7 ms·

Ibrahim Balic breaks silence on hacking Apple developer site

75 points by Bharath1234 13y ago

reggplant 13y ago
The article states that the website is back up but as of now 24/07 11:08GMT that is not the case. This is terrible timing for me since I came back from travelling on Thursday and haven't been able to get on with working in iOS 7. I really wish Apple were able to provide us with more information on time-scales.
- esamek 13y ago
  Yeap, no dice. Still offline 7/24 7:23AM EST
- deleted 13y ago
  [deleted]
- thornjm 13y ago
  I would not trust everything the article reports. Slightly off topic, but for those unfamiliar with news.com.au it is a low quality sensationalist outlet who frequently post link bait material. Some of their stories are shared from their News Corp partners but the rest is celebrity gossip and reddit reposts.
- mattstocum 13y ago
  They may have checked developer.apple.com, which is up. It's just when you try to get into the dev centers that you get the notice.
  - k-mcgrady 13y ago
    I noticed today that the resolution center also isn't working right. I can receive/view messages but get an error when I try to send them. Unsure if it's linked to the dev center being down but I would guess it is.
- RandallBrown 13y ago
  Especially terrible timing for me. I hadn't gotten around to updating my phone off the original iOS 7 beta. Guess what expired yesterday? The original iOS 7 beta. My phone is essentially a brick now until I can update to a non-expired version of iOS.
  - nicholassmith 13y ago
    If you've got a model a1429 I actually have a copy sat on my machine, I can put it on Dropbox and give you a link.
  - xuki 13y ago
    You still can roll back to 6.1.1. And this is exactly why you don't install a beta OS on your main phone. Btw, you can download beta 3 using a certain p2p protocol.
bsaul 13y ago
The fact that the site is still down makes wonder what they're doing. Provided that the hacker did report all the security bugs to Apple, one could suppose that it would only require of couple of days to fix the bugs, put the site back online, and start performing a full security audit along with massive code rewrite in parallel. The only reason i see why they would still be offline, is that they instead decided to rewrite some crucial portion of the code from the ground up (which is what the email they sent the other day would suggest). But 1 week in emergency mode for a company like Apple really means rewriting TONS of code... <offtopic> Anyone know the state of Objective-C on the server ? I really like that language now that it has ARC, and i wonder if apple is still using that technology on the server side </offtopic>
- threeseed 13y ago
  The developer portal is written in WebObjects/Java. And whilst I am sure they are using Project Wonder which wraps up a lot of the old WebObjects code there is still the fact that it is a deprecated technology. And it's never just write some code and deploy in these situations. It will involve testers signing it off, performance testing, security testing, deployment etc. So all those parts add up. Plus there's no "Steve Jobs will fire you" threat breathing down your neck.
  - protomyth 13y ago
    I do wish they had converted WebObjects back to Objective-C and released EOF with it. It would have been nice to write the app and the server code in the same language and environment.
    - bsaul 13y ago
      Completely agree. Objective-C with ARC and blocks has the perfect blend of dynamic language + static typing that i'm looking for (although the syntax really feels like a hack). Now, libraries for the server are clearly not there, and i suppose that you would need to write them in C to get descent performances, which is unrealistic i guess.
    - 13y ago
terabytest 13y ago
With the iOS 7 launch already on a tight schedule this is a disgrace for both Apple and developers trying to renovate their apps.
- mikhailt 13y ago
  disgrace |disˈgrās| noun loss of reputation or respect, esp. as the result of a dishonorable action [ in sing. ] a person or thing regarded as shameful and unacceptable How is it a disgrace? You're making it sound like Apple meant for this to happen, this could've happen to any companies. Apple should not be portrayed to be perfect at everything, they're lead by humans who can make mistakes, just like everybody else. Apple's fixing the problem, it is taking longer than they expected it to. Nothing shameful or unacceptable here, just a nature of technology and mistakes/bugs. We do not know the full scale of the problem, media needs to stop acting like it's just 13 bugs reported by a hacker (sorry, if he wants to be a "security researcher", he could've acted like one). It is entirely possible that the 13 bugs was just a small scale of the problem and Apple've found more extensive problems that can't be fixed quickly. iOS 7 can be delayed to make up for the loss of time developers need or the developers will have to delay their apps. Stuff happens, we just have to rough it out, and move on.
  - 67726e 13y ago
    > How is it a disgrace? You're making it sound like Apple meant for this to happen, this could've happen to any companies. Well if Ibrahim is to be believed, Apple failed to reasonably handle his disclosure of the security flaws. Apple is not entirely at fault, but they surely failed to protect their users' data. Users trusted Apple to prevent this from happening, but they have failed. That is a disgrace.
    - deleted 13y ago
      [deleted]
    - dubcanada 13y ago
