9 ms·

Apple Developer Website Update

282 points by danielsiders 13y ago

Email from Apple Apple Developer Website Update Last Thursday, an intruder attempted to secure personal information of our registered developers from our developer website. Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. In the spirit of transparency, we want to inform you of the issue. We took the site down immediately on Thursday and have been working around the clock since then. In order to prevent a security threat like this from happening again, we’re completely overhauling our developer systems, updating our server software, and rebuilding our entire database. We apologize for the significant inconvenience that our downtime has caused you and we expect to have the developer website up again soon.

stephen_gareth 13y ago
I'm more interested in the identity of the intruder for some reason. Who/what are they? Presumably there are easier targets to steal credit card numbers from, for example.
jamesjyu 13y ago
Yep, I can confirm I just got this as well.
- dfamorato 13y ago
  +1
  - thrush 13y ago
    Same. It'd be helpful if they'd have a permalink for the email, as I'd imagine a lot of developers (including myself) have/will post to hacker news.
    - makomk 13y ago
      I figure that's probably why they don't have a link for the e-mail - they don't want their developers posting it publicly.
deleted 13y ago
[deleted]
tlongren 13y ago
"In the spirit of transparency". Right, Apple.
- jordanthoms 13y ago
  In the spirit of transparency, we're giving you vague warning that some information might have been accessed _4 days ago_
  - logicallee 13y ago
    That's not a long time to receive a letter like this. That's as fast as Apple instantly responds to anything, esp. considering the weekend. And the site was down, so it was clear something was going on. It is also extremely transparent in the sense that people were wondering this exact thing even earlier today, and now received a response detailing that this is an extremely severe breach, as opposed to something else. What more do you want on a Sunday?
    - jordanthoms 13y ago
      Well I'm giving them a hard time due to the massive schadenfreude, obviously. Still, this is very vague about what the 'sensitive personal information' is (passwords?), what was encrypted, what was hashed, was it using a proper hashing scheme, etc. And announcing it just because people have started to speculate is damage control, not taking responsibility.
      - k-mcgrady 13y ago
        >> "And announcing it just because people have started to speculate is damage control, not taking responsibility." It's possible it took them a few days to figure out exactly what was taken and waited until they had as much info as possible to make a statement. I doubt Apple would be following blogs during a situation like this with someone making the decision: "oh, people have started to speculate about what's happening - I think we should make a statement."
      - 13y ago
tsm 13y ago
These details are befuddling. "Personal information was encrypted and cannot be accessed". It can't be accessed because it's somehow stored elsewhere, or it can't be accessed because of the encryption? That is, does the intruder currently own my encrypted data? I'm also disappointed that it took them 72 hours to tell us anything, and that the update doesn't even have a timeline for when the site may be back. "Soon" is meaningless.
- tlongren 13y ago
  As I interpreted it, yes, the intruder does have your encrypted data.
  - deleted 13y ago
    [deleted]
  - num3ric 13y ago
    I hope you were using good encryption Apple. This guy cracked 400,000 md5 hashed passwords: http://www.youtube.com/watch?v=0WPny7wk960 http://www.youtube.com/watch?v=0WPny7wk960 He says even with password salts, it could be done.
    - ptwiggens 13y ago
      Unsalted MD5 has been extremely easy to crack for years. Not sure why the claim would be impressive at this point.
    - laumars 13y ago
      To be fair, unsalted md5 hashes are only one step above storing passwords in plain text.
    - MrGando 13y ago
      I could crack your unsalted md5 password with my Gameboy Color.
- Watabou 13y ago
  Yeah I'm confused why companies tells us DAYS after something serious happened as opposed to right away. I can understand waiting a day but 3 whole days?! I just don't understand the delay. It's our data, we should have the right to know what happened to it.
nwh 13y ago
Uh, how does this "encryption" work? For the website to show these details (and it does, in part, use these details in the interface) it must be able to decrypt these on the web applications side. Ergo the keys for decryption must also be on the server or derived from the users passwords, both of which make the use of encryption a fairly worthless venture. ED: As another commenter mentioned in an earlier thread, lots of other AppleID facing applications are gone as well ( https://ecommerce.apple.com/ https://ecommerce.apple.com/ ), so it would be interesting to find out how far this all goes. The websites don't seem that far disconnected from the information in iCloud.
- jordanthoms 13y ago
  I think the 'sensitive personal information' is passwords, so the names, addresses etc which are displayed on the site were not encrypted.
  - deleted 13y ago
    [deleted]
- fleitz 13y ago
  Maybe they phoned for a ransom after breaking in? Your post is pure speculation and depends heavily on what Apple means by 'sensitive'. I'm guessing that Apple means your CC numbers, certs, shared keys, etc. Possibly also your support tickets, your bank numbers, etc. As for how encryption works, I'd suggest Applied Cryptography by Scheiner. I think there's a problem in that book about Bob keeping speculative posts to Alice secret from Eve. After reading that book, I'd suggest applying for a job at Apple to give you first hand knowledge of what they're actually doing and then you could make an informed judgement about what may or may not have been exposed.
  - nwh 13y ago
    I am aware how crypto works. I was commenting on there being no source for a key in this situation, rendering it a fairly useless venture.
yulaow 13y ago
Can it be related to the similar attack on the ubuntu forum? Maybe it was a single group of hackers targeting the servers in which they know a lot of developers have an account
kyro 13y ago
No reason to be up in arms, folks. They've got the marketing team working on this too.
- kabdib 13y ago
  Never underestimate the skill of the 2AM janitorial staff, too.
- aaronbrethorst 13y ago
  The marketing team runs the portal. https://twitter.com/chockenberry/status/358310019537715200 https://twitter.com/chockenberry/status/358310019537715200
  - threeseed 13y ago
    Marketing has financial responsibility but engineers still develop and maintain it. And there is lots of cross collaboration with iTunes Store and Apple Online Store teams. WWDR is all about evangelising the platform to a technical audience. Of course it belongs in marketing and not engineering i.e. it involves road shows, presentations, reach out activities etc. Not everyone that is technical are developers remember.
0x0 13y ago
Well at least it was "only" the dev center, and not iCloud and iMessage!
- Sucker 13y ago
  It's not uncommon for developers to use the same credentials for both their developer account and their iTunes/iCloud account. I do.
  - 0x0 13y ago
    Good scary point (I don't). At least I've pre-emptively disabled Find my Mac to avoid another Wired-like remote wipe. Imagine that being pushed to all ios and mac developers at once!
  - objclxt 13y ago
    Apple use a centralised credential system. If I was to speculate I would assume what's happened here is the metadata attached to the developer portal (developer contact information, company info, etc) was compromised, not the actual Apple ID. This would explain why Apple are saying no 'sensitive' information (passwords?) was taken.
pdknsk 13y ago
Hmm so it only takes a few days to "completely overhaul" their developer systems? Not sure I believe this is what they're actually doing. And why haven't they updated their server software before? I know mistakes can never be completely avoided, but this seems slightly amateurish for a company with so much cash.
- k-mcgrady 13y ago
  >> "Hmm so it only takes a few days to "completely overhaul" their developer systems?" They've already been down a few days and haven't said when they'll be back up so it's impossible to know yet how long it'll take.
- objclxt 13y ago
  > this seems slightly amateurish for a company with so much cash I know there are people here who probably have been in the start-up space for all of their working life, but never underestimate how piss poor architecture can be at big companies. I would place a large amount of money that every single person here who has done a stint at a large corporation has a horror story about terrible, awful architecture, outdated practices, and shoddy insecure software. And yes, that includes companies like Facebook, Google, etc.
