Hacker News Reader

Comment by smoldesu | Hacker News Reader

> Apple claimed in a press release that access was gained via spear phishing attacks.

Ah, because American celebrities spend so much of their time clicking through junk mail and seeing where it goes. Makes plenty of sense.

View on HN

Spear phishing, by design, is intended to not look like junk mail. Maybe it's designed to look like it came from an agent? Maybe like it was from someone they had hired to take care of their pets, or kids? If you're constantly busy (and it is my understanding that many celebrities are busy, at a bare minimum), and you don't want to think too hard about a particular thing, then a spear phishing attack could quite easily hit you, if your guard isn't up, and you don't consider technology to be a battelground.

Sounds like a security oversight on Apple's behalf then. iCloud should have 2FA enabled by default if it's so easy to trick the subconscious user into handing over credentials. Furthermore, it's already been confirmed that iCloud had multiple exploits allowing for brute-force and injection attacks[0] at the same time that the hacks happened, so it's definitely more feasible that an unpatched, full-disclosure exploit was abused instead of a couple hundred interns all clicking on the same spam email at the same time.

[0] https://www.ibtimes.co.uk/icloud-accounts-risk-brute-force-a...

You might want to read up on the history: this is a key part of why Apple needed up the default experience because hectoring users about using strong passwords, not sharing them, etc. hasn’t worked. A lot of what we take for granted now was contentious at the time and it’s taken years to improve the balance in a user-friendly manner — and pointing out that they acted on problems years ago seems more like a positive than supporting whatever point you think you’re making.

Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out.

There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. https://youtu.be/Z20XNp-luNA

There isn’t a second set of technology used by American celebrities. Smartphones are used by just about everyone and email is part of that.

Spearfishing looks like legitimate emails to most people which is why it works.

Considering the celebrities involved, I find this entirely likely.

Heck, corporate CEOs get nailed by spearfishing. There was an article on HN just a couple of years ago showing that even many CIOs can't tell a real e-mail from a fake one.

Or CISOs, or analysts. Technically proficient users are _more_ likely to spot a problem but nobody is immune — it’s just a question of how much someone wants to spend targeting you.

Of all the good reasons to criticize Apple, you picked the most bogus one. Congratulations, that's an achievement. :D

You severely overestimate celebrities' technical prowess -- and underestimate their naivete. They live in their own bubble of trust and laughs and fun and parties; and if somebody crafts a message that looks to be from their agent or a friend celebrity they absolutely WILL click on it and will give their data willingly.

None of us has the entire picture of course, but after knowing a few local celebrities 10+ years ago, I can definitely believe they are that gullible so as to make a spear-phishing attack successful.

And, let’s be clear, this is true for almost everyone — even most HN commenters. Companies have spent years training people to expect email from bizarre domains, with random attachments or HTML links which point to gibberish tracking URLs, etc. Spam filters have gotten better but by far the best protection move has been widespread U2F/FIDO deployment.

It sounds like they're just like everyone else then: in which case, even more users were vulnerable, and Apple has even more incentive to secure their system. Is there anything I'm missing here?

Nothing, except for the fact that people hate managing passwords with a passion and take the risk for their accounts willingly (I've had the heated table discussions to prove it). For them it's all about the tradeoff between "how much energy must I invest?" and "how much do I care if I lose this account?".

Most of the people I knew only enabled 2FA on their Gmail because they really couldn't afford to lose it. Everything else they were very meh about. They even had 000000 as their online banking PIN... <facepalm>

Password managers only started gaining prominence after biometric authentication allowed you to access your passwords with your finger or face.

So yeah, celebrities are users like all others -- if not slightly worse even.

I am pretty sure every corp like Apple, Google, Facebook, Microsoft et. al. would love to enforce maximum security but they also have to be very careful not to alienate their users. One good example is Google who will pester you for 2FA and recovery codes but never truly force you; they prefer to ban your account for suspicious activity instead (happened to one guy I knew some 3-4 years ago because his drunk friends tried to breach his Gmail account from several different phones).

So I get it, you don't like Apple, but as I have snarkily remarked above: it's for the wrong reasons. (I don't like them either but it's for completely other reasons.)

Reply on news.ycombinator.com