Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man steals 620k photos from iCloud accounts from home without Apple noticing

latimes.com

Post reply on HN
Print view View original

101–110 of 149 posts

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#101

Post by rootusrootus »

mataug wrote: post #46

As always humans are the weakest link when securing systems. This reminds me of this thread https://news.ycombinator.com/item?id=28279326 Where the attacker was able to trick Tmobile / Sprint customer service into providing a PUK number.

My wife and I had our USAA account 'hacked' in much the same way. Someone called the support line repeatedly, pretending to be my wife, got denied repeatedly. Until one time they didn't. Convinced the teller to reset the password on the account and tell them the login name. All the security in the world doesn't matter if the human with the keys is an idiot.

In the end, in our case, USAA gave us a detailed rundown of how they failed, and then turned up to 11 the security questions my wife had to answer. Every single call she had to give a password, pin code, and then answer the questions that are sourced from Experian(or some other credit bureau) intended to prove identity through knowledge. Every time. They punished us for a mistake they fully admitted was their employee's fault.

Nah, I'm not bitter at all. Ultimately, though, it will be one of the reasons I move my account away from USAA.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#102

Post by SilverRed »

hamburgerwah wrote: post #92

I am no fan of apple but this man used phishing attacks to gain access to just 306 icloud accounts. That hardly seams a significant failing on apples part. He used the credentials of the victims so I'm not really clear how rate limiting should have played a role, you should be limited from accessing your own account?

Apple has made leaps and bounds on security including having 2FA mandatory but none of it matters when the user is convinced they are speaking to someone from apple who is telling them to read out the 2FA code and provide their details.

No warning in the world will help because the attacker will just say "Ok thats ok, that warning is just for untrusted people. Since I am an Apple employee, it is perfectly safe". These victims already trust the attacker so they will just do anything asked.

I think the only solution here is to just block all logins outside of the users own country and to have local law enforcement crack down hard on any in country criminals. Apple can use the find my location to work out if any of the users devices are at or have been at a certain location. I can't imagine many situations where you leave all of your devices at home, leave the country and then try to log in.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#103

Post by [deleted] »

at_a_remove wrote: post #31

I have been thinking about "nudes" (which I will use as a shorthand to describe digital images of a person sans clothing, almost always taken by that person) in terms of cultural evolution. A couple of years ago I mentioned, on HN, that I knew Jenni, of JenniCam, before the "cam," back when she was just experimenting with this new digital camera device. And then they became more and more available. For a brief time t…

[deleted]

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#104

Post by noptd »

shuckles wrote: post #80
spac wrote: post #5

Earlier quoted context omitted.

https://twitter.com/matthew_d_green/status/14299631415684014...

This Twitter account continues to debase discourse about the child safety proposals with FUD. It posted incorrect information about the proposal before launch and has continued with useless speculation. How many of the hypothesized threat models which don’t pan out has he formally redacted? If you are worried about the security of iCloud, then that can be read as more reason to prefer client side scanning. Of course…

And I could say that this HN account has been baselessly dismissing valid concerns about the proposal and providing non sequiturs to assert why nobody should be concerned since it was announced.

However, stating my opinion as fact in an attempt to invalidate someone else's perspective on the matter would be debasing discourse so I wouldn't do that. None of us should.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#105

Post by IAmEveryone »

adrr wrote: post #93
mrkramer wrote: post #57

Earlier quoted context omitted.

Phishing is one of the most common entry points of cyberattacks. Even tech savvy people get tricked into clicking links or downloading attachments.

Apple makes phishing easier by always prompting the user their apple account password. Do anything including installing free apps and it requires the password.

It doesn't always prompt for a password or, more accurately, fingerprint scan on newish devices. In fact, standard applications that live in /Applications don't need it.

Nor do free apps downloaded via the App Store, as I just tried. Although this may be a setting somewhere.

But does it matter? You know what doesn't need a password? Accessing your photos. There's really very little you can do after authentication that you can't do otherwise. Maybe, after exfiltrating all the user data, you can also update macOS.

Sandboxing is really far more important than protecting sudo privileges, and I believe Apple is doing a fairly good job in that regard.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#107

Post by noptd »

hamburgerwah wrote: post #92

I am no fan of apple but this man used phishing attacks to gain access to just 306 icloud accounts. That hardly seams a significant failing on apples part. He used the credentials of the victims so I'm not really clear how rate limiting should have played a role, you should be limited from accessing your own account?

New device logins across 300+ accounts from the same IP in such a short time frame should raise a few red flags.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#108

Post by est31 »

SilverRed wrote: post #97
fshbbdssbbgdd wrote: post #78

Earlier quoted context omitted.

It’s not too weird for 306 accounts to be using iCloud from the same IP, considering stadiums, universities, etc. It’s probably highly unusual for that many of them to do an account recovery… unless the IP is an Apple store.

It's not weird for 1000 users to be simultaneously connected via the same IP because of CGNAT. This is where you would have to do something like browser fingerprinting to try to work out if they are the same person.

Browser fingerprinting works best on the Wintel and Android ecosystems, but fails on apple's devices because they are extremely uniform, and apple has been working on making them even more uniform. As apple products are designed to be used on apple devices first (and I guess also tested on them first), it would be unlikely that they employ fingerprinting.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#109

Post by SilverRed »

fortuna86 wrote: post #65
admn2 wrote: post #59

Doesn't icloud have built in 2FA from an unrecognized device?

I had the same thought.

If someone has given their email and password to an attacker, they won't think twice about giving the 2FA code as well.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#110

Post by WatchDog »

mrkramer wrote: post #57
jeroenhd wrote: post #7

It's kind of funny. When you look into cyber security, the papers are all about controlled rate limiting, advanced anomaly detection, client fingerprinting, the likes, but in practice, very little companies will actually pick out abuse like this. This creep didn't need advanced tooling, exploits or deep knowledge of the backing system. All he needed was a basic phishing scam to work well enough, and the official iClo…

Phishing is one of the most common entry points of cyberattacks. Even tech savvy people get tricked into clicking links or downloading attachments.

Getting compromised by "clicking links or downloading attachments", implies some kind of technical vulnerability, beyond phishing alone.
Post reply on HN