4 ms·

I haven't been following on this matter, it was or it wasn't Apple's fault?

randomfool 12y ago
From the article: "Apple earlier this week said that after a 40-hour investigation, the company concluded that there was no breach of its data servers. The company has said it discovered a number of celebrity accounts were compromised by targeted attacks, using methods like phishing or correctly answering security questions to obtain their passwords." So the stolen data was from Apple's servers, but was obtained by compromising individual logins. Lesson #1: enable 2FA. now.
- cliveowen 12y ago
  Looks like in the end the weak link is always human.
  - electromagnetic 12y ago
    It's a classic "password" is not a good password situation. Peoples passwords are way too common, its not surprising celebrities got hacked they're going to be just as likely as using a weak password as any young adult.
- nwh 12y ago
  2FA does not protect iCloud data at all, it would have done nothing here.
  - justizin 12y ago
    My understanding is it just doesn't protect iCloud backups, which is what were compromised here - also why things deleted from the phone were still in the cloud.
    - nwh 12y ago
      That's mine too, an iCloud backup is pretty much keys to the kingdom. Could also just have been that they had access for a very long time and downloaded data multiple times in that period without being detected.
- f3llowtraveler 12y ago
  Lesson #1: only use software that encrypts the data on the client side before storing it on the server.
- seanflyon 12y ago
  Also sending plain text auth tokens is not secure.
gress 12y ago
No. It was a labor intensive social engineering attack that couldn't be perpetrated on a wide scale, not a technical breach. However it's still a weakness and Apple can take steps to improve things.
- JimmaDaRustla 12y ago
  Hate to be that guy, but social engineering would mean they manipulated the person through social engagement to expose their credentials or information...which may have been possible, but more than likely they guessed or researched answers to the questions...?
  - k-mcgrady 12y ago
    I read something about a phishing attack - would that count as social engineering?
    - JimmaDaRustla 12y ago
      Yes, it gets the actual owner of the account to pass over personal information.
      - k-mcgrady 12y ago
        Ok. One of the stories I read mentioned that may have been how they got the information required to hack the account. Not too sure if it was just speculation or verified in anyway.
        seanflyon 12y ago
        With such a large group compromised at the same time I would guess it was not phishing.
        gress 12y ago
        The group wasn't large, and there is no evidence they were compromised at the same time.
ensignavenger 12y ago
Apple hasn't been forthcoming with details. They have thus far denied any responsibility. However, there is substantial evidence that it was indeed at least partly their fault. There was a flaw that allowed brute force password attempts exposed here: https://github.com/hackappcom/ibrute https://github.com/hackappcom/ibrute Apple also follows poor security practices like asking insecurity questions to allow users to gain access to an account. Apple has claimed that it was most likely a 'phishing' attack. However, given the large number of victims, and the lack of any evidence presented to support such a theory, I am rather hesitant to believe them. Until further information is made available, I am forced to consider Apple to be at fault.

From the article: "Apple earlier this week said that after a 40-hour investigation, the company concluded that there was no breach of its data servers. The company has said it discovered a number of celebrity accounts were compromised by targeted attacks, using methods like phishing or correctly answering security questions to obtain their passwords." So the stolen data was from Apple's servers, but was obtained by compromising individual logins. Lesson #1: enable 2FA. now.

cliveowen 12y ago
Looks like in the end the weak link is always human.
- electromagnetic 12y ago
  It's a classic "password" is not a good password situation. Peoples passwords are way too common, its not surprising celebrities got hacked they're going to be just as likely as using a weak password as any young adult.
nwh 12y ago
2FA does not protect iCloud data at all, it would have done nothing here.
- justizin 12y ago
  My understanding is it just doesn't protect iCloud backups, which is what were compromised here - also why things deleted from the phone were still in the cloud.
  - nwh 12y ago
    That's mine too, an iCloud backup is pretty much keys to the kingdom. Could also just have been that they had access for a very long time and downloaded data multiple times in that period without being detected.
f3llowtraveler 12y ago
Lesson #1: only use software that encrypts the data on the client side before storing it on the server.
seanflyon 12y ago
Also sending plain text auth tokens is not secure.

gress 12y ago

No. It was a labor intensive social engineering attack that couldn't be perpetrated on a wide scale, not a technical breach. However it's still a weakness and Apple can take steps to improve things.

JimmaDaRustla 12y ago
Hate to be that guy, but social engineering would mean they manipulated the person through social engagement to expose their credentials or information...which may have been possible, but more than likely they guessed or researched answers to the questions...?
- k-mcgrady 12y ago
  I read something about a phishing attack - would that count as social engineering?
  - JimmaDaRustla 12y ago
    Yes, it gets the actual owner of the account to pass over personal information.
    - k-mcgrady 12y ago
      Ok. One of the stories I read mentioned that may have been how they got the information required to hack the account. Not too sure if it was just speculation or verified in anyway.
      - seanflyon 12y ago
        With such a large group compromised at the same time I would guess it was not phishing.
        gress 12y ago
        The group wasn't large, and there is no evidence they were compromised at the same time.

ensignavenger 12y ago

Apple hasn't been forthcoming with details. They have thus far denied any responsibility. However, there is substantial evidence that it was indeed at least partly their fault. There was a flaw that allowed brute force password attempts exposed here: https://github.com/hackappcom/ibrute https://github.com/hackappcom/ibrute Apple also follows poor security practices like asking insecurity questions to allow users to gain access to an account. Apple has claimed that it was most likely a 'phishing' attack. However, given the large number of victims, and the lack of any evidence presented to support such a theory, I am rather hesitant to believe them. Until further information is made available, I am forced to consider Apple to be at fault.