top | item 8274729

(no title)

cliveowen | 11 years ago

I haven't been following on this matter, it was or it wasn't Apple's fault?

discuss

order

ensignavenger|11 years ago

Apple hasn't been forthcoming with details. They have thus far denied any responsibility. However, there is substantial evidence that it was indeed at least partly their fault.

There was a flaw that allowed brute force password attempts exposed here: https://github.com/hackappcom/ibrute

Apple also follows poor security practices like asking insecurity questions to allow users to gain access to an account.

Apple has claimed that it was most likely a 'phishing' attack. However, given the large number of victims, and the lack of any evidence presented to support such a theory, I am rather hesitant to believe them. Until further information is made available, I am forced to consider Apple to be at fault.

randomfool|11 years ago

From the article:

"Apple earlier this week said that after a 40-hour investigation, the company concluded that there was no breach of its data servers. The company has said it discovered a number of celebrity accounts were compromised by targeted attacks, using methods like phishing or correctly answering security questions to obtain their passwords."

So the stolen data was from Apple's servers, but was obtained by compromising individual logins.

Lesson #1: enable 2FA. now.

nwh|11 years ago

2FA does not protect iCloud data at all, it would have done nothing here.

f3llowtraveler|11 years ago

Lesson #1: only use software that encrypts the data on the client side before storing it on the server.

cliveowen|11 years ago

Looks like in the end the weak link is always human.

seanflyon|11 years ago

Also sending plain text auth tokens is not secure.

gress|11 years ago

No. It was a labor intensive social engineering attack that couldn't be perpetrated on a wide scale, not a technical breach.

However it's still a weakness and Apple can take steps to improve things.

JimmaDaRustla|11 years ago

Hate to be that guy, but social engineering would mean they manipulated the person through social engagement to expose their credentials or information...which may have been possible, but more than likely they guessed or researched answers to the questions...?