9 ms·
Update to Celebrity Photo Investigation
- flog 12y agoIf I was in Hollywood right now I'd be offering high-price security consultation services to teach celeb's how to use 2FA.
- dpeck 12y agoI've spent some time thinking about and talking about ti with friends in the security world before. I think it's a good idea, but falls short in reality. Celebrities arguably don't want it, you'd be a babysitter between them and their devices/APIs. Something they'd likely hate and continuously undermine, especially when a large part of their "job" is connectedness.
- josu 12y ago>I think it's a good idea, but falls short in reality. Celebrities arguably don't want it, you'd be a babysitter between them and their devices/APIs. Something they'd likely hate and continuously undermine, especially when a large part of their "job" is connectedness. If Entourage has anything to do with the real world, you could as well be talking about their agents. And as far as I know, there is no celebrity without agent.
- pjc50 12y agoHow do you 2fa iCloud? You end up carrying your phone and and auth token?
- kennywinker 12y agohttp://support.apple.com/kb/ht5570 http://support.apple.com/kb/ht5570 > When you set up two-step verification, you register one or more trusted devices. A trusted device is a device you control that can receive 4-digit verification codes using either SMS or Find My iPhone. You're required to provide at least one SMS capable phone number. > Then, any time you sign in to manage your Apple ID at My Apple ID or make an iTunes, App Store, or iBooks Store purchase from a new device, you'll need to verify your identity by entering both your password and a 4-digit verification code, as shown below.
- tvon 12y ago> After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. So, the brute force attack with reasonable guesses at email addresses?
- tomhschmidt 12y agoor phishing
- potatolicious 12y agoOr just password recovery with trivially discoverable personal details. To a determined attacker, your mother's maiden name, the street you grew up on, and the name of your first pet are not hard to figure out. Information like that isn't even secret, the whole practice of using password recovery questions needs to go away.
- duskwuff 12y ago> trivially discoverable personal details Which are even more trivially discoverable for celebrities, since their lives are frequently so well-documented!
- level 12y agoMy guess would be that they found someone an address of someone with ties to a celebrity, compromised their account through security questions, and then found more personal information and iCloud accounts by going the contacts of each person they compromised. That was my suspicion from the start, security questions tend to be the easiest way to compromise accounts since finding someone's mother's maiden name isn't hard to do anymore.
- leephillips 12y agoI always put in made-up or nonsense information for the answers to the security questions, and store it all in the same encrypted file with my passwords. Seems more secure than using correct information that would not be hard for an attacker to discover. ("Then how will you get password recovery?" "I will never need that.")
- vitamen 12y agoSo "This is a very common attack on the Internet that we didn't do much to protect you against by default"? It's a pain setting up two step authentication across a lot of services, but I guess iCloud is probably one that's worth the effort. Still I'd rather brute force was not an option.
- sp332 12y agoThe recently fixed "find my phone" feature doesn't support two-factor auth because, presumably, you can't find your phone to get the second factor.
- deleted 12y ago[deleted]
- edent 12y agoSo, basically find any celebrity interview where they state what school they went to, their first pet, etc. Exactly the same way that Sarah Palin's email was hacked - https://en.wikipedia.org/wiki/Sarah_Palin_email_hack https://en.wikipedia.org/wiki/Sarah_Palin_email_hack
- Quarrelsome 12y agoI'm confused. The description of the problem doesn't rule out an issue with IBrute (targetted attack on usernames, passwords) but then they state it wasn't an issue with ICloud or FindMyPhone. Is this to suggest that its social engineering or just a password reset job? I don't otherwise see how an attack on usernames and passwords translates. I guess the thing I'm really trying to figure is that if it was IBrute (which personally I would find an embarrassing failure) would they actually admit it?
- culturestate 12y agoThey seem to have specifically ruled it out later in the statement, as iBrute was targeted at Find my iPhone: > None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone.
- Quarrelsome 12y agoUnderstood. My second question then is just asking whether Apple have a reputation for truthiness in this arena. I genuinely don't know, I'm asking.
- sigzero 12y agoI think that have a pretty good record on owning up to something. It would hurt them much much more to lie about it at this point.
- DigitalJack 12y agoI'm curious what you base that on... that they own up to problems. I know it's certainly not true with hardware issues. They may eventually fix it, but it's rare that they'll comment on it.
- slantyyz 12y ago>> They seem to have specifically ruled it out later in the statement >> > None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone. Have they ruled it out? When you factor that the statement's intended audience is the entire world, not just cyber security experts, the wording becomes muddy, as it depends on you how you interpret the word "breach". If someone successfully uses a password attack, is it actually a 'breach' of Apple's systems? After all, the systems successfully prevented entry until a valid password was entered, which is exactly what the systems were designed to do.
- omfg 12y agoIf anyone wants to setup 2FA for their Apple ID here's their support page on it: http://support.apple.com/kb/ht5570 http://support.apple.com/kb/ht5570
- Torgo 12y agoIt seems like it would be a feat to gather all the user IDs of these famous people in the first place. I'm guessing there's a black market just for that? I used to work on a service used by quite a few famous people, if anybody on the project was unscrupulous, it would have been easy to pass those emails and other personal information on to a hacker.