  - peterkelly 13y ago
    Case in point: http://bugreporter.apple.com http://bugreporter.apple.com still reflects the UI style of OS X 10.0
  - stock_toaster 13y ago
    > I know there are people here who probably have been in the start-up space for all of their working life, but never underestimate how piss poor architecture can be at big companies. Systems that are over 5/10/etc years old and are part of a multi-million/billion dollar system even more so. > who has done a stint at a large corporation has a horror story about terrible, awful architecture, outdated practices, and shoddy insecure software. My god that rings so true. ;_;
- 13y ago
plasma 13y ago
Is the encryption not good enough (and I mean in general when sites get bcrypt'd passwords stolen, etc) when owners are worried the encrypted data is in the hands of intruders? As a developer I'd still be concerned if I lost such data when encrypted - so I understand - but what measures can be put in place so that as a developer/site owner you're without uncertainty that the encrypted data will never be encrypted by the attacker (eg, would take trillions of years).
tater 13y ago
I bet Forstall did it.
0x0 13y ago
I wonder if the hackers managed to get code signing keys out? Ultimate jailbreak?
- RKearney 13y ago
  I highly doubt Apple keeps their master keys anywhere near a public facing web server.
  - 0x0 13y ago
    The dev center seems to be able to autogenerate code signing certificates at least. But maybe those can be revoked via online checks. I wouldn't mind having a wildcard enterprise cert with a 20 year expiration =)
    - Turing_Machine 13y ago
      Access to an API to get certificates from a different server one at a time is different thing from having the actual private signing key.
      - 0x0 13y ago
        Certainly, but an unrestricted code signing certificate would be quite useful too (until they are revoked)
        tcas 13y ago
        Which wouldn't take very long. I'd be amazed if Apple wasn't using a hardware security module to store their intermediate signing keys and logging the keys generated from it. I wonder where the CRL for the dev certificates is -- we might see an update to it soon.
        0x0 13y ago
        Some info on enterprise adhoc ocsp services are here: http://stackoverflow.com/questions/9216485/how-to-manage-enterprise-distribution-certificate-expiration http://stackoverflow.com/questions/9216485/how-to-manage-ent...
jchimney 13y ago
I read the comments dismissing apples handling of this. What would you have expected them to do? There is a LOT of forensics going on probably even now trying to get a handle on this. A massive corp isn't going to make an announcement until they have some idea what they're talking about. In my books 4 days is a very quick first announcement from a company of this size.
peterkelly 13y ago
Good to see some transparency on Apple's part here. I understand this must be a very challenging situation for them to deal with, and I appreciate the notification. As I'm sure many developers feel, I'd like to know more details, but I'm sure these will come in due course.
- peterkelly 13y ago
  Also, let's not jump to conclusions until we have more info. This is clearly a very serious and sensitive incident.
- markdown 13y ago
  It's a strange world we live in when every time we're told by a big corp that our personal info was compromised, we're grateful for being told. This is the worlds most cashed-up corporation. They could buy entire countries, yet they made a conscious choice not to update their server software or hire more competent sys-admins. There shouldn't be a way for them to gain marketing wins out of this. There should be a law requiring notification when personal information is compromised.
  - peterkelly 13y ago
    This isn't about marketing. It's about a security breach. And security breaches take time (> 2 days) to properly investigate and report. It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies. It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possible. Let's calm things down, give it a few days, and then evaluate. Nobody can make an immediate judgement about the exact causes of problems like this. If you're making judgements at this point, you really have no idea whether you're being accurate or not. And yes, if it turns out to be negligence on Apple's part, I'll be very angry. But let's wait and see.
    - pdknsk 13y ago
      >> It's about a security breach. Well, you're very much mistaken. It's not about a security breach at all. If you read carefully, you'll notice it's merely about a "security threat". :)
yapcguy 13y ago
> "In the spirit of transparency, we want to inform you of the issue." Ha, what a joke, I can't help laughing at that. With so many third-party Apple developers drinking the kool-aid, and dreaming of becoming rich, I'm not surprised Apple treat them like fools. Just yesterday on Twitter, some developers were speculating that the site was taken down to be updated with new SDKs for exciting new features and product lines.
- georgemcbay 13y ago
  I'm pretty sure in a fully honest world that would read "In the spirit of not risking running afoul of the security breach statutes in various states we do business in, we want to inform you of the issue". Apple is great a lot of things but I don't think even their most ardent fans would argue that transparency is one of them.
jpdoctor 13y ago
> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it. Apparently our intelligence, which cannot be insulted, has been insulted.
- jordanthoms 13y ago
  Alternately, inside the reality distortion field developers’ names, mailing addresses, and/or email addresses is not sensitive personal information.
  - Turing_Machine 13y ago
    Anyone who has my name can find my email address with a simple Google search. My mailing address is on all kinds of public records.
    - robryan 13y ago
      "Give me a list of all registered developers email addresses" is a little harder though.
      - ptwiggens 13y ago
        What use is the list without passwords?
        kalleboo 13y ago
        Spear phishing
        robryan 13y ago
        Spamming them with something that may interest iOS developers.
vmarsy 13y ago
If the intruder is a patent troll-er, getting developers’ names and mailing addresses can be pretty harmful.
- k-mcgrady 13y ago
  Nobody would take that risk. It wouldn't be difficult to figure out how they got all the names and addresses and would seriously backfire.
- ptwiggens 13y ago
  How exactly would that be harmful? If a patent troller wants to find out who is behind an app, they would go through the legal system and use a subpoena. Literally no reason whatsoever for them to hack a website to get it.
smallsharptools 13y ago
Until I see an email from Apple myself I will not see this info as credible.
- Turing_Machine 13y ago
  Mine just arrived as I was reading this. I'll bet yours will be there soon.
- alayne 13y ago
  I got email from Apple about 15 minutes ago with this text. It probably takes some time to send to everyone.
- RKearney 13y ago
  You will get one soon... http://i.imgur.com/PNMZrtn.png http://i.imgur.com/PNMZrtn.png
- kalleboo 13y ago
  I got the email then came straight to HN to check the discusson. Received: by 10.50.11.202 with SMTP id s10csp27972igb; Sun, 21 Jul 2013 16:01:44 -0700 (PDT) X-Received: by 10.68.172.34 with SMTP id az2mr27321730pbc.201.1374447703980; Sun, 21 Jul 2013 16:01:43 -0700 (PDT) Return-Path: <developer_bounces@insideapple.apple.com> Received: from msbadger0508.apple.com (msbadger0508.apple.com. [17.254.6.162]) by mx.google.com with ESMTP id yo6si9958126pac.15.2013.07.21.16.01.43 for <XXX>; Sun, 21 Jul 2013 16:01:43 -0700 (PDT) Received-SPF: pass (google.com: domain of developer_bounces@insideapple.apple.com designates 17.254.6.162 as permitted sender) client-ip=17.254.6.162; Authentication-Results: mx.google.com; spf=pass (google.com: domain of developer_bounces@insideapple.apple.com designates 17.254.6.162 as permitted sender) smtp.mail=developer_bounces@insideapple.apple.com; dkim=pass header.i=@insideapple.apple.com; dmarc=pass (p=REJECT dis=NONE) d=insideapple.apple.com
- briandear 13y ago
  Ok, don't think it's credible. The rest of us who've received the email can talk about it in the meantime.
kalleboo 13y ago
Any idea what "rebuilding our database" means? Reticulating the splines? I hear those go out of alignment sometimes.
- Sanddancer 13y ago
  There are lots of moving parts in a database, and lots of places one can hide back doors for later access -- triggers, etc. If you're not sure how hard you got owned, nuking, paving, and auditing is usually the best course of action.
diminoten 13y ago
Is there any other source that this actually happened besides from a guy posting some text on HN?
- joe_bleau 13y ago
  I received the same email.
- hdivider 13y ago
