141–149 of 149 posts
It's kind of funny. When you look into cyber security, the papers are all about controlled rate limiting, advanced anomaly detection, client fingerprinting, the likes, but in practice, very little companies will actually pick out abuse like this. This creep didn't need advanced tooling, exploits or deep knowledge of the backing system. All he needed was a basic phishing scam to work well enough, and the official iClo…
Isn't "stealing" inaccurate here? Copies were made, sure, but nothing was removed from their possession.
Earlier quoted context omitted.
Phishing is one of the most common entry points of cyberattacks. Even tech savvy people get tricked into clicking links or downloading attachments.
> tricked into clicking links or downloading attachments Is that "phishing"? Those actions should be secure to perform in a browser. The security model of browsers/computers is such that I don't need to establish authenticity/trust in order to click the link or even download something. Of course, that security model sometimes has holes, but if for example clicking the link enables an XSS attack, I'd call it (primaril…
Earlier quoted context omitted.
Phishing is one of the most common entry points of cyberattacks. Even tech savvy people get tricked into clicking links or downloading attachments.
> tricked into clicking links or downloading attachments Is that "phishing"? Those actions should be secure to perform in a browser. The security model of browsers/computers is such that I don't need to establish authenticity/trust in order to click the link or even download something. Of course, that security model sometimes has holes, but if for example clicking the link enables an XSS attack, I'd call it (primaril…
You don't understand how hacking and planting of malware works. Hackers abuse zero day vulnerabilities in order to drive by download malware onto user's PC. They use exploit kits in order to manage and plant malware by abusing browser's or computer's zero day exploits. So when you visit a malicious website with vulnerable browser malware silently gets downloaded(drive by download) onto your PC.
On the other hand one of the most common email attachments is Microsoft Word document and again just like with browsers Microsoft Office and Microsoft Word have many zero day exploits or simply existing vulnerabilities(exploits) which user didn't patch so attacker abuses these kinds of exploits in order to drop malware when user opens Microsoft Word document and interacts with it.
Summa summarum: Hackers use zeroday or existing exploits to plant malware or they make lookalike websites or documents to trick you into giving your login credentials and/or payment information(credit card, bank account information etc.)
>The security model of browsers/computers is such that I don't need to establish authenticity/trust in order to click the link or even download something.
You do; websites use SSL certificates and computer files get digitally signed as well.
Earlier quoted context omitted.
Not just better education around security practices, but better understanding around control of your content, where it's stored, what happens to content when you press that button in an app. I don't want to victim blame here, and this guy is a total creep, but the victims uploaded their nudes to the Internet. At that point, the cat was out of the bag. Part safely using the Internet is having the knowledge and being a…
It boggles my mind that people have nudes of themselves on any digital medium. I say if you want to dabble in that, get a film camera and develop the pictures in your own basement.
Earlier quoted context omitted.
They would just get an email saying that icloudbackupsupport@gmail.com (his phony address) accessed the account immediately after giving their info to icloudbackupsupport@gmail.com. He could even have told them to expect and ignore such an email.
There should be a request for approving the login attempt, and if you say yes, you get a six digit code to enter on the device trying to connect. Then when that succeeds, you get another push notification about it succeeding.
I am no fan of apple but this man used phishing attacks to gain access to just 306 icloud accounts. That hardly seams a significant failing on apples part. He used the credentials of the victims so I'm not really clear how rate limiting should have played a role, you should be limited from accessing your own account?
New device logins across 300+ accounts from the same IP in such a short time frame should raise a few red flags.
Earlier quoted context omitted.
Google will alert the account owner (across all channels -- devices they own, and Gmail) when there's a login from a new device. Doesn't Apple do the same?
Yes they do. But don't underestimate how much people don't actually read their emails. They have 20 newsletters coming in every day and quickly check if anything is related to them, they have no idea what that iCloud email says. They just fell victim to a phishing attempt, they are already not that tech savvy.
Earlier quoted context omitted.
> my previous employer had like 20,000 employees NATed behind a single IP. If so, it’s incredibly unlikely that all 20k were online simultaneously. If they were, each person could only open ~3 TCP sockets to the internet (even if via a proxy if dealing with individual login sessions) at a time before you’ve run out of ports.
even though you're probably right on the first part, the second part is false. while most NAT implementations operate as you describe, called "port-restricted cone NAT", some implementations allocate the external port only for a specific destination address, called "symmetric NAT".