Hacker News Reader

Comment by inglor | Hacker News Reader

He's dead Jim https://twitter.com/hackappcom/status/506383498333007872

Still, I expected better from Apple. Props for the fast patch.

>Still, I expected better from Apple.

Here is another flaw in iPhone. If a person is casting their screen to an Apple TV and must enter their PIN number, the screen will highlight each button press on the TV. No fingers in the way to even block it. Simple solution: don't broadcast this or don't provide screen feedback for entering the PIN.

Not so fast. This can very well be the leak used to access the celebs nude pics. Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there.

What do you guys think?

Addendum: the way it went down on 4chan points towards someone that is not an expert on extortions. You don't go to the public for some pocket change when you can have publications or the celebs paying you hundreds of thousands of dollars for those pictures. Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to.

Sounds plausible. And if it’s not this particular bug it may very well be some other. I find it hard to believe that someone just hacked his way into 400+ phones without any kind of glitch in the system. And judging by the fact that he went only for pictures and videos it doesn’t sound like an elaborate scam that could use high profile hacks like a fake connection antenna or something equally sophisticated.

Before the bug got public, I was thinking of some sort of Bluetooth honeypot attack at a big event, say the Oscars, or Grammys

@nikcub seems to think it wasn't this.

https://twitter.com/nikcub/status/506421890517200896

he's assuming from when the tool was released. The exploit was in the wild for much longer.

The leaker got doxxed by 4chan and doesn't seem capable of discovering the exploit on his own.

Though he's commented to Buzzfeed denying it was him (but anyone would).

http://www.buzzfeed.com/charliewarzel/bryan-hamade-blamed-by...

@nikcub still thinks it's him

https://twitter.com/nikcub/status/506465151562694656

The password list for this particular implementation is pretty limited. I doubt all the celebs hacked had a password on that list. The concept may well have been used with different code / pw dictionary.

i'm watching them continue to attempt to hack new accounts on a forum, so whatever apple patched with this bug wasn't it.

Address books are backed up on icloud aren't they? So you get into one celeb account and it's easy from there. Use their address book to find agent/manager/publicists's info, then an endless chain of celebs from there.

You can find agents from IMDB Pro too. It's not that hard if you're determined (or obsessed for that matter).

> Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to.

If only people shared the same feelings about illegal mass surveillance and the lax security of the companies responsible for these breaches.

I do, I think Snowden is a hero. That does not stop me from thinking that this kind of behavior should be punished exemplarily. This is no "new product" leak, nor a ethical hack performed to expose a hidden truth. It's just some private pictures stolen and uploaded to the internet for the public to see. Jennifer Lawrence has all the rights to take private nude pictures of herself in the privacy of her own house. Nobody has the right to steal them, even if her iCloud password was Katniss.

Reply on news.ycombinator.com