11 ms·

Apple hit by hackers who targeted Facebook last week

83 points by derpenxyne 14y ago

mtgx 14y ago
How do they know it's the same hackers? If they are only assuming they should state so.
- dguido 14y ago
  Shared infrastructure, use of same non-public backdoor, same tactics taken once on the box, same watering hole used, hop point includes connections from both Facebook and Apple... Come on man. Read the Mandiant report on APT1 if you want to get schooled on how to tie groups of hackers together over different campaigns.
cooldeal 14y ago
>only a small number of its employees' Macintosh computers were breached, but "there was no evidence that any data left Apple." Looks like Apple is worried more about leaks of their unreleased products. I would be more worried about data entering Apple, whether any websites were injected with malware or, in a much more unlikely scenario, malicious code being in injected into OS code or apps.
- 0x0 14y ago
  It's pretty scary to imagine what a bad guy could do with backdoor access to the iCloud or iMessage services, too. Remote control and wipe any iOS or mac device, steal device backups, intercept txts...
- deleted 14y ago
  [deleted]
recoiledsnake 14y ago
Looks like the "Write Once, Run Anywhere" Java mantra is true for malware too. Pretty much any run-of-the-mill Windows PC, Mac or Linux machine is vulnerable to this. http://en.wikipedia.org/wiki/Write_once,_run_anywhere http://en.wikipedia.org/wiki/Write_once,_run_anywhere
- nivla 14y ago
  This is true of any cross platform language, the job of making the exploit work across different OS gets efficiently transferred to the compiler. One of the main reasons I am worried if webkit becomes monolithic, zero day exploits, there will be no running away from it.
  - eksith 14y ago
    It's not the language so much the isolation in the VM. Normally, there would be safegards against privilege escalation (since remote code execution is a feature, not a bug). This is just a factor of Oracle not paying attention to a product they bought. When Cisco let Linksys (in the consumer market) stagnate, we ended up with lackluster hardware. Not a big deal. When Oracle ignored Java in the consumer market, the damage is quite a bit more extensive due to its sheer ubiquity.
    - chc 14y ago
      You're talking about something different than nivia was. That comment was in reference to "write once, run anywhere" meaning that malware became cross-platform. A malicious Python app can do malicious things on any platform with Python just like a malicious Java app can do bad things anywhere you have Java. The fact that this is exploitable through a browser plugin makes the risk of infection worse, but doesn't actually make it more cross-platform, per se.
      - eksith 14y ago
        Yes but Python also isn't generally distributed the same way. You could argue the same about the C++ redistributable across Windows and even .Net (I think 4.0 runs on XP), but malware for these are still executables. Silverlight may be the only common ground, but then that's the same as Flash, Acrobat or similar plugin. And as you say it certainly doesn't run in the browser on so many disparate systems making watering hole attacks not nearly as damaging if there were to be Python malware in the wild (and I'm sure there are).
  - 14y ago
0x0 14y ago
Which web site was compromised? Several reports point to "a website for mobile software developers" as "the waterhole". Is it the apple ios dev center? The android sdk site? HN? I'd be very interested in knowing if myself or coworkers may have been exposed (or in the best case, which waterhole website I've been missing out on)
- jmsduran 14y ago
  I'm very curious too, I wonder why this "waterhole" has not been publicly revealed yet? It would make it easier for others to identify whether they were exposed, and take the necessary actions to secure their workstations.
  - dguido 14y ago
    If you are running Java in your browser, you were exposed. There, done. The internet is a nasty place, get used it.
    - 0x0 14y ago
      So let's say I'm not except when I'm forced to use Safari for some pages in the iOS dev center?
    - martinced 14y ago
      If you are running Java, Flash, most PDF readers, using any browser which doesn't update automatically, you are exposed. Not "were". Even browser updating automatically aren't a panacea: the update itself may be corrupted by an exploit (now that would be a fiasco). That is precisely the reason people should surf from a separate user account, using very strict firewalling rules. "iptables -I OUTPUT -p tcp --dport 80 (and 443) -m state --state NEW -m user --user-id 501 -j ACCEPT" Now it's too bad per-user firewalling cannot be done easily on neither Windows nor OS X. It's also too bad one user (say the one allowed to surf the Web) cannot display its browser window(s) in another user (say your main account)'s graphical display (neither on Windows nor on OS X). Or too bad OS X doesn't allow to run two graphical sessions simultaneously (on some version of Windows, if you pay enough, at least you can do that). All this is trivial to do under Linux. I'm feeling better and better using Linux as my desktop.
corresation 14y ago