- jgrahamc 12y agoIf you can break into one person's account and get their contacts then you can recurse from there. It's likely that one celebrity knows another and so on.
- deleted 12y ago[deleted]
- philip1209 12y agoI had no idea that Apple supports two-step verification.
- davis 12y agohttps://twofactorauth.org/#retail https://twofactorauth.org/#retail ;)
- 64mb 12y ago> "we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions" > "None of the cases we have investigated has resulted from any breach in any of Apple’s systems" Don't these lines contradict each other?
- res0nat0r 12y agoNo as I can try and guess your login credentials and that is a perfectly acceptable and valid workflow which isn't exploiting anything. I think the issue is that the previously posted Find My Iphone code didn't rate limit invalid logins and this was used to bruteforce creds. This is probably the real underlying issue and not any type of buffer overflow / exploit etc.
- induscreep 12y agoAnswer: "Hack" was due to weak passwords and no 2-factor, not because of any weakness in Apple's systems.
- 64mb 12y agoAh, thanks for clearing that up.
- mbesto 12y ago> Apple's systems Systems aren't just technical (software), they involve human beings, feedback loops, interactions, etc. Apple's security systems are in fact weak, just not weaker than the norm. Actually I think the Apple press release was poorly worded. This in particular: >None of the cases we have investigated has resulted from any breach in any of Apple’s systems There was indeed a breach in Apple's system, there just wasn't a system wide breach that compromised all accounts, just a select few.
- personZ 12y agoIt seems significantly more likely that the "hack" was in the account recovery system which allows -- via a couple of often easily discovered personal details -- a complete, immediate account takeover.
- nokiaman 12y agoThe damage has been done, surely? Headlines around the world are "iCloud hacked", "Apple hacking scandal", "Are your photos safe on iCloud?" etc. Meanwhile celebrities like Kirsten Dunst have described iCloud as a "piece of shit" (a tweet with emoticons). Timing is not great for Apple since they are supposed to be launching health and payment related features for iOS in the next few days. Question is, would Apple have responded so quickly if celebrities weren't involved?
- chez17 12y agoI'm sorry, but Apple was hacked. There are multiple layers to security. Even the physical security of the building counts. If you have a terrible, easy to crack security system like "What is your first pet's name?" and your customers lose their data because of it, your system was hacked. Plain and simple. Security isn't just blocking a port or an ip range, it's the entire, the entire, system. Those "security questions" are very easy to find out, therefor the system is insecure.
- Zikes 12y ago2FA needs more traction. Also, email/text alerts about new logins, login attempts, and changes to account settings.
- jfaat 12y agoWhenever these types of questions are required for account recovery, I use a false set of answers as an additional security measure. Probably a good practice for a celebrity.
- bashinator 12y agoIf the only way to safely use the system is to deliberately ignore its instructions ("provide answers to these questions"), then the system is broken.
- jfaat 12y ago
- curiousDog 12y agoWhy not make 2FA mandatory?
- LeoPanthera 12y agoBecause not everyone has an iPhone.
- davis 12y agoJust a friendly remind of the sites that support 2FA, Apple is on the list: https://twofactorauth.org/ https://twofactorauth.org/
- ToastyMallows 12y agoWow thanks for the link, I didn't know half of these had 2 Factor Authentication. Time to enable them all!
- nedwin 12y agoAt what point do tech companies start making two factor authentication mandatory? It's one thing to say "We tell our users to use two factor authentication - it's their fault if they don't use it" but it's another to say "all user accounts use two factor authentication to ensure security of their data"
- pptr1 12y agoI am kinda of sick of hearing about how celebs got hacked and how it is such a big deal. The media over hypes these things and really the celebs involved should of used stronger passwords and/or 2 factor authentication. They should of known better. People get "hacked" this way tons of times by using weak passwords and/or security questions. You'll never see that appear in the media. The inequality here is the importance the media places on Kate Upton, Jennifer Lawrence, etc. It a waste of tax payer money to get the "FBI" invoked. I see it also has a waste for the government to chummy up with these "celebs". Some of them are great entertainers no doubt, but what have they done to really deserve the popularity they have. Have they build something that tremendously improves people lives. Are they key decision makers on items that effect people? Yes Jennifer Lawrence is a great actress but c'mon. Stop giving importance to celebs by not reading news about them. Radaronline, Tmz, etc.
- com2kid 12y agoThey are performing artist, how you feel about their contribution to society is based upon how you feel about performing artists in general. Is society enriched by the eloquence of humanity of ballet? Does humanity prove itself to the universe when our best singers hold a pure note for a brief moment in time? What impact does a movie exploring some aspect of the human experience have upon the world? Popular performing artists are popular because their performances bring some amount of joy to people's lives.
- elliottpayne 12y ago2FA is no panacea. My yahoo account (only used for flickr) was compromised with 2FA & 20+ character password.
- sosuke 12y agoGoogle and Yahoo both had 2FA holes in their mobile authentication entry points. No data to back this up other than my own experience and seeing the last logins coming from mobile devices in another country.
