10 ms·
AppleID password brute force proof-of-concept
- cr3ative 12y agoThis is interesting, but it seems irresponsible to even attempt expose the endpoint at fault for this until it is fixed.
- eknkc 12y agoWeird that this surfaces right after the celebrity photo leak eveyone attributes to an iCloud breach..
- guipsp 12y agoThis attack was already described by JB'ers for a long time.
- atmosx 12y agoNot weird at all, makes perfect. The code/idea is so trivial that I would find it hard to believe any accusations on the author of the code... One could probably modify a much more sophisticated/fast brute-force software to attack iCloud, like hydra[1]. Given the deep pockets Apple has, I don't understand how something like this was even possible. [1] https://www.thc.org/thc-hydra/ https://www.thc.org/thc-hydra/
- joshschreuder 12y agoCurrently the rumour is that the photo leak is an underground celeb photo sharing ring, where you use photos you've hacked to get access to more photos, and isn't limited to iCloud / Apple, but who knows.
- mogui 12y agoanyone has confirmed that the leak is from icloud and thats the way they did it?
- maximumoverload 12y agoNobody is sure how they did it. Or even if it comes from iCloud. The leakers themselves claim it was from iCloud (the actual leaker only bought it online from various hackers though, again according to him).
- sergiotapia 12y agoAccording to the person who is actually leaking this pictures to popular forums, he acquired many of the pictures either by trading or buying them from the -real- hackers on one of those shady online marketplaces. He claims the hackers got them from iCloud hacks, and other more social engineering hacks.
- contingencies 12y agoDoes anyone else prefer to entirely avoid signing up for an Apple ID? I absolutely refuse to do so, and therefore use only software that doesn't require it. I suspect I'm not entirely alone out here on the sidelines...
- antimagic 12y agoIt should be noted that the attack has just been patched by Apple, so no longer works....
- 5414h 12y agodoes this mean that you can bypass the icloud activation ?
- camillomiller 12y agoNo it has nothing to do with it. It's just a script exploiting the former lack of a brute force containment measure on Find My iPhone's login interface, now patched.
- RyanZAG 12y agoHopefully apple is doing more than just fixing the code flaw, and is using logs to see which emails had brute force attempted on them and locked/reset those apple ids.
- andrewchambers 12y agoDictionary attacks are incredibly effective. Humans have a hard time coming up with unique passwords.
- crocowhile 12y agoThey are also quite easy to prevent, though.
- andrewchambers 12y agoThey are, but the average granny or non tech person doesn't care enough.
- crocowhile 12y agoI was thinking server side..
- aianus 12y agoIt'd be nice if Windows/OSX/iOS/Android came with 1Password out of the box. It's both easier to use and more secure than manual passwords, which is a rare combination.
- stephenr 12y agoSafari on OSX & iOS does do random password suggestions, out of the box.
- Geee 12y agoI don't know if this was the attack used in the hack, but it is really, really bad news for Apple. The public is not going to trust iCloud any more. I'm pretty sure Apple will drop iWallet from the keynote, or it'll end up like their maps.
- simonh 12y agoSince they've already patched it, this seems unlikely.
- herghost 12y agoYeah, no one plays Playstation since the Sony hack. And I bet no one shops at Target any more. TKMaxx ceased trading right after their hack. Linked In is a thing of the past.
- adventured 12y agoDon't forget eBay, they went out of business. Adobe has also shut down.
- gwern 12y agoTarget's quarterly revenue did fall after the hack.
- threeseed 12y agoI think you're on a roll there. You sure Apple won't also get rid of TouchID as well ?
- mikeash 12y ago"End up like their maps," meaning frequently used by the vast majority of iDevice owners? I'm no fan of Apple Maps. I pretty much only use it when I have to (e.g. because Find My Friends uses it) or to make fun of it. But there are a ton of people who don't care and just use the default. Even among my tech-savvy programmer friends it's common.
- Thesaurus 12y agoIt's sad that there aren't legal requirements for security hardening. There are massive corporations which retain sensitive information that are low hanging fruit for script kiddies.
- kmfrk 12y agoThere is if a company promises the kind of security in marketing, though. SnapChat got slapped (and just that) for promising ephemeral messaging: http://www.ftc.gov/news-events/press-releases/2014/05/snapchat-settles-ftc-charges-promises-disappearing-messages-were http://www.ftc.gov/news-events/press-releases/2014/05/snapch....
- Cthulhu_ 12y agoidk, I can imagine the recent celebrity leaks would sue Apple for allowing those pictures to be distributed. Of course, I'm sure Apple's got a clause in its iCloud T&C's that makes them deny liability.
- inglor 12y agoHe's dead Jim https://twitter.com/hackappcom/status/506383498333007872 https://twitter.com/hackappcom/status/506383498333007872 Still, I expected better from Apple. Props for the fast patch.