  I also got the same message. It's a real email from Apple. Also, expect to see stories about this on the usual tech sites within minutes.
- pdknsk 13y ago
  http://devimages.apple.com/maintenance/ http://devimages.apple.com/maintenance/
- adnrw 13y ago
  Plenty of Apple and tech-related news sites have posted the email: http://9to5mac.com/2013/07/21/apple-explains-developer-center-outage-intruder-attempted-to-retrieve-users-info/ http://9to5mac.com/2013/07/21/apple-explains-developer-cente... http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev-center-has-potentially-been-breached-by-hackers/ http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev... http://allthingsd.com/20130721/apple-developer-center-was-hacked-site-remains-down-while-company-overhauls-security/ http://allthingsd.com/20130721/apple-developer-center-was-ha...
michaelxia 13y ago
Thanks Apple! This email was super helpful, now I know exactly whats going on.
- __david__ 13y ago
  I sense some sarcasm here, but I don't get it. Yesterday the site was just down, now we officially know why and have some sense of a timeline. It seems reasonable enough to me—what more do you want?
  - michaelxia 13y ago
    Then let me clarify... 1) The site was down since Thursday, not yesterday. 2) You can't "overhaul" and expect to deploy "soon", so wtf are you doing apple? 3) "Soon" is not a timeline, at least not in the real world. 4) What info got owned? What could be effected?
foobarme 13y ago
Apple jargon for "oh "
dphase 13y ago
This may explain some strange occurrences I had yesterday. Starting at 7am, I received an Apple ID password reset request every 4 hours and 19 minutes, ending last night at midnight. This Apple ID is also the login for my personal developer account (several years old). My developers IDs used for work never received a password reset request.
- ptwiggens 13y ago
  I highly doubt the hackers plan was to get email addresses and try to brute force from there... just doesn't make sense. If you search Google, people are all the time receiving password reset emails going back years, even repeated ones. Email addresses are in the clear all the time, and I've never heard of them being considered sensitive before. You should assume everyone has your email address.
thepumpkin1979 13y ago
`rebuilding our entire database`. So the database was... destroyed...?
- tater 13y ago
  I'd let them slide on that if they had the brass to announce it was running on CoreData.
peterkelly 13y ago
I understand everyone's frustrations with this, and the fact that Apple haven't been immediately clear on exactly what happened. As a developer, I too am alarmed by what has happened. But these things are complex, and it takes time (i.e. a few days) to fully and properly evaluate what has happened and what information leaks/security breaches have occurred. Let's give this a reasonable amount of time, and only then pass judgement on their handling of the case. I don't want to appear like an Apple apologist - and maybe it is a serious fault on their side. But in fairness I do think it's reasonable we give them time to evaluate & respond appropriately.
dakrisht 13y ago
"Completely overhauling our developer systems, updating our server software, and rebuilding our entire database." That does not sound like an intruder "attempt" by any means. They got hacked, and they got hacked bad if they're rebuilding databases and overhauling entire enterprise-class systems over there. Transparent my ass. They're deep in the gutter, 3-days and counting no fix, engineers are probably working 24 hours a day and the entire site is still down. This isn't a small time breach folks. They had to go public considering it will probably be down for a few more days...
0x0 13y ago
Imagine what you could do here: - break into facebook or twitter or any other high profile dev account - reissue new code signing keys - crack the latest public app and patch in a backdoor - code sign with new keys and submit as an app update
- agent123 13y ago
  How? They took it offline.
  - 0x0 13y ago
    Yes, when they discovered it. We don't know for how long they have actually been compromised. Also, imagine if it happens again and is not discovered.
    - agent123 13y ago
      Seems like it's just your imagination: http://www.loopinsight.com/2013/07/21/apple-comments-on-developer-site-hack/ http://www.loopinsight.com/2013/07/21/apple-comments-on-deve...
      - 0x0 13y ago
        That's why I started the original post with "Imagine..." :) (Plus, a single PR release about one incident doesn't exclude the possibility of other (known or unknown) incidents taking place)
GR8K 13y ago
It's also posted here: http://devimages.apple.com/maintenance/ http://devimages.apple.com/maintenance/ screenshot: http://i.imgur.com/9BicjeE.jpg http://i.imgur.com/9BicjeE.jpg
general_failure 13y ago
If anyone thinks this is the complete truth, well be prepared to be fooled many times more. I mean the thing is down for 3 days now. This must be a huge breach.
- agent123 13y ago
  No. That tells us nothing about how big the breach is. Only how much effort it is taking for them to be confident that they've properly patched it.
GR8K 13y ago
Manage your Apple ID/password/security questions here: https://appleid.apple.com https://appleid.apple.com
- ptwiggens 13y ago
  What use would changing passwords be if passwords weren't stolen? If you think having your email address out there means you are at higher risk of being attacked, I've got news for you...
  - mcintyre1994 13y ago
    They said sensitive information is encrypted and can't be accessed, my interpretation of that is that the plain text can't be accessed but attackers may have the encrypted sensitive information (eg passwords). Depending on the strength of their encryption though, and the key used etc etc.. it might be perfectly accessible. In the absense of transparency on actual encryption details, you're probably better off assuming the data is compromised than not.
    - ptwiggens 13y ago
      "Depending on the strength of their encryption though, and the key used" I trust that Apple is competent when it comes to encryption at this point. I agree that the statement was ambiguous as to whether the data was actually taken.
      - mcintyre1994 13y ago
        Hopefully, but from the comments this an old, hacky system based on old software with critical software vulnerabilities. I don't imagine their encryption reflects that, but until it's clarified it's probably better to assume it does.
sarreph 13y ago
A little more info from TC: http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev-center-has-potentially-been-breached-by-hackers/ http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev... Update — Just got off the phone with an Apple rep, who confirmed a bit more: - The hack only affected developer accounts; standard iTunes accounts were not compromised - Credit card data was not compromised - They waited three days to alert developers because they were trying to figure out exactly what data was exposed - There is no time table yet for when the Dev Center will return
jamin 13y ago
Thanks Apple. Now what really happened?
deleted 13y ago
[deleted]
tcas 13y ago
I downloaded the CRL for developer certificates [1] and quickly looked at it using grep: grep -E "Revocation Date: Jul 17 .{8} 2013" wwdrccrl.txt | wc -l 3065 grep -E "Revocation Date: Jul 18 .{8} 2013" wwdrccrl.txt | wc -l 2289 grep -E "Revocation Date: Jul 19 .{8} 2013" wwdrccrl.txt | wc -l 2 grep -E "Revocation Date: Jul 20 .{8} 2013" wwdrccrl.txt | wc -l 0 grep -E "Revocation Date: Jul 21 .{8} 2013" wwdrccrl.txt | wc -l 0 These are the two certificates that were revoked on the 19th grep -A 3 -B 1 -E "Revocation Date: Jul 19 .{8} 2013" wwdrccrl.txt Serial Number: 2628C7F90970D227 Revocation Date: Jul 19 03:14:04 2013 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise -- Serial Number: 1A51ABFA4844BD45 Revocation Date: Jul 19 03:24:03 2013 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise To generate the wwdrccrl.txt file I used: openssl crl -inform DER -text -noout -in wwdrca.crl > wwdrccrl.txt Just to be clear -- every entry there I see lists the reason as Key Compromise, just interesting that they usually seem to revoke at least 2000 certificates a day but suddenly stopped on the 19th with just revoking 2. [1]http://www.apple.com/certificateauthority/ http://www.apple.com/certificateauthority/
- cmelbye 13y ago
  That's because the portal is down and people can no longer log in to revoke their developer certificates.
  - tcas 13y ago
    That's what I thought -- but it was also down the 19th yet 2 were revoked. Probably means nothing however. I doubt that anybody with the ability to get into the system would want to get only developer certificates.
    - deleted 13y ago
      [deleted]
sampk 13y ago
> intruder attempted to secure personal information haha "secure". Am so using that word next time my site gets hacked.
- rimantas 13y ago
  get a dictionary.
rogerchucker 13y ago