- learc83 12y agoHow? Did you have another email account attached as a backup that was compromised?
- julianpye 12y agoPeople have become so close with their smartphones that they entrust it with more information than their friends know. In addition no brand is more loved than Apple, with many celebrities being ambassadors to the brand. The brand is planning to introduce new payment and health services next week. For the average consumer two-factor-authentication means nothing, but they will start distrusting Apple more and will be more careful with data. This does not mean they will use more and better security. The average consumer will just stop using some of these services.
- csours 12y agoNitpick: Ambassadors work in an Embassy.
- kennywinker 12y agohttp://www.merriam-webster.com/dictionary/ambassador http://www.merriam-webster.com/dictionary/ambassador > 2 a : an authorized representative or messenger > b : an unofficial representative <traveling abroad as ambassadors of goodwill>
- csours 12y agoParent had ambassador spelled as embassador.
- smacktoward 12y ago> After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet. >None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone. Um... doesn't "a very targeted attack on user names, passwords and security questions" count as a "breach in... Apple's systems"? A social engineering hack is still a hack.
- pseudonym 12y agoIs it still a social engineering hack if a well-known celebrity with their personal info broadcasted all over the internet decides to use that personal info to secure their account? Or rather, is that a social engineering hack on Apple, or the celebrity themselves? And what should Apple do, in this situation? If your names show up in tabloids, don't allow you to answer certain security questions? Require 2FA if your name is mentioned on Google more than a certain number of times? I don't feel this is an Apple problem any more than it would be if someone created their iCloud password and then posted it on their Twitter.
- smacktoward 12y ago"Require 2FA for everybody, full stop" would do the trick. The proposed solutions you outline all assume that "password + security question" is only an insecure system for celebrities. But we have enough experience by now to know it's an insecure system for everyone.
- enraged_camel 12y ago>>"Require 2FA for everybody, full stop" would do the trick. How do you require 2FA for the Find My iPhone application when the only context for using that application is one in which your phone is lost?
- aganders3 12y ago
- modfodder 12y agoFrom what I've read on 4-chan, Ars, Slashdot (indiv. comments, not articles) and other sources that this wasn't one person hacking a group of celebs acount, but a leak from an underground celeb nude trading ring that has existed for a while. So multiple hackers over a long period of time, from multiple sources. link to one explanation: http://i.imgur.com/vnd0H9J.jpg http://i.imgur.com/vnd0H9J.jpg
- fjarlq 12y agoI'm still wondering if the Find My iPhone brute force bug was exploited. Why doesn't Apple at least offer a bug bounty reward? Is it irresponsible that they don't? All they offer now, as far as I have found, is a mention on this web page: http://support.apple.com/kb/HT1318 http://support.apple.com/kb/HT1318 And, does the fact that this bug made it into production suggest a lack of internal security audits at Apple?
- kennywinker 12y agoThey specifically mention "Find My iPhone" as NOT the source. I'm not sure if you missed that bit, or you are you saying you don't believe them?
- fjarlq 12y agoThe way they worded it can be interpreted to mean that it is still a possibility that the Find My iPhone bug was involved. And anyway, I'm still wondering if it was exploited in this celeb pic scandal or other breaches we haven't heard about yet, so I still have those questions.
- karl_nerd 12y agoSo i'd wager there'd be quite a few celebrity dick picks available too if hackers wanted them. We know men like to send them unsolicited, and I'm sure those celebrities had received more than a few. But there are none. And why? Because those women were specifically targeted by people with a lot of resources and patience. (it's important that they were targeted specifically for being women). To all of you idiots blaming the victims out there right now "should have used 2fa, should have used stronger passwords": 1. You don't know if 2FA was in place, you don't know what strength the passwords were. 2. Again: those women were highly targeted. Can you defend yourself if someone takes a week/month long project to break into your phone? (Also this was during heartbleed and other big vulnerabilites) Come off your bullshit high horse. Don't blame the victims here.
- iaw 12y agoRe: 1) 2FA wasn't in use by these individuals. If you read the Apple release they not only neglect to mention 2FA as a source of the breach but actively encourage users to sign up for it. If 2FA was in place I doubt that this vector would have been successful. That being said, I think the culpability is on Apple here as much as it is on the individuals responsible for obtaining the links. Security questions were never good security and companies need to start moving away from failed models.
- dpweb 12y agoSecurity questions are just horrible. 2FA is good, but these celebs have people that handle their social media, so even if the technical leaks are plugged, things would just move to social eng. tactics, bribe an assistant, etc.. Probably a number of people have a celebs Twitter password. Pretty worthless statement by APPL. "happpens all the time", "not our fault", etc.. They should be called out for security questions in the 1st place if that's what they use at all. Even after Sarah Palin which was greatly publicized. These companies learn nothing.
- ciiworldwide 12y agoFull investigation means full...Apple will clear this issue and do the best...and do the full investigation.. Ciiworldwide
- ciiworldwide 12y agoFull investigation means full...Apple will clear this issue and do the best...and do the full investigation.. Ciiworldwide