Hacker News Reader

Comment by cliveowen | Hacker News Reader

I haven't been following on this matter, it was or it wasn't Apple's fault?

Apple hasn't been forthcoming with details. They have thus far denied any responsibility. However, there is substantial evidence that it was indeed at least partly their fault.

There was a flaw that allowed brute force password attempts exposed here: https://github.com/hackappcom/ibrute

Apple also follows poor security practices like asking insecurity questions to allow users to gain access to an account.

Apple has claimed that it was most likely a 'phishing' attack. However, given the large number of victims, and the lack of any evidence presented to support such a theory, I am rather hesitant to believe them. Until further information is made available, I am forced to consider Apple to be at fault.

From the article:

"Apple earlier this week said that after a 40-hour investigation, the company concluded that there was no breach of its data servers. The company has said it discovered a number of celebrity accounts were compromised by targeted attacks, using methods like phishing or correctly answering security questions to obtain their passwords."

So the stolen data was from Apple's servers, but was obtained by compromising individual logins.

Lesson #1: enable 2FA. now.

2FA does not protect iCloud data at all, it would have done nothing here.

My understanding is it just doesn't protect iCloud backups, which is what were compromised here - also why things deleted from the phone were still in the cloud.

That's mine too, an iCloud backup is pretty much keys to the kingdom. Could also just have been that they had access for a very long time and downloaded data multiple times in that period without being detected.

Lesson #1: only use software that encrypts the data on the client side before storing it on the server.

Looks like in the end the weak link is always human.

It's a classic "password" is not a good password situation. Peoples passwords are way too common, its not surprising celebrities got hacked they're going to be just as likely as using a weak password as any young adult.

Also sending plain text auth tokens is not secure.

No. It was a labor intensive social engineering attack that couldn't be perpetrated on a wide scale, not a technical breach.

However it's still a weakness and Apple can take steps to improve things.

Hate to be that guy, but social engineering would mean they manipulated the person through social engagement to expose their credentials or information...which may have been possible, but more than likely they guessed or researched answers to the questions...?

I read something about a phishing attack - would that count as social engineering?

Yes, it gets the actual owner of the account to pass over personal information.

Ok. One of the stories I read mentioned that may have been how they got the information required to hack the account. Not too sure if it was just speculation or verified in anyway.

With such a large group compromised at the same time I would guess it was not phishing.

The group wasn't large, and there is no evidence they were compromised at the same time.

Reply on news.ycombinator.com