I find this a bit concerning not because Apple was hit, but because getting hit by some Java-malware necessitates a public statement. Anyone here in an organization of more than about 10 users likely has one or more of them with malware of some sort on their device right now, and it is treated as just the cost of the platform. In my organization I'm sort of the paranoid in that I treat every exposure as a serious event, but I am very much alone on that.
- lawnchair_larry 14y ago
  Unless they can prove (to themselves) that no customer data could have been obtained, they have to disclose this due to laws in several states, including California. Aside from that, I believe it is ambiguous as to whether or not publicly traded companies have to disclose incidents that may have adverse effects for investors. In some cases, ambiguous errs on the side of not getting sued or sanctioned. It's good that companies are coming out. I work in infosec, and it's constantly a battle with clients who take a "it can't happen to a big company like us, we have a professional IT department" mindset. It is happening, constantly, and things only improve when there is awareness. I also like the forced disclosure to deal with the "they probably won't hack us, and if they do, we will just fix it later and quietly cover it up" companies. There are a fair number of those as well. Doing things right costs money that they think they can get away with not spending. Usually, that translates to externalizing the cost to the customers who get hacked for using their products, or get their data raided.
  - DanBlake 14y ago
    This is untrue, there is no law saying as such. Every large ( >1000 employees ) organization has DAILY infections on employee computers. That is the reason for IT departments. If any big corp did a press release every time they found malware on a computer, it would just be a never ending stream. Not everyone who works for apple is a programmer. There are janitors, cooks, secretary's, etc.. Those people use IE and click links in emails. I cant say as to why apple chose to release this statement. I can just say I am fairly confident they did not have to.
devindotcom 14y ago
A minor point - Facebook wasn't targeted last week, they were targeted in January and it was reported last week. The timeline is important if we're going to be linking these together. I didn't see hack date info in the Reuters piece, did I miss it or was it not included?
gph 14y ago
The authors of this piece try to make it out like it's Apple that's now become a security risk, when this hack is really Java's fault. It makes you wonder if Oracle is entirely up to the responsibility that comes along with inheriting the entire Java-sphere.
- rednukleus 14y ago
  No they don't. They make it very clear that this was done by exploiting a flaw in Java. > The same software, which infected Macs by exploiting a flaw in a version of Oracle Corp's Java software used as a plug-in on Web browsers, was used to launch attacks against Facebook, which the social network disclosed on Friday. That being said, even if it is Oracle's "fault", most malware works by exploiting third-party software such as Java or Flash or Acrobat - including most Windows malware. OS X may be "becoming less secure", even though OS X itself hasn't changed, due to the fact that some Java and other exploits are now being used to target OS X machines. This is all covered very fairly in the article.
suyash 14y ago
Which websites are they talking about? Also, which browsers are infected (Chrome only or Safari, Chrome, Firefox etc)?
- KMag 14y ago
  Which browser is infected? Perhaps your browser is infected. Which browsers are affected? Any browser configured to pass along Java class files or jar archives to Oracle's Java plugin. Chrome, Safari, and Firefox are all potentially affected.
- dsl 14y ago
  The more advanced kits detect your OS/Browser/Plugin stack and deliver exactly the exploit that will own you. It was iphonedevsdk.com that was used as the watering hole.
  - suyash 14y ago
    thanks dsl..
guelo 14y ago
I see a lot of people bagging on Java but I think the real problem are the browsers. Java is the one being used in this attack but next time it could be Flash or Acrobat or any other plugin or even 3rd party Javascript scripts. The default behavior of browsers should be similar to flash-block, Ghosterly and other similar plugins: the plugin only runs when the user requests it by acknowledging the source and hitting a "play" button inside the page. No auto-loaded code should ever run.
- pcwalton 14y ago
  Firefox will soon be doing this, except for Flash.
- robert-wallis 14y ago
  Chrome's "click to play" plugin setting chrome://settings/content has a nice user experience, because on YouTube you click the video that you want to play instead of clicking some off menu to enable Flash on the whole domain. I think that setting should be default, but likely the AdSense team would have a throwdown with the Chromium team if that happened.
robert-wallis 14y ago
In other news, "Windows laptop gets compromised, media responds 'And your point is?...'" It would be nice if the attack vector were the main focus of the article, but how much publicity would "Java plugin allows Facebook and Apple to be hacked." get. Here's some perspective: http://www.qualys.com/research/top10/ http://www.qualys.com/research/top10/ Also here's their site where you can check your current config: https://browsercheck.qualys.com/ https://browsercheck.qualys.com/
drivebyacct2 14y ago
The sooner Google and Mozilla make Click-to-Run the default, the sooner more clueless people will be safer.

