lock myself out of my bank account once or twice and the process for unlocking it was so dreadful (a 30 minutes interrogation with questions like "when and where did I make my last ATM transaction") that since then I keep the required sensitive info in a GPG encrypted file so that I never have to call them again. Other equally frustrated but less tech savvy customers are probably doing the same with post-it notes. Is this an improvement?
- omgbear 14y ago
  Sure - you need physical access to get to someone's post-its. Might as well install a keylogger then.
- orbitingpluto 14y ago
  I was out of town and went to make a large cash purchase. (The retailer added a very hefty 10% for using debit or credit cards.) So I ran into the problem of a daily cash withdrawal at the ATM. I also did not have anything with me other than an ATM card and a Credit card with me (No ID). Turned out the bank didn't even ask for my ID when I went in. I just explained my situation and they just handed over a couple thousand... Security at the bank seems discretionary at best.
  - rogerbinns 14y ago
    > Security at the bank seems discretionary at best No, it is a cost benefit decision. Do you know they don't check the signature on cheques or credit card transactions? Heck I bet if you mail in a change of address they will go ahead and do it, possibly sending something to your old address. The reality is that fraud is at low levels compared to legitimate transactions. Putting in lots of extra hoops just makes the legitimate transactions harder, and chances are it won't affect those trying to commit fraud since they have a wide variety of things to try while tellers don't (eg fake id in this case). In this specific case, anyone coming into the branch is on security cameras inside and out. TV shows, the Internet and technology make it increasingly easier to match up the footage with real people. And the bank doesn't bear the full costs of any investigation since they are passed off to the police/FBI. If you ran the bank would you add a dollar in expenses and one minute per transaction that has a 10% chance of catching fraud, and fraud occurs one in every 25,000 transactions? Would you have the same measures in every branch across the country or have their expense and severity proportional to the amount of fraud that does actually happen at any location? Despite what we see in films and TV shows, bank robbery is pitiful way to not make money: http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbing-Banks-Really-Doesnt-Pay.aspx http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbin... http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-stats-show-lu.html/ http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-sta...
encoderer 14y ago
I have no idea if this is related, but just now I attempted to purchase an app on the Mac AppStore and, after authenticating, I was given a prompt to re-enter my password and: Improve Apple ID Security - To help ensure the security of your Apple ID, choose three security questions and answers. Just random because I don't have challenge responses on record, or immediate low-hanging fruit in response to this breach?
- _djo_ 14y ago
  Probably just a result of having no challenge responses on record. I experienced something similar a couple of months ago.

ams6110 14y ago

This should make every user of every online service really nervous. It sort of makes the Google/Facebook model of "it's impossible to actually talk to a human" look good.

tuxidomasx 14y ago
Indeed, but even companies who don't offer a phone-based customer support service can be susceptible to basic social engineering. When Facebook was still granting new users access by checking that their email matched a school's domain, I was able to make accounts at multiple schools by sending a forged email (claiming to originate from the school domain) to Facebook support saying something like: "I never received the confirmation email. Will you please activate my account at fakename@targetschool.edu?" And it worked 90% of the time. I wonder how many websites nowadays would be susceptible to a targeted and personalized forged email to customer service (especially since emails are frequently used to prove account ownership).
- fullfilldreams 14y ago
  Journalist blames Apple tech for allowing iCloud hack and for more details you can go here: http://goo.gl/Gi4B1 http://goo.gl/Gi4B1
sigkill 14y ago
You know, as much as I laughed at your comment I think you have a point here. The long times it takes for them to even answer a mail (if at all) would probably give a heads-up to anything fishy going on in your account. Secondly, unless your account is actually worth the wait, they would probably try to attack an easier target instead of Google or Facebook.
- caller9 14y ago
  Security through support obscurity?
  - ralfn 14y ago

hexagonal 14y ago

"Humans are the security hole that can never be patched." Social engineering will always work.

ansgri 14y ago
There was an article about HFT recently [0] that mentioned a case where social influence is of small importance: the game is played beyond human capabilities even when really needed. [0] http://news.ycombinator.com/item?id=4339531 http://news.ycombinator.com/item?id=4339531

guylhem 14y ago

Never considered? Try to call them someday if you forget your passwords, you'll see how easy it is. My solution at the moment is to remove every passwords from icloud. There're some nice scripts online - just did that and blogged about it on http://en.blog.guylhem.net/post/28778777551/icloud-remove-keychain-passwords http://en.blog.guylhem.net/post/28778777551/icloud-remove-ke... It's obvious it can't be trusted until 2-way auth is implemented. hell - if I manage to forget my password and loose my cellphones and homephone numbers, I WANT my icloud data to be gone for good!

ghshephard 14y ago

A good social engineering attack knows more about me than I do. They know my first pet, my mother's maiden name, and where all my banking records are. Lots of ways of getting that. Notice - the call was because the guys _phone_ was inoperable. A call back could go to a burner, and Apple would be none the wiser. Very few, if any, defenses against social engineering, other than (A) Not allowing it, or (B) Requiring a Notarized-registered-letter of identification to start the process. I'm a fan of using Notaries for password resets. Particularly to my email account, as it's the most valuable thing I own. Double-notarize in the event of two-factor resets. Make it a HUGE burden. Lock me out of email for a week or two if required, but don't give anyone access to my email.

niels_olson 14y ago

My father-in-law told me yesterday about a novel he's reading. The thief wanted to test the target's security system, so he threw clods of dirt over the fence until security came out and investigated. For a week. Then he threw cats over (good luck finding a pissed off cat in the middle of the night). Then they declared the alarm dysfunctional and posted a sign in the security shack: until further notice, disregard alarms between 0300 and 0500. Makes you wonder if offering accessible customer service, at scale, eventually it's not even the guy on the phone that's the problem. The policy person cries uncle.

TwoBit 14y ago
People have been doing this for years to steal cars. Set off its alarm every night till the owner disables it.

nikcub 14y ago

> Apple didn't send a text message to his number-on-file? "Sir, we are just going to need to send an SMS to your phone number" "Ok which number is that.. " "it is the 065 488 48.." "..that is my old work phone, which I no longer have access to" Works all the time. The tip with social engineering is to ask for a little at a time. You don't call up and say "I don't have my phone, email, password, and nor do I know my mothers maiden name.. please let me into my account" You take it all a step at a time and give it a narrative, just like a real user in the predicament would (and I have been in the predicament and called Apple). Works almost every time.