How is a developer's mailing address not a sensitive information for that developer? How does a tech company get away making a blanket assumption like that?
rogerchucker 13y ago
Is there a database of intrusion attempts (and successful ones too) made at tech companies?
coldcode 13y ago
Jeez people, a company identifies a hack attempt, stops it, and makes sure it never happens again. How often do you hear that one? Most companies don't even tell you anything happened and if they are forced to, they don't even admit anything bad happened (we only exposed 80,000,000 credit cards, no biggie). If my employer suffered this I doubt they'd even tell the employees. What do all of us do when we find a security issue?
- coolnow 13y ago
  The thing that people are getting annoyed at is Apple are claiming this update to be in the name of transparency, even though it's 3 days late and is worded quite poorly. >Most companies don't even tell you anything happened Seeing as you're confident with the "most companies" part, name me 5 big tech companies that suffered a data breach and didn't tell the public, or were forced to. There are laws you know, about informing people about (potential) security breaches.
  - agent123 13y ago
    You can't have it both ways. They were transparent. Complaining that it was 3 days after the incident is irrelevant since we don't know how much investigation was required for them to understand the problem.
    - coolnow 13y ago
      >You can't have it both ways. Why not? See: Ubuntuforums >we don't know how much investigation was required for them to understand the problem. I agree, but i find it hard to believe a company the size of Apple, with the talented force that they have, couldn't have identified that they might've been breached, within 3 days. 3 days.
ChuckMcM 13y ago
I got this email about an hour ago. I feel sorry for the folks who are "updating our server software, and rebuilding our entire database". Songs will be sung in the opsen bars about about this battle. From the sound of the email it suggests they have records of some data (perhaps not sensitive data :-) being compromised but no root cause on how it was compromised, so they are re-building systems from the ground up validating, configuring, and then moving to the next step.There are times where this is faster than spending time trying to root cause the exploit. That said, this is where privacy and security collide. Since logs going back months of what everyone has done on every system really helps reconstruct things, but of course if you have those logs it means that someone else can abuse them.
dano414 13y ago
I got kicked out of an Apple store. I questioned a Managers managatorial expertise. I took his angry picture at the door(Eric in Corte Madera). I am tempted to post it on youtube, but feel punishment enough is working there? Oh yea, the reason he was furious at me, is because I didn't like the way he was treating my salesman. I've never understood people who let a title go to their head? Off topic, just venting.
tszming 13y ago
>> and rebuilding our entire database. maybe someone dropped or polluted the database after hacking it, so they need to rebuild the entire database from other sources?
soheil 13y ago
wow if they're "overhauling" everything that means Apple knows that hackers got some or all developers' info so it's not just that they can't "rule it out" they just don't want to publicly announce it.
blinkingled 13y ago
> In order to prevent a security threat like this from happening again, we’re completely overhauling our developer systems, updating our server software, and rebuilding our entire database. I am wondering what was the thought process behind this gem. I think this looks like a knee jerk reaction and it's particularly lacking polish coming from Apple. I mean clearly Apple knows that "overhauling" systems and updating software is no guarantee for future security. It's not a one time fix - it's an ongoing process. And rebuilding entire database - that's just crazy talk! This is especially inexcusable because the target of this update are developers! Security is hard - you've got legacy crap, 3rd party/unsupported code, you've got open source code and then you have your own code that has evolved to be a Frankenstein. I don't have a problem with Apple getting it wrong once - but the statement does nothing to make developers confident that Apple will finally get web services right.
Lightbody 13y ago
Here's my semi-educated guess for how the attack started: from casual observation (view source, URLs ending with .action, etc) a good chunk of the ADC is written in Java and uses WebWork/Struts2, a framework I helped create years ago. Late last week a security advisory came out that allows for executing malicious code[1]. Atlassian, which uses similar technology, also issued announcements around the same time[2]. My wild speculation is this was the attack vector. Sadly, I feel some responsibility for this pretty major security hole. There have been a few like this and they are all rooted in the fact that almost 9 years ago I made the (bad) decision to use OGNL as WebWork's expression language. I did so because it was "powerful" but it opened up all sorts of extra binding trickery I never intended. I haven't been contributing to the project in 5+ years, but this is a good reminder how technology choices tend to stick around a lot longer than you ever imagine :) [1] http://struts.apache.org/release/2.3.x/docs/s2-016.html http://struts.apache.org/release/2.3.x/docs/s2-016.html [2] https://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2013-07-16 https://confluence.atlassian.com/display/BAMBOO/Bamboo+Secur...
- joeblau 13y ago
  So what you're saying is that it's your fault that I can't update my provisioning profile? No just kidding--Honestly, while you may feel responsible, the project has been up and running for a while. The current maintainers are responsible for the bugs that show up regardless of who designed the original code base. Definitely appreciate you shedding light on the situation since Apple hasn't really given us to much information.
  - aboodman 13y ago
    Both are responsible, and responsibility can add up to more than 100%.
    - muddylemon 13y ago
      I think we, as a society, are ultimately to blame.
djvu9 13y ago
Could it be related to CVE-2013-2251 which was released on 07/20? The URL developer.apple.com/devcenter/ios/index.action seems struts alike..
johansch 13y ago
There is an interesting comment at techcrunch: http://fyre.it/tjlVmC.4 http://fyre.it/tjlVmC.4 "[...] One of those bugs have provided me access to users details etc. I immediately reported this to Apple. I have taken 73 users details (all apple inc workers only) and prove them as an example. 4 hours later from my final report Apple developer portal gas closed down and you know it still is. I have emailed and asked if I am putting them in any difficulty so that I can give a break to my research. I have not gotten any respond to this.. [...] "
- cromwellian 13y ago
  Looks like Apple is using Google Web Toolkit, those are GWT RPC responses. He probably found an CSRF attack.
tater 13y ago
Theres a security researcher commenting on techcrunch claiming he's responsible for the breach here http://fyre.it/tjlVmC.4 http://fyre.it/tjlVmC.4 His proof uploaded to youtube: http://www.youtube.com/watch?v=q000_EOWy80 http://www.youtube.com/watch?v=q000_EOWy80
- kyrra 13y ago
  Taking 40k records is more than just penetration testing.
jhspaybar 13y ago
For what it's worth, Wednesday morning at 4am I had an email account associated with my developer account compromised(they both stupidly used the same password). This account was used for almost nothing but accessing my developer accounts at Apple. At the time, I thought my Apple accounts might be in trouble and I immediately changed all my Apple related passwords as well as regained control of my email account. I'm now wondering if the breach might have gone the other direction...
- jhspaybar 13y ago
  At the time I re-secured the two accounts, I also changed my apple developer account to a new email with 2-factor auth. Apple is still sending these announcements to the email I changed >72 hours ago.
rimantas 13y ago
I got a feeling that the most outraged never used Apple developer portal in their life.
jlebrech 13y ago
glad that i use a password manager and disable no-paste from firebug in order to login.
noja 13y ago
> Sensitive personal information was encrypted sigh Tell us exactly what was and what wasn't encrypted.
zztop 13y ago
I can't feel too bad for Apple. They use WW/Struts but when was the last time they contributed to the project? They never have. Open source volunteers do their best but unless big corporations want to spend their own money, and do their own security assessments, and contribute back anything they find, what do you expect? It's great when you get things for free, but when you're sitting on billions, send some back to the community you're using code from.

