4 ms·

He's dead Jim https://twitter.com/hackappcom/status/506383498333007872 https://twitter.com/hackappcom/status/506383498333007872 Still, I expected better from A

by inglor 12y ago

He's dead Jim https://twitter.com/hackappcom/status/506383498333007872 https://twitter.com/hackappcom/status/506383498333007872 Still, I expected better from Apple. Props for the fast patch.

camillomiller 12y ago
Not so fast. This can very well be the leak used to access the celebs nude pics. Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there. What do you guys think? Addendum: the way it went down on 4chan points towards someone that is not an expert on extortions. You don't go to the public for some pocket change when you can have publications or the celebs paying you hundreds of thousands of dollars for those pictures. Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to.
- elorant 12y ago
  Sounds plausible. And if it’s not this particular bug it may very well be some other. I find it hard to believe that someone just hacked his way into 400+ phones without any kind of glitch in the system. And judging by the fact that he went only for pictures and videos it doesn’t sound like an elaborate scam that could use high profile hacks like a fake connection antenna or something equally sophisticated.
  - camillomiller 12y ago
    Before the bug got public, I was thinking of some sort of Bluetooth honeypot attack at a big event, say the Oscars, or Grammys
- IBM 12y ago
  @nikcub seems to think it wasn't this. https://twitter.com/nikcub/status/506421890517200896 https://twitter.com/nikcub/status/506421890517200896
  - Quarrelsome 12y ago
    he's assuming from when the tool was released. The exploit was in the wild for much longer.
    - IBM 12y ago
      The leaker got doxxed by 4chan and doesn't seem capable of discovering the exploit on his own. Though he's commented to Buzzfeed denying it was him (but anyone would). http://www.buzzfeed.com/charliewarzel/bryan-hamade-blamed-by-redditors-for-jennifer-lawrence-leak#1ldqbpf http://www.buzzfeed.com/charliewarzel/bryan-hamade-blamed-by... @nikcub still thinks it's him https://twitter.com/nikcub/status/506465151562694656 https://twitter.com/nikcub/status/506465151562694656
    - waterlesscloud 12y ago
      The password list for this particular implementation is pretty limited. I doubt all the celebs hacked had a password on that list. The concept may well have been used with different code / pw dictionary.
    - nikcub 12y ago
      i'm watching them continue to attempt to hack new accounts on a forum, so whatever apple patched with this bug wasn't it.
- waterlesscloud 12y ago
  Address books are backed up on icloud aren't they? So you get into one celeb account and it's easy from there. Use their address book to find agent/manager/publicists's info, then an endless chain of celebs from there.
  - elorant 12y ago
    You can find agents from IMDB Pro too. It's not that hard if you're determined (or obsessed for that matter).
- brymaster 12y ago
  > Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to. If only people shared the same feelings about illegal mass surveillance and the lax security of the companies responsible for these breaches.
  - camillomiller 12y ago
    I do, I think Snowden is a hero. That does not stop me from thinking that this kind of behavior should be punished exemplarily. This is no "new product" leak, nor a ethical hack performed to expose a hidden truth. It's just some private pictures stolen and uploaded to the internet for the public to see. Jennifer Lawrence has all the rights to take private nude pictures of herself in the privacy of her own house. Nobody has the right to steal them, even if her iCloud password was Katniss.
coffeedrinker 12y ago
>Still, I expected better from Apple. Here is another flaw in iPhone. If a person is casting their screen to an Apple TV and must enter their PIN number, the screen will highlight each button press on the TV. No fingers in the way to even block it. Simple solution: don't broadcast this or don't provide screen feedback for entering the PIN.

by inglor 12y ago

He's dead Jim https://twitter.com/hackappcom/status/506383498333007872 https://twitter.com/hackappcom/status/506383498333007872 Still, I expected better from Apple. Props for the fast patch.

camillomiller 12y ago

Not so fast. This can very well be the leak used to access the celebs nude pics. Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there. What do you guys think? Addendum: the way it went down on 4chan points towards someone that is not an expert on extortions. You don't go to the public for some pocket change when you can have publications or the celebs paying you hundreds of thousands of dollars for those pictures. Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to.

elorant 12y ago
Sounds plausible. And if it’s not this particular bug it may very well be some other. I find it hard to believe that someone just hacked his way into 400+ phones without any kind of glitch in the system. And judging by the fact that he went only for pictures and videos it doesn’t sound like an elaborate scam that could use high profile hacks like a fake connection antenna or something equally sophisticated.
- camillomiller 12y ago
  Before the bug got public, I was thinking of some sort of Bluetooth honeypot attack at a big event, say the Oscars, or Grammys
IBM 12y ago
@nikcub seems to think it wasn't this. https://twitter.com/nikcub/status/506421890517200896 https://twitter.com/nikcub/status/506421890517200896
- Quarrelsome 12y ago
  he's assuming from when the tool was released. The exploit was in the wild for much longer.
  - IBM 12y ago
    The leaker got doxxed by 4chan and doesn't seem capable of discovering the exploit on his own. Though he's commented to Buzzfeed denying it was him (but anyone would). http://www.buzzfeed.com/charliewarzel/bryan-hamade-blamed-by-redditors-for-jennifer-lawrence-leak#1ldqbpf http://www.buzzfeed.com/charliewarzel/bryan-hamade-blamed-by... @nikcub still thinks it's him https://twitter.com/nikcub/status/506465151562694656 https://twitter.com/nikcub/status/506465151562694656
  - waterlesscloud 12y ago
    The password list for this particular implementation is pretty limited. I doubt all the celebs hacked had a password on that list. The concept may well have been used with different code / pw dictionary.
  - nikcub 12y ago
    i'm watching them continue to attempt to hack new accounts on a forum, so whatever apple patched with this bug wasn't it.
waterlesscloud 12y ago
Address books are backed up on icloud aren't they? So you get into one celeb account and it's easy from there. Use their address book to find agent/manager/publicists's info, then an endless chain of celebs from there.
- elorant 12y ago
  You can find agents from IMDB Pro too. It's not that hard if you're determined (or obsessed for that matter).
brymaster 12y ago
> Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to. If only people shared the same feelings about illegal mass surveillance and the lax security of the companies responsible for these breaches.
- camillomiller 12y ago
  I do, I think Snowden is a hero. That does not stop me from thinking that this kind of behavior should be punished exemplarily. This is no "new product" leak, nor a ethical hack performed to expose a hidden truth. It's just some private pictures stolen and uploaded to the internet for the public to see. Jennifer Lawrence has all the rights to take private nude pictures of herself in the privacy of her own house. Nobody has the right to steal them, even if her iCloud password was Katniss.

coffeedrinker 12y ago

>Still, I expected better from Apple. Here is another flaw in iPhone. If a person is casting their screen to an Apple TV and must enter their PIN number, the screen will highlight each button press on the TV. No fingers in the way to even block it. Simple solution: don't broadcast this or don't provide screen feedback for entering the PIN.