12 ms·
Apple Confirms That Its Dev Center Has Been Breached By Hackers
- spaux 13y agoWord is, apns is still up, only the dev center has been effected.
- deleted 13y ago[deleted]
- Zikes 13y agoSounds like Weev is about to get some company.
- deleted 13y ago[deleted]
- ars 13y ago> Credit card data was not compromised So? Who cares about credit card data - it so easy to just send a list of compromised numbers to the banks and get new numbers. I've been sent new cards at least twice without being told why they are changing the number, except for some nebulous "security measure", so they clearly do do this. Of all things to worry about credit card numbers hardly rank. I don't know how it works - but can the breach allow attackers to upload modified apps in the name of the developer?
- deleted 13y ago[deleted]
- T-Winsnes 13y agoI would care. If I know that it hasn't been compromised I don't have to get a new number and go around to all the services I'm registered with to update my credit card details. Saves me a lot of hassle.
- ars 13y agoThey are supposed to update those automatically.
- T-Winsnes 13y agoWho are? I use my credit card at multiple services. Is the bank going to call around to services that I have paid for previously and tell them my new credit card details? I hope not
- mpeg 13y agoWhen you get a new credit card, only the last 4 numbers will change, and your bank might charge the new credit card for payments that were supposed to be going to the old card if they are deemed low risk (if it's something you used to pay for before) Of course, YMMV, this is just what my bank does.
- 300bps 13y agoNot even close. I work at a large bank and often 12 or more numbers change. Beyond that it is irrelevant how many numbers change. Beyond that only approved but unsettled transactions will go through under the old number. You can't continue to use the old number for new transactions.
- ars 13y ago> Is the bank going to call around to services that I have paid for previously and tell them my new credit card details? I hope not Yes. Anyplace that bills you regularly on the old number will automatically get the new number. > You can't continue to use the old number for new transactions. It depends on how you define new. A new biller, then correct. But if it's a biller that you have an existing relationship with, i.e. they bill you every month, then they do send them the new numbers (and/or allow them to use the old number). I can't say if this is a global policy of all issuers, but I can say that I've experienced it. I've also seen it in the fine print when I signed up for repeated billing.
- k-mcgrady 13y agoPeople using debit cards would care. It's much more difficult to get payments refunded with them.
- atomicbird 13y ago> but can the breach allow attackers to upload modified apps in the name of the developer? It doesn't look like they can. Uploading apps to the app store is done via iTunes Connect. That's always been a separate login from the developer center, and it has not been down during the current dev center outage.
- ChuckMcM 13y agoBummer, and they have earnings to announce on Tuesday.
- MrSourz 13y agooh shit. Hadn't thought much about that.
- Subuatai 13y agoThere must be some serious mudbutt going on with the upper level executives right now.
- ams6110 13y agoThe general public won't care so much about the dev center. If iTunes, App Store, or Apple Store had been hacked that would be much more serious from a PR standpoint.
- ChuckMcM 13y agoMy thought was not that the general public would care, rather it was that institutions own AAPL stock do care, and if they think that this event will affect Apple's ability to deliver product or recruit developers they may decide shift their portfolio's holdings to a different tech company with more upside.
- ancarda 13y ago>In order to prevent a security threat like this from happening again, we're completely overhauling our developer systems. I wonder how out of date it was? >updating our server software Why now? This should be done as soon as new releases are available. There's even packages like unattended-upgrades that do it for you.
- nknighthb 13y ago> There's even packages like unattended-upgrades that do it for you. Anyone deliberately installing such a package on a production server is dangerous. Their profound lack of judgement disqualifies them from any form of access to servers I control. Updates break things. They get approved by a knowledgable human familiar with the system and installed with suitable engineers standing by, or they don't get installed.
- duey 13y agoHaving out of date packages on production servers is also dangerous. It really depends what you consider your biggest risk to be: downtime vs getting hacked due to an out-of-date packages? I personally would take downtime, but every place is different.
- kisielk 13y agoI'm sure Apple has the resources to hire enough sysadmins to keep their systems up to date. The question is why it isn't happening.
- czhiddy 13y agoIt looks like the exploit used a vulnerability in Apache Struts that was revealed on 7/16 : https://news.ycombinator.com/item?id=6081428 https://news.ycombinator.com/item?id=6081428 Given that, your question of "how can we completely avoid zero-day attacks" is nonsensical.
- nknighthb 13y ago
- untog 13y agoIt would be nice if they could knock out some easy wins early. I was trying to set up a new machine on Friday- I wanted to install Homebrew, but it required XCode command line tools. Which are on Apple's dev portal. So I can't use Homebrew (or build anything at all) on that machine. These tools and other static downloads (SDKs etc.) are clearly not affected by this breach - can't they rehost them somewhere in the short term?