282 points by danielsiders 13y ago

stephen_gareth 13y ago

I'm more interested in the identity of the intruder for some reason. Who/what are they? Presumably there are easier targets to steal credit card numbers from, for example.

jamesjyu 13y ago

Yep, I can confirm I just got this as well.

dfamorato 13y ago
+1
- thrush 13y ago
  Same. It'd be helpful if they'd have a permalink for the email, as I'd imagine a lot of developers (including myself) have/will post to hacker news.
  - makomk 13y ago
    I figure that's probably why they don't have a link for the e-mail - they don't want their developers posting it publicly.

deleted 13y ago

[deleted]

tlongren 13y ago

"In the spirit of transparency". Right, Apple.

jordanthoms 13y ago
In the spirit of transparency, we're giving you vague warning that some information might have been accessed _4 days ago_
- logicallee 13y ago
  That's not a long time to receive a letter like this. That's as fast as Apple instantly responds to anything, esp. considering the weekend. And the site was down, so it was clear something was going on. It is also extremely transparent in the sense that people were wondering this exact thing even earlier today, and now received a response detailing that this is an extremely severe breach, as opposed to something else. What more do you want on a Sunday?
  - jordanthoms 13y ago
    Well I'm giving them a hard time due to the massive schadenfreude, obviously. Still, this is very vague about what the 'sensitive personal information' is (passwords?), what was encrypted, what was hashed, was it using a proper hashing scheme, etc. And announcing it just because people have started to speculate is damage control, not taking responsibility.
    - k-mcgrady 13y ago
      >> "And announcing it just because people have started to speculate is damage control, not taking responsibility." It's possible it took them a few days to figure out exactly what was taken and waited until they had as much info as possible to make a statement. I doubt Apple would be following blogs during a situation like this with someone making the decision: "oh, people have started to speculate about what's happening - I think we should make a statement."
    - 13y ago

tsm 13y ago

These details are befuddling. "Personal information was encrypted and cannot be accessed". It can't be accessed because it's somehow stored elsewhere, or it can't be accessed because of the encryption? That is, does the intruder currently own my encrypted data? I'm also disappointed that it took them 72 hours to tell us anything, and that the update doesn't even have a timeline for when the site may be back. "Soon" is meaningless.

tlongren 13y ago
As I interpreted it, yes, the intruder does have your encrypted data.
- deleted 13y ago
  [deleted]
- num3ric 13y ago
  I hope you were using good encryption Apple. This guy cracked 400,000 md5 hashed passwords: http://www.youtube.com/watch?v=0WPny7wk960 http://www.youtube.com/watch?v=0WPny7wk960 He says even with password salts, it could be done.
  - ptwiggens 13y ago
    Unsalted MD5 has been extremely easy to crack for years. Not sure why the claim would be impressive at this point.
  - laumars 13y ago
    To be fair, unsalted md5 hashes are only one step above storing passwords in plain text.
  - MrGando 13y ago
    I could crack your unsalted md5 password with my Gameboy Color.
Watabou 13y ago
Yeah I'm confused why companies tells us DAYS after something serious happened as opposed to right away. I can understand waiting a day but 3 whole days?! I just don't understand the delay. It's our data, we should have the right to know what happened to it.

nwh 13y ago

Uh, how does this "encryption" work? For the website to show these details (and it does, in part, use these details in the interface) it must be able to decrypt these on the web applications side. Ergo the keys for decryption must also be on the server or derived from the users passwords, both of which make the use of encryption a fairly worthless venture. ED: As another commenter mentioned in an earlier thread, lots of other AppleID facing applications are gone as well ( https://ecommerce.apple.com/ https://ecommerce.apple.com/ ), so it would be interesting to find out how far this all goes. The websites don't seem that far disconnected from the information in iCloud.

jordanthoms 13y ago
I think the 'sensitive personal information' is passwords, so the names, addresses etc which are displayed on the site were not encrypted.
- deleted 13y ago
  [deleted]
fleitz 13y ago
Maybe they phoned for a ransom after breaking in? Your post is pure speculation and depends heavily on what Apple means by 'sensitive'. I'm guessing that Apple means your CC numbers, certs, shared keys, etc. Possibly also your support tickets, your bank numbers, etc. As for how encryption works, I'd suggest Applied Cryptography by Scheiner. I think there's a problem in that book about Bob keeping speculative posts to Alice secret from Eve. After reading that book, I'd suggest applying for a job at Apple to give you first hand knowledge of what they're actually doing and then you could make an informed judgement about what may or may not have been exposed.
- nwh 13y ago
  I am aware how crypto works. I was commenting on there being no source for a key in this situation, rendering it a fairly useless venture.

yulaow 13y ago

Can it be related to the similar attack on the ubuntu forum? Maybe it was a single group of hackers targeting the servers in which they know a lot of developers have an account

kyro 13y ago

No reason to be up in arms, folks. They've got the marketing team working on this too.

kabdib 13y ago
Never underestimate the skill of the 2AM janitorial staff, too.
aaronbrethorst 13y ago
The marketing team runs the portal. https://twitter.com/chockenberry/status/358310019537715200 https://twitter.com/chockenberry/status/358310019537715200
- threeseed 13y ago
  Marketing has financial responsibility but engineers still develop and maintain it. And there is lots of cross collaboration with iTunes Store and Apple Online Store teams. WWDR is all about evangelising the platform to a technical audience. Of course it belongs in marketing and not engineering i.e. it involves road shows, presentations, reach out activities etc. Not everyone that is technical are developers remember.

0x0 13y ago

Well at least it was "only" the dev center, and not iCloud and iMessage!

Sucker 13y ago
It's not uncommon for developers to use the same credentials for both their developer account and their iTunes/iCloud account. I do.
- 0x0 13y ago
  Good scary point (I don't). At least I've pre-emptively disabled Find my Mac to avoid another Wired-like remote wipe. Imagine that being pushed to all ios and mac developers at once!
- objclxt 13y ago
  Apple use a centralised credential system. If I was to speculate I would assume what's happened here is the metadata attached to the developer portal (developer contact information, company info, etc) was compromised, not the actual Apple ID. This would explain why Apple are saying no 'sensitive' information (passwords?) was taken.

pdknsk 13y ago

Hmm so it only takes a few days to "completely overhaul" their developer systems? Not sure I believe this is what they're actually doing. And why haven't they updated their server software before? I know mistakes can never be completely avoided, but this seems slightly amateurish for a company with so much cash.

k-mcgrady 13y ago
>> "Hmm so it only takes a few days to "completely overhaul" their developer systems?" They've already been down a few days and haven't said when they'll be back up so it's impossible to know yet how long it'll take.
objclxt 13y ago
> this seems slightly amateurish for a company with so much cash I know there are people here who probably have been in the start-up space for all of their working life, but never underestimate how piss poor architecture can be at big companies. I would place a large amount of money that every single person here who has done a stint at a large corporation has a horror story about terrible, awful architecture, outdated practices, and shoddy insecure software. And yes, that includes companies like Facebook, Google, etc.
- peterkelly 13y ago
  Case in point: http://bugreporter.apple.com http://bugreporter.apple.com still reflects the UI style of OS X 10.0
- stock_toaster 13y ago
  > I know there are people here who probably have been in the start-up space for all of their working life, but never underestimate how piss poor architecture can be at big companies. Systems that are over 5/10/etc years old and are part of a multi-million/billion dollar system even more so. > who has done a stint at a large corporation has a horror story about terrible, awful architecture, outdated practices, and shoddy insecure software. My god that rings so true. ;_;
13y ago

plasma 13y ago

Is the encryption not good enough (and I mean in general when sites get bcrypt'd passwords stolen, etc) when owners are worried the encrypted data is in the hands of intruders? As a developer I'd still be concerned if I lost such data when encrypted - so I understand - but what measures can be put in place so that as a developer/site owner you're without uncertainty that the encrypted data will never be encrypted by the attacker (eg, would take trillions of years).

tater 13y ago

I bet Forstall did it.