- camillomiller 12y agoNot so fast. This can very well be the leak used to access the celebs nude pics. Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there. What do you guys think? Addendum: the way it went down on 4chan points towards someone that is not an expert on extortions. You don't go to the public for some pocket change when you can have publications or the celebs paying you hundreds of thousands of dollars for those pictures. Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to.
- elorant 12y agoSounds plausible. And if it’s not this particular bug it may very well be some other. I find it hard to believe that someone just hacked his way into 400+ phones without any kind of glitch in the system. And judging by the fact that he went only for pictures and videos it doesn’t sound like an elaborate scam that could use high profile hacks like a fake connection antenna or something equally sophisticated.
- camillomiller 12y agoBefore the bug got public, I was thinking of some sort of Bluetooth honeypot attack at a big event, say the Oscars, or Grammys
- IBM 12y ago@nikcub seems to think it wasn't this. https://twitter.com/nikcub/status/506421890517200896 https://twitter.com/nikcub/status/506421890517200896
- delackner 12y agoHow is it ethical to distribute this without first disclosing to apple and waiting for a fix at least a few days?
- orian 12y ago"The end of fun, Apple have just patched"
- mark2456 12y agoEasy answer: It is not.
- camillomiller 12y agoIt is not and it probably had consequences (celebrity nude pics leak).
- tomjen3 12y agoSimple: it is Apples problem if their servers aren't secure. You don't owe apple free work. Delayed disclosure is a nicety, not something you are obligated to do.
- shapov 12y agoSo there is no ethical responsibility to protect the users who will be left vulnerable to this exploit? Remember the danger here is screwing people who have iCloud accounts. It's not like Julie the housewife in Minnesota, had any say in the security of Apple's products.
- MichaelGG 12y agoMaybe the harm caused to a few people is worth the publicity and increased awareness.
- Drakim 12y agoOne problem is that if the exploit is given silently to the company, they often don't change any of their practices (even if they fix that particular exploit), and more exploits soon surface, and maybe this time by people who plan to abuse them instead of telling the company. By going loud and public, you ensure that the company has to do something to save face. It can't just be forgotten on some manager's desk. And the fact is, you, as part of the public, would only know about the times when somebody goes loud about an exploit. For all you know, there might have been hundreds upon hundreds of times when security researches have gone to the company and been outright ignored, and when one finally goes loud with what he has found, you say "He really should have done this more quietly, it would have been much more responsible"
- josteink 12y agoI guess some female celebrities are going to reconsider Android next time they buy a smartphone.
- joeyspn 12y agoCyanogenMod specifically...
- letmechimein 12y agoAgree. I can totally see a celeb buying an Android then going on line and hunting CyanogenMod and then flashing their phone.
- svenkat 12y agoGood point. They're probably too poor to afford to hire someone to do it for them. /s
- UnoriginalGuy 12y agoYour typical Android phone has 2-3 built in backup options (e.g. Google+ photo backup, Google Cloud Backup, [manufacturer] backup). So unless those are all well secured (and they may be, no clue) then moving to Android is no magical fix. A better way of doing things is making it more clear to people what they are and aren't backing up. I'm sure for the majority of people backing up nudes is unintentional.
- joeyspn 12y agoThis whole "exploit / massive celebrity pics leak" is surreal... Is this Apple's answer to Cloud to Butt Google Chrome's extension? That's the reason why I will never trust the cloud for personal stuff (for non-critical professional stuff is ok)... I'd only be willing to test MaidSafe, after they reach a stable release...
- deleted 12y ago[deleted]
- Cthulhu_ 12y agoSo how could people use this to, for example, access people's photo's? Doesn't the two-factor authentication kick in whenever someone logs in from an untrusted device?
- keypusher 12y agoTwo-factor authentication is optional and not enabled by default. Not sure if there is email confirmation required when logging in from an untrusted device the first time.
- kirk21 12y agoOther people getting mails from Apple saying people tried to reset your Apple ID? They tried several times just an hour ago (was not checking my mail)...
- Dzordz42 12y agoThe bomb on Apple iOS security is here. My friend bypass the iCloud activation screen lock whit the hack tool from this page http://bypassicloudactivationlock.blogspot.com/ http://bypassicloudactivationlock.blogspot.com/ Look it if you have this problem - you can solve it here
- Dzordz42 12y agoThe bomb on Apple iOS security is here. My friend bypass the iCloud activation screen lock whit the hack tool from this page http://bypassicloudactivationlock.blogspot.com/ http://bypassicloudactivationlock.blogspot.com/ Look it if you have this problem
- iPhoneunlockpro 12y agoI solve the problem whit bypass iCloud activation screen lock on my iPhone from Apple . Hakers hack it !!! This bypass iCloud software is available on this page : www.bypassicloudactivationlock.net . This is a survey page , so for downloading the tool I must compleate a survey ( I download Flash player before the tool ) . Nice job hackers. Great work ...
- surendrapratap 12y agox@508585 surendrapratap