      He created a bug in a portal of hundreds of thousands of bugs. That was not even two weeks ago. I'd be surprised if someone had even looked at the bug until a few days ago. Then they did some investigating, determined it to be true and ran up the manager ladder till someone said shut it down.
smandou 13y ago
"I don't want to be black listed" Not everybody is Edward Snowden...
kybernetyk 13y ago
> I have taken 73 users details (all apple inc workers only) and prove them as an example ... > I have over 100,000+ users details ... > I do not want my name to be in blacklist One would think that 73 compromised Apple employee accounts should be enough to make a point. Why would he take another 100k user accounts hostage?
- jasallen 13y ago
  That probably wouldn't have shut down the site, which in turn would not have gotten the attention. He wasn't making a point to Apple, who already knew the bugs existed, he was making Apple do something about it. He did.
  - kybernetyk 13y ago
    > That probably wouldn't have shut down the site So the guy is a hero. Thanks for disturbing real life businesses for several days, I guess? > he was making Apple do something about it. This behavior is endemic for the self-righteous security "researcher" scene. "I found a bug - you must do what I say, NOW, or else ..." It's not like Apple would have ignored his bug reports if he wouldn't have scraped 100k developer accounts.
    - ZoF 13y ago
      He says he reported the bug previously and got no response... So, it's very much "like Apple would have ignored his bug reports..."
      - agent123 13y ago
        What he leaves out is that he waited less than a day for a response. (You can see this from the radar shown in his video)
    - jasallen 13y ago
      "This behavior is endemic for the self-righteous security 'researcher' scene" Yes, and that behavior is moving us to a world where corporations have to be careful what they put out, not just rush the newest shiny feature out faster. Besides, who do you want exploiting the bug, a self-righteous guy who 'may' be in it for his own glory, or an out-and-out criminal?
junto 13y ago
This kind of pen-testing, without previous authorization, is a very risky enterprise if you live in the UK. The Computer Misuse Act 1990 expressly forbids "unauthorised access". Sections 1-3 of the Act introduced three criminal offences: - unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000); - unauthorised access with intent to commit or facilitate commission of further offences, punishable by 6 months/maximum fine on summary conviction or 5 years/fine on indictment; - unauthorised modification of computer material, subject to the same sentences as section 2 offences. If he had been contracted to pen-test the website by Apple then it would be a different matter.
- at-fates-hands 13y ago
  Agreed. I would think cases like the Andrew Auernheimer (who was convicted and sentenced to three years in jail) would be a wake up call for pen testing sites without prior authorization. Taking the 73 accounts is arguable in court. Once you cross the line and scrap another 100K users in order to get their attention and shut the developer site down - you've just boxed yourself. There is no really no defense for doing something like this, regardless of your motives.
- gcb0 13y ago
  Those laws are retarded and it's sad to see them defended in HN. Always try to do a parallel without computers to see if a computer law pass the retarded test. In this case "it's illegal to enter a door left wide open for months, pick up a wallet full of money from a desk visible inside thru said open door, and return it to the home owner with all the money and a note about closing the door because it's not a safe neighborhood"
  - zxcvb 13y ago
    It's sad to see another stupid comment on HN. He never defended the laws. He was just stating the facts.
  - squidi 13y ago
    He cannot return the data per se, so there is a difference. Once it leaves Apple's servers it could be less secure and he's not registered as a data controller I'm sure. In your example above, why could the person not just point out that the money was not safe? It's no loss to them if the person does not act on the information.
racl101 13y ago
Heh, he looks like Marv from Home Alone.
tsenkov 13y ago
> The site was put back online yesterday. No it's not.
abelardx 13y ago
I can't trust anyone who spells 'purpose' as 'porpoise' even if English isn't his first language.
sergiotapia 13y ago
I love how they just plop in some random comment from "Marco". Why is he so famous in Mac circles?
- parasubvert 13y ago
  Its pretty simple: 1. Instapaper was very popular. 2. Gruber links to him a lot, and he writes well. More cynically, he has modeled his writing style after Gruber's, so if you want more of a Daring fireball fix, you read Marco. I don't think Marco's opinions really hold anywhere near the weight of John's. Some just have an appreciation for this style of writing.
- notatoad 13y ago
  because he always has something to say. You want a quote from somebody recognizable on an apple-related news story? marco will already have one for you.
alimoeeny 13y ago
I don't know what the correct action here has been, but I know as an Apple developer that apple has been acting very irresponsibly, since the first day they opened the app store about any bug reports or generally any developer communications, at least in my experience. And some part of me is happy that they hit their head against a brick wall, although my own day to day biz is disrupted too.