- axxl 13y agoIf you download Xcode via the Mac App Store, I believe you can still install the command line tools from the downloads pane in the Xcode preferences. I updated mine yesterday from there no problem. Hope it works for you!
- lordlarm 13y agoIt's available on multiple torrent sites. I just found my self a copy for my newly installed mountain lion.
- general_failure 13y agoTechcrunch comment - http://m.youtube.com/watch?feature=youtu.be&v=q000_EOWy80&desktop_uri=%2Fwatch%3Fv%3Dq000_EOWy80%26feature%3Dyoutu.be http://m.youtube.com/watch?feature=youtu.be&v=q000_EOWy80&de...
- abalone 13y agoActual comment is here: http://fyre.it/tjlVmC.4 http://fyre.it/tjlVmC.4 Says alternately that he's taken 100,000+ user records, or just 73 Apple worker records, or no user details at all. And that he's keeping all the "evidences".
- sillysaurus 13y agoInteresting. Anyone want to weigh in on the ethicality of this? (Either side.) Downloading 100k userdata records seems quite extreme, but is it unethical for a security researcher to do so?
- daeken 13y agoIt is absolutely, unquestionably unethical to do that. There's a huge, huge difference between proving a concept and stealing user data -- no matter what your end goal is. What possible positive outcome could he be looking for in taking this data?
- sillysaurus 13y agoAnyone know if this was illegal, then? Or will his status as a security researcher (albeit one with poor judgement) protect him?
- unimpressive 13y ago>Or will his status as a security researcher (albeit one with poor judgement) protect him? It usually doesn't protect you even if you don't take anything. That's why there's a huge backlash against "responsible disclosure".
- deleted 13y ago[deleted]
- dave1010uk 13y ago3 days seems like a long time to alert people. Releasing the news early would be the right thing to do but keeping it secret until you know the extent of the breach was probably better for their brand.
- rdl 13y agoNot giving any notification for several days was pretty bogus. Probably not actionable under CA law, though. The sad thing is I know several competent people who work at Apple on security, although I think they do OS security not online-services. Apple has proven over and over again that they're utter crap at online services. They're going to be totally pwned at Blackhat w.r.t. iCloud in a week, too. I don't understand why they can't just drop $500mm to $2b on buying one or more competent saas/ops companies to get some real expertise in house, rather than relying on 15 years of accumulated contractor/vendor built crapware.
- kybernetyk 13y ago> why they can't just drop $500mm to $2b on buying one or more competent saas/ops companies to get some real expertise in house I don't know. Look at how huge iCloud and the iTunes store are. Every iOS device sold uses those services. They'd need to buy twitter or facebook to get people that are experts on that scale. If you take the scale into account I don't think that their web services are 'crapware' - especially for a company where those services are only complementary to their main products.
- rdl 13y agoIt doesn't have to be a consumer service; they could buy Akamai or really any decent sized CDN, any of a bunch of network carriers, managed hosting providers, etc. Apple's stuff is all really easy to shard/partition, so it's nowhere near the technical challenge something like Facebook is, where it's largely one big monolithic thing with lots of interconnection. (I wouldn't be suggesting Twitter as a source of amazing ops/security talent, in particular.) Or they could buy Canonical or Red Hat or SUSE, or to stay BSD, iXSystems. Twilio or Github also probably have a high level of ops/tech competence vs. cost to acquire, even if they're dealing with a smaller userbase currently. Valve would be another obvious one. Jobs was right -- in 10 years, iCloud is going to be central to the success or failure of Apple. There's no way I'd pick Apple based solely on iCloud so far; it's markedly inferior to what Google has put together, and actually basically inferior to what a modernized RIM BES could have been.
- k-mcgrady 13y agoHis credibility as a 'security research' is seriously damaged in my opinion for two reasons: 1. He unnecessarily downloaded so many records 2. He made a YouTube video to brag, showing off names and emails in the process.
- duiker101 13y agoI don't think it was for bragging but more trying to cover his ass. But I might even be wrong.
- k-mcgrady 13y agoTrue with his final statement in the video that's what it sounds like he was trying to do. But if he just found the flaw, reported to Apple and did nothing remotely nefarious he shouldn't have felt the need to do the video. It seems to me he knows he shouldn't have downloaded so many records and it trying to backtrack to cover himself.
- mirkules 13y agoA "security researcher" posted a video with compromised accounts claiming to have deleted all the data after reporting the bugs to Apple: http://www.youtube.com/watch?v=q000_EOWy80 http://www.youtube.com/watch?v=q000_EOWy80 It is really unfortunate and irresponsible that data in the video is not obscured.
- Subuatai 13y agoHow is this legal? Seems like someone should be facing charges for this...
- kingkilr 13y agoThe Computer Fraud and Abuses Act is incredibly broad, it's basically impossible to prove a vulnerability like this exists without violating it.