83 points by derpenxyne 14y ago

mtgx 14y ago

How do they know it's the same hackers? If they are only assuming they should state so.

dguido 14y ago
Shared infrastructure, use of same non-public backdoor, same tactics taken once on the box, same watering hole used, hop point includes connections from both Facebook and Apple... Come on man. Read the Mandiant report on APT1 if you want to get schooled on how to tie groups of hackers together over different campaigns.

cooldeal 14y ago

>only a small number of its employees' Macintosh computers were breached, but "there was no evidence that any data left Apple." Looks like Apple is worried more about leaks of their unreleased products. I would be more worried about data entering Apple, whether any websites were injected with malware or, in a much more unlikely scenario, malicious code being in injected into OS code or apps.

0x0 14y ago
It's pretty scary to imagine what a bad guy could do with backdoor access to the iCloud or iMessage services, too. Remote control and wipe any iOS or mac device, steal device backups, intercept txts...
deleted 14y ago
[deleted]

recoiledsnake 14y ago

Looks like the "Write Once, Run Anywhere" Java mantra is true for malware too. Pretty much any run-of-the-mill Windows PC, Mac or Linux machine is vulnerable to this. http://en.wikipedia.org/wiki/Write_once,_run_anywhere http://en.wikipedia.org/wiki/Write_once,_run_anywhere

nivla 14y ago
This is true of any cross platform language, the job of making the exploit work across different OS gets efficiently transferred to the compiler. One of the main reasons I am worried if webkit becomes monolithic, zero day exploits, there will be no running away from it.
- eksith 14y ago
  It's not the language so much the isolation in the VM. Normally, there would be safegards against privilege escalation (since remote code execution is a feature, not a bug). This is just a factor of Oracle not paying attention to a product they bought. When Cisco let Linksys (in the consumer market) stagnate, we ended up with lackluster hardware. Not a big deal. When Oracle ignored Java in the consumer market, the damage is quite a bit more extensive due to its sheer ubiquity.
  - chc 14y ago
    You're talking about something different than nivia was. That comment was in reference to "write once, run anywhere" meaning that malware became cross-platform. A malicious Python app can do malicious things on any platform with Python just like a malicious Java app can do bad things anywhere you have Java. The fact that this is exploitable through a browser plugin makes the risk of infection worse, but doesn't actually make it more cross-platform, per se.
    - eksith 14y ago
      Yes but Python also isn't generally distributed the same way. You could argue the same about the C++ redistributable across Windows and even .Net (I think 4.0 runs on XP), but malware for these are still executables. Silverlight may be the only common ground, but then that's the same as Flash, Acrobat or similar plugin. And as you say it certainly doesn't run in the browser on so many disparate systems making watering hole attacks not nearly as damaging if there were to be Python malware in the wild (and I'm sure there are).
- 14y ago

0x0 14y ago

Which web site was compromised? Several reports point to "a website for mobile software developers" as "the waterhole". Is it the apple ios dev center? The android sdk site? HN? I'd be very interested in knowing if myself or coworkers may have been exposed (or in the best case, which waterhole website I've been missing out on)

jmsduran 14y ago
I'm very curious too, I wonder why this "waterhole" has not been publicly revealed yet? It would make it easier for others to identify whether they were exposed, and take the necessary actions to secure their workstations.
- dguido 14y ago
  If you are running Java in your browser, you were exposed. There, done. The internet is a nasty place, get used it.
  - 0x0 14y ago
    So let's say I'm not except when I'm forced to use Safari for some pages in the iOS dev center?
  - martinced 14y ago
    If you are running Java, Flash, most PDF readers, using any browser which doesn't update automatically, you are exposed. Not "were". Even browser updating automatically aren't a panacea: the update itself may be corrupted by an exploit (now that would be a fiasco). That is precisely the reason people should surf from a separate user account, using very strict firewalling rules. "iptables -I OUTPUT -p tcp --dport 80 (and 443) -m state --state NEW -m user --user-id 501 -j ACCEPT" Now it's too bad per-user firewalling cannot be done easily on neither Windows nor OS X. It's also too bad one user (say the one allowed to surf the Web) cannot display its browser window(s) in another user (say your main account)'s graphical display (neither on Windows nor on OS X). Or too bad OS X doesn't allow to run two graphical sessions simultaneously (on some version of Windows, if you pay enough, at least you can do that). All this is trivial to do under Linux. I'm feeling better and better using Linux as my desktop.