75 points by Bharath1234 13y ago

The article states that the website is back up but as of now 24/07 11:08GMT that is not the case. This is terrible timing for me since I came back from travelling on Thursday and haven't been able to get on with working in iOS 7. I really wish Apple were able to provide us with more information on time-scales.

esamek 13y ago
Yeap, no dice. Still offline 7/24 7:23AM EST
deleted 13y ago
[deleted]
thornjm 13y ago
I would not trust everything the article reports. Slightly off topic, but for those unfamiliar with news.com.au it is a low quality sensationalist outlet who frequently post link bait material. Some of their stories are shared from their News Corp partners but the rest is celebrity gossip and reddit reposts.
mattstocum 13y ago
They may have checked developer.apple.com, which is up. It's just when you try to get into the dev centers that you get the notice.
- k-mcgrady 13y ago
  I noticed today that the resolution center also isn't working right. I can receive/view messages but get an error when I try to send them. Unsure if it's linked to the dev center being down but I would guess it is.
RandallBrown 13y ago
Especially terrible timing for me. I hadn't gotten around to updating my phone off the original iOS 7 beta. Guess what expired yesterday? The original iOS 7 beta. My phone is essentially a brick now until I can update to a non-expired version of iOS.
- nicholassmith 13y ago
  If you've got a model a1429 I actually have a copy sat on my machine, I can put it on Dropbox and give you a link.
- xuki 13y ago
  You still can roll back to 6.1.1. And this is exactly why you don't install a beta OS on your main phone. Btw, you can download beta 3 using a certain p2p protocol.

bsaul 13y ago

The fact that the site is still down makes wonder what they're doing. Provided that the hacker did report all the security bugs to Apple, one could suppose that it would only require of couple of days to fix the bugs, put the site back online, and start performing a full security audit along with massive code rewrite in parallel. The only reason i see why they would still be offline, is that they instead decided to rewrite some crucial portion of the code from the ground up (which is what the email they sent the other day would suggest). But 1 week in emergency mode for a company like Apple really means rewriting TONS of code... <offtopic> Anyone know the state of Objective-C on the server ? I really like that language now that it has ARC, and i wonder if apple is still using that technology on the server side </offtopic>

threeseed 13y ago
The developer portal is written in WebObjects/Java. And whilst I am sure they are using Project Wonder which wraps up a lot of the old WebObjects code there is still the fact that it is a deprecated technology. And it's never just write some code and deploy in these situations. It will involve testers signing it off, performance testing, security testing, deployment etc. So all those parts add up. Plus there's no "Steve Jobs will fire you" threat breathing down your neck.
- protomyth 13y ago
  I do wish they had converted WebObjects back to Objective-C and released EOF with it. It would have been nice to write the app and the server code in the same language and environment.
  - bsaul 13y ago
    Completely agree. Objective-C with ARC and blocks has the perfect blend of dynamic language + static typing that i'm looking for (although the syntax really feels like a hack). Now, libraries for the server are clearly not there, and i suppose that you would need to write them in C to get descent performances, which is unrealistic i guess.
  - 13y ago

terabytest 13y ago

With the iOS 7 launch already on a tight schedule this is a disgrace for both Apple and developers trying to renovate their apps.

mikhailt 13y ago
disgrace |disˈgrās| noun loss of reputation or respect, esp. as the result of a dishonorable action [ in sing. ] a person or thing regarded as shameful and unacceptable How is it a disgrace? You're making it sound like Apple meant for this to happen, this could've happen to any companies. Apple should not be portrayed to be perfect at everything, they're lead by humans who can make mistakes, just like everybody else. Apple's fixing the problem, it is taking longer than they expected it to. Nothing shameful or unacceptable here, just a nature of technology and mistakes/bugs. We do not know the full scale of the problem, media needs to stop acting like it's just 13 bugs reported by a hacker (sorry, if he wants to be a "security researcher", he could've acted like one). It is entirely possible that the 13 bugs was just a small scale of the problem and Apple've found more extensive problems that can't be fixed quickly. iOS 7 can be delayed to make up for the loss of time developers need or the developers will have to delay their apps. Stuff happens, we just have to rough it out, and move on.
- 67726e 13y ago
  > How is it a disgrace? You're making it sound like Apple meant for this to happen, this could've happen to any companies. Well if Ibrahim is to be believed, Apple failed to reasonably handle his disclosure of the security flaws. Apple is not entirely at fault, but they surely failed to protect their users' data. Users trusted Apple to prevent this from happening, but they have failed. That is a disgrace.
  - deleted 13y ago
    [deleted]
  - dubcanada 13y ago
    He created a bug in a portal of hundreds of thousands of bugs. That was not even two weeks ago. I'd be surprised if someone had even looked at the bug until a few days ago. Then they did some investigating, determined it to be true and ran up the manager ladder till someone said shut it down.