0x0 13y ago

I wonder if the hackers managed to get code signing keys out? Ultimate jailbreak?

RKearney 13y ago
I highly doubt Apple keeps their master keys anywhere near a public facing web server.
- 0x0 13y ago
  The dev center seems to be able to autogenerate code signing certificates at least. But maybe those can be revoked via online checks. I wouldn't mind having a wildcard enterprise cert with a 20 year expiration =)
  - Turing_Machine 13y ago
    Access to an API to get certificates from a different server one at a time is different thing from having the actual private signing key.
    - 0x0 13y ago
      Certainly, but an unrestricted code signing certificate would be quite useful too (until they are revoked)
      - tcas 13y ago
        Which wouldn't take very long. I'd be amazed if Apple wasn't using a hardware security module to store their intermediate signing keys and logging the keys generated from it. I wonder where the CRL for the dev certificates is -- we might see an update to it soon.
        0x0 13y ago
        Some info on enterprise adhoc ocsp services are here: http://stackoverflow.com/questions/9216485/how-to-manage-enterprise-distribution-certificate-expiration http://stackoverflow.com/questions/9216485/how-to-manage-ent...

jchimney 13y ago

I read the comments dismissing apples handling of this. What would you have expected them to do? There is a LOT of forensics going on probably even now trying to get a handle on this. A massive corp isn't going to make an announcement until they have some idea what they're talking about. In my books 4 days is a very quick first announcement from a company of this size.

peterkelly 13y ago

Good to see some transparency on Apple's part here. I understand this must be a very challenging situation for them to deal with, and I appreciate the notification. As I'm sure many developers feel, I'd like to know more details, but I'm sure these will come in due course.

peterkelly 13y ago
Also, let's not jump to conclusions until we have more info. This is clearly a very serious and sensitive incident.
markdown 13y ago
It's a strange world we live in when every time we're told by a big corp that our personal info was compromised, we're grateful for being told. This is the worlds most cashed-up corporation. They could buy entire countries, yet they made a conscious choice not to update their server software or hire more competent sys-admins. There shouldn't be a way for them to gain marketing wins out of this. There should be a law requiring notification when personal information is compromised.
- peterkelly 13y ago
  This isn't about marketing. It's about a security breach. And security breaches take time (> 2 days) to properly investigate and report. It's entirely possible that this is a massive oversight by Apple and they've been extremely negligent in their security policies. It's equally possible that there's some bug (that either you or I could easily have made the mistake of introducing) that's resulted in this being possible. Let's calm things down, give it a few days, and then evaluate. Nobody can make an immediate judgement about the exact causes of problems like this. If you're making judgements at this point, you really have no idea whether you're being accurate or not. And yes, if it turns out to be negligence on Apple's part, I'll be very angry. But let's wait and see.
  - pdknsk 13y ago
    >> It's about a security breach. Well, you're very much mistaken. It's not about a security breach at all. If you read carefully, you'll notice it's merely about a "security threat". :)

yapcguy 13y ago

> "In the spirit of transparency, we want to inform you of the issue." Ha, what a joke, I can't help laughing at that. With so many third-party Apple developers drinking the kool-aid, and dreaming of becoming rich, I'm not surprised Apple treat them like fools. Just yesterday on Twitter, some developers were speculating that the site was taken down to be updated with new SDKs for exciting new features and product lines.

georgemcbay 13y ago
I'm pretty sure in a fully honest world that would read "In the spirit of not risking running afoul of the security breach statutes in various states we do business in, we want to inform you of the issue". Apple is great a lot of things but I don't think even their most ardent fans would argue that transparency is one of them.

jpdoctor 13y ago

> Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers’ names, mailing addresses, and/or email addresses may have been accessed. So they can't rule out the possibility that sensitive personal information, which cannot be accessed, has been accessed. Got it. Apparently our intelligence, which cannot be insulted, has been insulted.

jordanthoms 13y ago
Alternately, inside the reality distortion field developers’ names, mailing addresses, and/or email addresses is not sensitive personal information.
- Turing_Machine 13y ago
  Anyone who has my name can find my email address with a simple Google search. My mailing address is on all kinds of public records.
  - robryan 13y ago
    "Give me a list of all registered developers email addresses" is a little harder though.
    - ptwiggens 13y ago
      What use is the list without passwords?
      - kalleboo 13y ago
        Spear phishing
      - robryan 13y ago
        Spamming them with something that may interest iOS developers.

vmarsy 13y ago

If the intruder is a patent troll-er, getting developers’ names and mailing addresses can be pretty harmful.

k-mcgrady 13y ago
Nobody would take that risk. It wouldn't be difficult to figure out how they got all the names and addresses and would seriously backfire.
ptwiggens 13y ago
How exactly would that be harmful? If a patent troller wants to find out who is behind an app, they would go through the legal system and use a subpoena. Literally no reason whatsoever for them to hack a website to get it.

smallsharptools 13y ago

Until I see an email from Apple myself I will not see this info as credible.

Turing_Machine 13y ago
Mine just arrived as I was reading this. I'll bet yours will be there soon.
alayne 13y ago
I got email from Apple about 15 minutes ago with this text. It probably takes some time to send to everyone.
RKearney 13y ago
You will get one soon... http://i.imgur.com/PNMZrtn.png http://i.imgur.com/PNMZrtn.png
kalleboo 13y ago
I got the email then came straight to HN to check the discusson. Received: by 10.50.11.202 with SMTP id s10csp27972igb; Sun, 21 Jul 2013 16:01:44 -0700 (PDT) X-Received: by 10.68.172.34 with SMTP id az2mr27321730pbc.201.1374447703980; Sun, 21 Jul 2013 16:01:43 -0700 (PDT) Return-Path: <developer_bounces@insideapple.apple.com> Received: from msbadger0508.apple.com (msbadger0508.apple.com. [17.254.6.162]) by mx.google.com with ESMTP id yo6si9958126pac.15.2013.07.21.16.01.43 for <XXX>; Sun, 21 Jul 2013 16:01:43 -0700 (PDT) Received-SPF: pass (google.com: domain of developer_bounces@insideapple.apple.com designates 17.254.6.162 as permitted sender) client-ip=17.254.6.162; Authentication-Results: mx.google.com; spf=pass (google.com: domain of developer_bounces@insideapple.apple.com designates 17.254.6.162 as permitted sender) smtp.mail=developer_bounces@insideapple.apple.com; dkim=pass header.i=@insideapple.apple.com; dmarc=pass (p=REJECT dis=NONE) d=insideapple.apple.com
briandear 13y ago
Ok, don't think it's credible. The rest of us who've received the email can talk about it in the meantime.

kalleboo 13y ago

Any idea what "rebuilding our database" means? Reticulating the splines? I hear those go out of alignment sometimes.