- chmars 13y agoIt's of course NOT legal … I've just reported the video to Google.
- Subuatai 13y agoI've just reported the video to Google sounds like a dirty, dirty euphemism
- draugadrotten 13y agoIt's amusing (and sad) that while the NSA monitors all emails and every single phone calls of all Americans, but still fails to detect and prevent a computer intrusion of this magnitude into Americas largest company.
- grey-area 13y agoThere was no need to take all that data at all. If he was interested in security he could just set up a test account, test the vuln with that account only, and send Apple the results. Job done. I doubt Apple would bother to prosecute for that, they might even thank him. Do they pay bounties for reports on security vulnerabilities? If not they should. Taking all the data and publishing it, and then bragging about it on youtube (!) just leaves him open to prosecution, and I imagine Apple will go after him now for publishing the data of their developers. I'm not sure I understand the logic of publishing this, but there seems to be a mentality of braggadocio among wannabe security researchers - 1. Hack high profile website and publicise it 2. ????? 3. Profit! I'm not sure what step 2 is.
- est 13y agoI am very surprised the root cause of the incident wasn't mentioned by any other HNers This is a serious exploit on Apache Struts 2, a popular Java Web framework known as SSH (Spring, Struts, Hibernate). If you visit many websites, and see URLs ending with .action , it's probably written in Struts 2 S2-016 / CVE-2013-2251, effecting Struts 2.3.15 or lower http://struts.apache.org/release/2.3.x/docs/s2-016.html http://struts.apache.org/release/2.3.x/docs/s2-016.html The exploit was deadly easy to weaponize as the Apache folks blatantly published PoC on their own bulletin Example of server side arbitary Java code (OGNL expressions) execution http://wp3.sina.cn/woriginal/761d2801jw1e6pqfs8hrbj20c70gomyw.jpg http://wp3.sina.cn/woriginal/761d2801jw1e6pqfs8hrbj20c70gomy... Apple.com hacking was published on a popular Chinese security bulletin website http://www.wooyun.org/bugs/wooyun-2013-023444 http://www.wooyun.org/bugs/wooyun-2013-023444 The issue was submitted to APPL on 2013-05-10 but ignored, and went public on 2013-06-24. A Chinese blog on history and technical details of the exploit: http://www.inbreak.net/archives/507 http://www.inbreak.net/archives/507 As a side note, rumor is that about 60% of Chinese goverment, e-commerce, banking, gaming websites was hacked using this S2-016 exploit, database was dumped, and exchanged in underground market. Also past records shows that the Apache Struts team is incompetent at security: http://taosay.net/?p=611 http://taosay.net/?p=611 (Warning: rant in Chinese text)
- fsck--off 13y agoIt was mentioned on this thread, 2 hours ago: https://news.ycombinator.com/item?id=6082212 https://news.ycombinator.com/item?id=6082212 This link points to the top comment on another thread (which has more points and comments as of now) about the Dev Website outage.
- est 13y agoyeah but the reaction was vastly different. I remember the last RoR exploit was quite a thing on HN few months ago. But not this Struts 2 one. Tip: if you see some URL end with .action, it's propably Struts 2 and vunlerable to S2-012, S2-015 and S2-016 such. Besides, apple.com was hacked as early as in May using similar Struts2 exploits.
- ogwyther 13y ago"They waited three days to alert developers because they were trying to figure out exactly what data was exposed" Why couldn't they notify people about the hack, then alert them to it's specifics in due course? Piss poor excuse IMO.
- trosenbaum 13y agoMy guess is that from a PR perspective they might have worried that releasing the information without a definitive scope of impact would have led to days of wild panicked speculation in the media outlets, and userbase. While there was still wild speculation, security was only one of many possible scenarios being discussed, and it was mostly treated like a regular outage. I'm not saying this delay in disclosure was "right" (what if it had ended up worse in scope?), but I agree with sibling post (dave1010uk) that it seems to have worked out better for their brand.
- Tichy 13y agoGreat, and I can't figure out how to change my apple password because it asks me some "security questions" before allowing me to change the pwd (such as "what was your favorite band in high school).
- xixixao 13y agoJust got a bogus "reset apple id password" email. > If you weren't trying to reset your password, don't worry – your account is still secure and no one has been given access to it. Ironic.
- momerath 13y agoYeah, I've gotten two today. Can anyone speak to the aim of these?
- martin_ 13y agoA security researcher has claimed responsibility in a comment[1] on the article citing his intentions were not malicious and he reported 13 bugs to Apple prior to the dev center being taken down [1] http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev-center-has-potentially-been-breached-by-hackers/?hubRefSrc=permalink#lf_comment=87472293 http://techcrunch.com/2013/07/21/apple-confirms-that-the-dev...
- deleted 13y ago[deleted]