corresation 14y ago

I find this a bit concerning not because Apple was hit, but because getting hit by some Java-malware necessitates a public statement. Anyone here in an organization of more than about 10 users likely has one or more of them with malware of some sort on their device right now, and it is treated as just the cost of the platform. In my organization I'm sort of the paranoid in that I treat every exposure as a serious event, but I am very much alone on that.

lawnchair_larry 14y ago
Unless they can prove (to themselves) that no customer data could have been obtained, they have to disclose this due to laws in several states, including California. Aside from that, I believe it is ambiguous as to whether or not publicly traded companies have to disclose incidents that may have adverse effects for investors. In some cases, ambiguous errs on the side of not getting sued or sanctioned. It's good that companies are coming out. I work in infosec, and it's constantly a battle with clients who take a "it can't happen to a big company like us, we have a professional IT department" mindset. It is happening, constantly, and things only improve when there is awareness. I also like the forced disclosure to deal with the "they probably won't hack us, and if they do, we will just fix it later and quietly cover it up" companies. There are a fair number of those as well. Doing things right costs money that they think they can get away with not spending. Usually, that translates to externalizing the cost to the customers who get hacked for using their products, or get their data raided.
- DanBlake 14y ago
  This is untrue, there is no law saying as such. Every large ( >1000 employees ) organization has DAILY infections on employee computers. That is the reason for IT departments. If any big corp did a press release every time they found malware on a computer, it would just be a never ending stream. Not everyone who works for apple is a programmer. There are janitors, cooks, secretary's, etc.. Those people use IE and click links in emails. I cant say as to why apple chose to release this statement. I can just say I am fairly confident they did not have to.

devindotcom 14y ago

A minor point - Facebook wasn't targeted last week, they were targeted in January and it was reported last week. The timeline is important if we're going to be linking these together. I didn't see hack date info in the Reuters piece, did I miss it or was it not included?

gph 14y ago

The authors of this piece try to make it out like it's Apple that's now become a security risk, when this hack is really Java's fault. It makes you wonder if Oracle is entirely up to the responsibility that comes along with inheriting the entire Java-sphere.

rednukleus 14y ago
No they don't. They make it very clear that this was done by exploiting a flaw in Java. > The same software, which infected Macs by exploiting a flaw in a version of Oracle Corp's Java software used as a plug-in on Web browsers, was used to launch attacks against Facebook, which the social network disclosed on Friday. That being said, even if it is Oracle's "fault", most malware works by exploiting third-party software such as Java or Flash or Acrobat - including most Windows malware. OS X may be "becoming less secure", even though OS X itself hasn't changed, due to the fact that some Java and other exploits are now being used to target OS X machines. This is all covered very fairly in the article.

suyash 14y ago

Which websites are they talking about? Also, which browsers are infected (Chrome only or Safari, Chrome, Firefox etc)?

KMag 14y ago
Which browser is infected? Perhaps your browser is infected. Which browsers are affected? Any browser configured to pass along Java class files or jar archives to Oracle's Java plugin. Chrome, Safari, and Firefox are all potentially affected.
dsl 14y ago
The more advanced kits detect your OS/Browser/Plugin stack and deliver exactly the exploit that will own you. It was iphonedevsdk.com that was used as the watering hole.
- suyash 14y ago
  thanks dsl..

guelo 14y ago

I see a lot of people bagging on Java but I think the real problem are the browsers. Java is the one being used in this attack but next time it could be Flash or Acrobat or any other plugin or even 3rd party Javascript scripts. The default behavior of browsers should be similar to flash-block, Ghosterly and other similar plugins: the plugin only runs when the user requests it by acknowledging the source and hitting a "play" button inside the page. No auto-loaded code should ever run.

pcwalton 14y ago
Firefox will soon be doing this, except for Flash.
robert-wallis 14y ago
Chrome's "click to play" plugin setting chrome://settings/content has a nice user experience, because on YouTube you click the video that you want to play instead of clicking some off menu to enable Flash on the whole domain. I think that setting should be default, but likely the AdSense team would have a throwdown with the Chromium team if that happened.

robert-wallis 14y ago

In other news, "Windows laptop gets compromised, media responds 'And your point is?...'" It would be nice if the attack vector were the main focus of the article, but how much publicity would "Java plugin allows Facebook and Apple to be hacked." get. Here's some perspective: http://www.qualys.com/research/top10/ http://www.qualys.com/research/top10/ Also here's their site where you can check your current config: https://browsercheck.qualys.com/ https://browsercheck.qualys.com/

drivebyacct2 14y ago

The sooner Google and Mozilla make Click-to-Run the default, the sooner more clueless people will be safer.