Sanddancer 13y ago
There are lots of moving parts in a database, and lots of places one can hide back doors for later access -- triggers, etc. If you're not sure how hard you got owned, nuking, paving, and auditing is usually the best course of action.

diminoten 13y ago

Is there any other source that this actually happened besides from a guy posting some text on HN?

joe_bleau 13y ago
I received the same email.
hdivider 13y ago
I also got the same message. It's a real email from Apple. Also, expect to see stories about this on the usual tech sites within minutes.
pdknsk 13y ago
http://devimages.apple.com/maintenance/ http://devimages.apple.com/maintenance/
adnrw 13y ago
Plenty of Apple and tech-related news sites have posted the email: http://9to5mac.com/2013/07/21/apple-explains-developer-center-outage-intruder-attempted-to-retrieve-users-info/ http://9to5mac.com/2013/07/21/apple-explains-developer-cente... http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev-center-has-potentially-been-breached-by-hackers/ http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev... http://allthingsd.com/20130721/apple-developer-center-was-hacked-site-remains-down-while-company-overhauls-security/ http://allthingsd.com/20130721/apple-developer-center-was-ha...

michaelxia 13y ago

Thanks Apple! This email was super helpful, now I know exactly whats going on.

__david__ 13y ago
I sense some sarcasm here, but I don't get it. Yesterday the site was just down, now we officially know why and have some sense of a timeline. It seems reasonable enough to me—what more do you want?
- michaelxia 13y ago
  Then let me clarify... 1) The site was down since Thursday, not yesterday. 2) You can't "overhaul" and expect to deploy "soon", so wtf are you doing apple? 3) "Soon" is not a timeline, at least not in the real world. 4) What info got owned? What could be effected?

foobarme 13y ago

Apple jargon for "oh "

dphase 13y ago

This may explain some strange occurrences I had yesterday. Starting at 7am, I received an Apple ID password reset request every 4 hours and 19 minutes, ending last night at midnight. This Apple ID is also the login for my personal developer account (several years old). My developers IDs used for work never received a password reset request.

ptwiggens 13y ago
I highly doubt the hackers plan was to get email addresses and try to brute force from there... just doesn't make sense. If you search Google, people are all the time receiving password reset emails going back years, even repeated ones. Email addresses are in the clear all the time, and I've never heard of them being considered sensitive before. You should assume everyone has your email address.

thepumpkin1979 13y ago

`rebuilding our entire database`. So the database was... destroyed...?

tater 13y ago
I'd let them slide on that if they had the brass to announce it was running on CoreData.

peterkelly 13y ago

I understand everyone's frustrations with this, and the fact that Apple haven't been immediately clear on exactly what happened. As a developer, I too am alarmed by what has happened. But these things are complex, and it takes time (i.e. a few days) to fully and properly evaluate what has happened and what information leaks/security breaches have occurred. Let's give this a reasonable amount of time, and only then pass judgement on their handling of the case. I don't want to appear like an Apple apologist - and maybe it is a serious fault on their side. But in fairness I do think it's reasonable we give them time to evaluate & respond appropriately.

dakrisht 13y ago

"Completely overhauling our developer systems, updating our server software, and rebuilding our entire database." That does not sound like an intruder "attempt" by any means. They got hacked, and they got hacked bad if they're rebuilding databases and overhauling entire enterprise-class systems over there. Transparent my ass. They're deep in the gutter, 3-days and counting no fix, engineers are probably working 24 hours a day and the entire site is still down. This isn't a small time breach folks. They had to go public considering it will probably be down for a few more days...

0x0 13y ago

Imagine what you could do here: - break into facebook or twitter or any other high profile dev account - reissue new code signing keys - crack the latest public app and patch in a backdoor - code sign with new keys and submit as an app update

agent123 13y ago
How? They took it offline.
- 0x0 13y ago
  Yes, when they discovered it. We don't know for how long they have actually been compromised. Also, imagine if it happens again and is not discovered.
  - agent123 13y ago
    Seems like it's just your imagination: http://www.loopinsight.com/2013/07/21/apple-comments-on-developer-site-hack/ http://www.loopinsight.com/2013/07/21/apple-comments-on-deve...
    - 0x0 13y ago
      That's why I started the original post with "Imagine..." :) (Plus, a single PR release about one incident doesn't exclude the possibility of other (known or unknown) incidents taking place)

GR8K 13y ago

It's also posted here: http://devimages.apple.com/maintenance/ http://devimages.apple.com/maintenance/ screenshot: http://i.imgur.com/9BicjeE.jpg http://i.imgur.com/9BicjeE.jpg

general_failure 13y ago

If anyone thinks this is the complete truth, well be prepared to be fooled many times more. I mean the thing is down for 3 days now. This must be a huge breach.

agent123 13y ago
No. That tells us nothing about how big the breach is. Only how much effort it is taking for them to be confident that they've properly patched it.

GR8K 13y ago

Manage your Apple ID/password/security questions here: https://appleid.apple.com https://appleid.apple.com

ptwiggens 13y ago
What use would changing passwords be if passwords weren't stolen? If you think having your email address out there means you are at higher risk of being attacked, I've got news for you...
- mcintyre1994 13y ago
  They said sensitive information is encrypted and can't be accessed, my interpretation of that is that the plain text can't be accessed but attackers may have the encrypted sensitive information (eg passwords). Depending on the strength of their encryption though, and the key used etc etc.. it might be perfectly accessible. In the absense of transparency on actual encryption details, you're probably better off assuming the data is compromised than not.
  - ptwiggens 13y ago
    "Depending on the strength of their encryption though, and the key used" I trust that Apple is competent when it comes to encryption at this point. I agree that the statement was ambiguous as to whether the data was actually taken.
    - mcintyre1994 13y ago
      Hopefully, but from the comments this an old, hacky system based on old software with critical software vulnerabilities. I don't imagine their encryption reflects that, but until it's clarified it's probably better to assume it does.

sarreph 13y ago

A little more info from TC: http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev-center-has-potentially-been-breached-by-hackers/ http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev... Update — Just got off the phone with an Apple rep, who confirmed a bit more: - The hack only affected developer accounts; standard iTunes accounts were not compromised - Credit card data was not compromised - They waited three days to alert developers because they were trying to figure out exactly what data was exposed - There is no time table yet for when the Dev Center will return

jamin 13y ago

Thanks Apple. Now what really happened?

deleted 13y ago

[deleted]

tcas 13y ago

I downloaded the CRL for developer certificates [1] and quickly looked at it using grep: grep -E "Revocation Date: Jul 17 .{8} 2013" wwdrccrl.txt | wc -l 3065 grep -E "Revocation Date: Jul 18 .{8} 2013" wwdrccrl.txt | wc -l 2289 grep -E "Revocation Date: Jul 19 .{8} 2013" wwdrccrl.txt | wc -l 2 grep -E "Revocation Date: Jul 20 .{8} 2013" wwdrccrl.txt | wc -l 0 grep -E "Revocation Date: Jul 21 .{8} 2013" wwdrccrl.txt | wc -l 0 These are the two certificates that were revoked on the 19th grep -A 3 -B 1 -E "Revocation Date: Jul 19 .{8} 2013" wwdrccrl.txt Serial Number: 2628C7F90970D227 Revocation Date: Jul 19 03:14:04 2013 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise -- Serial Number: 1A51ABFA4844BD45 Revocation Date: Jul 19 03:24:03 2013 GMT CRL entry extensions: X509v3 CRL Reason Code: Key Compromise To generate the wwdrccrl.txt file I used: openssl crl -inform DER -text -noout -in wwdrca.crl > wwdrccrl.txt Just to be clear -- every entry there I see lists the reason as Key Compromise, just interesting that they usually seem to revoke at least 2000 certificates a day but suddenly stopped on the 19th with just revoking 2. [1]http://www.apple.com/certificateauthority/ http://www.apple.com/certificateauthority/

cmelbye 13y ago
That's because the portal is down and people can no longer log in to revoke their developer certificates.
- tcas 13y ago
  That's what I thought -- but it was also down the 19th yet 2 were revoked. Probably means nothing however. I doubt that anybody with the ability to get into the system would want to get only developer certificates.
  - deleted 13y ago
    [deleted]

sampk 13y ago

> intruder attempted to secure personal information haha "secure". Am so using that word next time my site gets hacked.