smandou 13y ago

"I don't want to be black listed" Not everybody is Edward Snowden...

kybernetyk 13y ago

> I have taken 73 users details (all apple inc workers only) and prove them as an example ... > I have over 100,000+ users details ... > I do not want my name to be in blacklist One would think that 73 compromised Apple employee accounts should be enough to make a point. Why would he take another 100k user accounts hostage?

jasallen 13y ago
That probably wouldn't have shut down the site, which in turn would not have gotten the attention. He wasn't making a point to Apple, who already knew the bugs existed, he was making Apple do something about it. He did.
- kybernetyk 13y ago
  > That probably wouldn't have shut down the site So the guy is a hero. Thanks for disturbing real life businesses for several days, I guess? > he was making Apple do something about it. This behavior is endemic for the self-righteous security "researcher" scene. "I found a bug - you must do what I say, NOW, or else ..." It's not like Apple would have ignored his bug reports if he wouldn't have scraped 100k developer accounts.
  - ZoF 13y ago
    He says he reported the bug previously and got no response... So, it's very much "like Apple would have ignored his bug reports..."
    - agent123 13y ago
      What he leaves out is that he waited less than a day for a response. (You can see this from the radar shown in his video)
  - jasallen 13y ago
    "This behavior is endemic for the self-righteous security 'researcher' scene" Yes, and that behavior is moving us to a world where corporations have to be careful what they put out, not just rush the newest shiny feature out faster. Besides, who do you want exploiting the bug, a self-righteous guy who 'may' be in it for his own glory, or an out-and-out criminal?

junto 13y ago

This kind of pen-testing, without previous authorization, is a very risky enterprise if you live in the UK. The Computer Misuse Act 1990 expressly forbids "unauthorised access". Sections 1-3 of the Act introduced three criminal offences: - unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000); - unauthorised access with intent to commit or facilitate commission of further offences, punishable by 6 months/maximum fine on summary conviction or 5 years/fine on indictment; - unauthorised modification of computer material, subject to the same sentences as section 2 offences. If he had been contracted to pen-test the website by Apple then it would be a different matter.

at-fates-hands 13y ago
Agreed. I would think cases like the Andrew Auernheimer (who was convicted and sentenced to three years in jail) would be a wake up call for pen testing sites without prior authorization. Taking the 73 accounts is arguable in court. Once you cross the line and scrap another 100K users in order to get their attention and shut the developer site down - you've just boxed yourself. There is no really no defense for doing something like this, regardless of your motives.
gcb0 13y ago
Those laws are retarded and it's sad to see them defended in HN. Always try to do a parallel without computers to see if a computer law pass the retarded test. In this case "it's illegal to enter a door left wide open for months, pick up a wallet full of money from a desk visible inside thru said open door, and return it to the home owner with all the money and a note about closing the door because it's not a safe neighborhood"
- zxcvb 13y ago
  It's sad to see another stupid comment on HN. He never defended the laws. He was just stating the facts.
- squidi 13y ago
  He cannot return the data per se, so there is a difference. Once it leaves Apple's servers it could be less secure and he's not registered as a data controller I'm sure. In your example above, why could the person not just point out that the money was not safe? It's no loss to them if the person does not act on the information.

racl101 13y ago

Heh, he looks like Marv from Home Alone.

tsenkov 13y ago

> The site was put back online yesterday. No it's not.

abelardx 13y ago

I can't trust anyone who spells 'purpose' as 'porpoise' even if English isn't his first language.

sergiotapia 13y ago

I love how they just plop in some random comment from "Marco". Why is he so famous in Mac circles?

parasubvert 13y ago
Its pretty simple: 1. Instapaper was very popular. 2. Gruber links to him a lot, and he writes well. More cynically, he has modeled his writing style after Gruber's, so if you want more of a Daring fireball fix, you read Marco. I don't think Marco's opinions really hold anywhere near the weight of John's. Some just have an appreciation for this style of writing.
notatoad 13y ago
because he always has something to say. You want a quote from somebody recognizable on an apple-related news story? marco will already have one for you.

alimoeeny 13y ago

I don't know what the correct action here has been, but I know as an Apple developer that apple has been acting very irresponsibly, since the first day they opened the app store about any bug reports or generally any developer communications, at least in my experience. And some part of me is happy that they hit their head against a brick wall, although my own day to day biz is disrupted too.