rimantas 13y ago
get a dictionary.

rogerchucker 13y ago

How is a developer's mailing address not a sensitive information for that developer? How does a tech company get away making a blanket assumption like that?

rogerchucker 13y ago

Is there a database of intrusion attempts (and successful ones too) made at tech companies?

coldcode 13y ago

Jeez people, a company identifies a hack attempt, stops it, and makes sure it never happens again. How often do you hear that one? Most companies don't even tell you anything happened and if they are forced to, they don't even admit anything bad happened (we only exposed 80,000,000 credit cards, no biggie). If my employer suffered this I doubt they'd even tell the employees. What do all of us do when we find a security issue?

coolnow 13y ago
The thing that people are getting annoyed at is Apple are claiming this update to be in the name of transparency, even though it's 3 days late and is worded quite poorly. >Most companies don't even tell you anything happened Seeing as you're confident with the "most companies" part, name me 5 big tech companies that suffered a data breach and didn't tell the public, or were forced to. There are laws you know, about informing people about (potential) security breaches.
- agent123 13y ago
  You can't have it both ways. They were transparent. Complaining that it was 3 days after the incident is irrelevant since we don't know how much investigation was required for them to understand the problem.
  - coolnow 13y ago
    >You can't have it both ways. Why not? See: Ubuntuforums >we don't know how much investigation was required for them to understand the problem. I agree, but i find it hard to believe a company the size of Apple, with the talented force that they have, couldn't have identified that they might've been breached, within 3 days. 3 days.

ChuckMcM 13y ago

I got this email about an hour ago. I feel sorry for the folks who are "updating our server software, and rebuilding our entire database". Songs will be sung in the opsen bars about about this battle. From the sound of the email it suggests they have records of some data (perhaps not sensitive data :-) being compromised but no root cause on how it was compromised, so they are re-building systems from the ground up validating, configuring, and then moving to the next step.There are times where this is faster than spending time trying to root cause the exploit. That said, this is where privacy and security collide. Since logs going back months of what everyone has done on every system really helps reconstruct things, but of course if you have those logs it means that someone else can abuse them.

dano414 13y ago

I got kicked out of an Apple store. I questioned a Managers managatorial expertise. I took his angry picture at the door(Eric in Corte Madera). I am tempted to post it on youtube, but feel punishment enough is working there? Oh yea, the reason he was furious at me, is because I didn't like the way he was treating my salesman. I've never understood people who let a title go to their head? Off topic, just venting.

tszming 13y ago

>> and rebuilding our entire database. maybe someone dropped or polluted the database after hacking it, so they need to rebuild the entire database from other sources?

soheil 13y ago

wow if they're "overhauling" everything that means Apple knows that hackers got some or all developers' info so it's not just that they can't "rule it out" they just don't want to publicly announce it.

blinkingled 13y ago

> In order to prevent a security threat like this from happening again, we’re completely overhauling our developer systems, updating our server software, and rebuilding our entire database. I am wondering what was the thought process behind this gem. I think this looks like a knee jerk reaction and it's particularly lacking polish coming from Apple. I mean clearly Apple knows that "overhauling" systems and updating software is no guarantee for future security. It's not a one time fix - it's an ongoing process. And rebuilding entire database - that's just crazy talk! This is especially inexcusable because the target of this update are developers! Security is hard - you've got legacy crap, 3rd party/unsupported code, you've got open source code and then you have your own code that has evolved to be a Frankenstein. I don't have a problem with Apple getting it wrong once - but the statement does nothing to make developers confident that Apple will finally get web services right.

Lightbody 13y ago

Here's my semi-educated guess for how the attack started: from casual observation (view source, URLs ending with .action, etc) a good chunk of the ADC is written in Java and uses WebWork/Struts2, a framework I helped create years ago. Late last week a security advisory came out that allows for executing malicious code[1]. Atlassian, which uses similar technology, also issued announcements around the same time[2]. My wild speculation is this was the attack vector. Sadly, I feel some responsibility for this pretty major security hole. There have been a few like this and they are all rooted in the fact that almost 9 years ago I made the (bad) decision to use OGNL as WebWork's expression language. I did so because it was "powerful" but it opened up all sorts of extra binding trickery I never intended. I haven't been contributing to the project in 5+ years, but this is a good reminder how technology choices tend to stick around a lot longer than you ever imagine :) [1] http://struts.apache.org/release/2.3.x/docs/s2-016.html http://struts.apache.org/release/2.3.x/docs/s2-016.html [2] https://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2013-07-16 https://confluence.atlassian.com/display/BAMBOO/Bamboo+Secur...

joeblau 13y ago
So what you're saying is that it's your fault that I can't update my provisioning profile? No just kidding--Honestly, while you may feel responsible, the project has been up and running for a while. The current maintainers are responsible for the bugs that show up regardless of who designed the original code base. Definitely appreciate you shedding light on the situation since Apple hasn't really given us to much information.
- aboodman 13y ago
  Both are responsible, and responsibility can add up to more than 100%.
  - muddylemon 13y ago
    I think we, as a society, are ultimately to blame.

djvu9 13y ago

Could it be related to CVE-2013-2251 which was released on 07/20? The URL developer.apple.com/devcenter/ios/index.action seems struts alike..

johansch 13y ago

There is an interesting comment at techcrunch: http://fyre.it/tjlVmC.4 http://fyre.it/tjlVmC.4 "[...] One of those bugs have provided me access to users details etc. I immediately reported this to Apple. I have taken 73 users details (all apple inc workers only) and prove them as an example. 4 hours later from my final report Apple developer portal gas closed down and you know it still is. I have emailed and asked if I am putting them in any difficulty so that I can give a break to my research. I have not gotten any respond to this.. [...] "

cromwellian 13y ago
Looks like Apple is using Google Web Toolkit, those are GWT RPC responses. He probably found an CSRF attack.

tater 13y ago

Theres a security researcher commenting on techcrunch claiming he's responsible for the breach here http://fyre.it/tjlVmC.4 http://fyre.it/tjlVmC.4 His proof uploaded to youtube: http://www.youtube.com/watch?v=q000_EOWy80 http://www.youtube.com/watch?v=q000_EOWy80

kyrra 13y ago
Taking 40k records is more than just penetration testing.

jhspaybar 13y ago

For what it's worth, Wednesday morning at 4am I had an email account associated with my developer account compromised(they both stupidly used the same password). This account was used for almost nothing but accessing my developer accounts at Apple. At the time, I thought my Apple accounts might be in trouble and I immediately changed all my Apple related passwords as well as regained control of my email account. I'm now wondering if the breach might have gone the other direction...

jhspaybar 13y ago
At the time I re-secured the two accounts, I also changed my apple developer account to a new email with 2-factor auth. Apple is still sending these announcements to the email I changed >72 hours ago.

rimantas 13y ago

I got a feeling that the most outraged never used Apple developer portal in their life.

jlebrech 13y ago

glad that i use a password manager and disable no-paste from firebug in order to login.

noja 13y ago

> Sensitive personal information was encrypted sigh Tell us exactly what was and what wasn't encrypted.

zztop 13y ago

I can't feel too bad for Apple. They use WW/Struts but when was the last time they contributed to the project? They never have. Open source volunteers do their best but unless big corporations want to spend their own money, and do their own security assessments, and contribute back anything they find, what do you expect? It's great when you get things for free, but when you're sitting on billions, send some back to the community you're using code from.