Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man steals 620k photos from iCloud accounts from home without Apple noticing

latimes.com

Post reply on HN
Print view View original

131–140 of 149 posts

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#131

Post by dkonofalski »

fshbbdssbbgdd wrote: post #78
jeroenhd wrote: post #7

It's kind of funny. When you look into cyber security, the papers are all about controlled rate limiting, advanced anomaly detection, client fingerprinting, the likes, but in practice, very little companies will actually pick out abuse like this. This creep didn't need advanced tooling, exploits or deep knowledge of the backing system. All he needed was a basic phishing scam to work well enough, and the official iClo…

It’s not too weird for 306 accounts to be using iCloud from the same IP, considering stadiums, universities, etc. It’s probably highly unusual for that many of them to do an account recovery… unless the IP is an Apple store.

This is trivial to overcome with a VPN. There's nothing that suggests that he was connecting from the same IP each time. Based on the article, he could have just easily forgot to sign in to a VPN before logging in and that mistake unraveled the whole thing.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#132

Post by Hello71 »

oarsinsync wrote: post #113
missingcolours wrote: post #52

Earlier quoted context omitted.

That's not really a reliable/actionable signal overall - my previous employer had like 20,000 employees NATed behind a single IP.

> my previous employer had like 20,000 employees NATed behind a single IP. If so, it’s incredibly unlikely that all 20k were online simultaneously. If they were, each person could only open ~3 TCP sockets to the internet (even if via a proxy if dealing with individual login sessions) at a time before you’ve run out of ports.

even though you're probably right on the first part, the second part is false. while most NAT implementations operate as you describe, called "port-restricted cone NAT", some implementations allocate the external port only for a specific destination address, called "symmetric NAT".

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#134

Post by shuckles »

noptd wrote: post #104
shuckles wrote: post #80

Earlier quoted context omitted.

This Twitter account continues to debase discourse about the child safety proposals with FUD. It posted incorrect information about the proposal before launch and has continued with useless speculation. How many of the hypothesized threat models which don’t pan out has he formally redacted? If you are worried about the security of iCloud, then that can be read as more reason to prefer client side scanning. Of course…

And I could say that this HN account has been baselessly dismissing valid concerns about the proposal and providing non sequiturs to assert why nobody should be concerned since it was announced. However, stating my opinion as fact in an attempt to invalidate someone else's perspective on the matter would be debasing discourse so I wouldn't do that. None of us should.

Are you asking me to provide evidence that the account posted false information and never redacted it? How about the very tweets in the linked thread where the account makes fact-free claims about how a “single IP” accessing “hundreds of accounts” (the former of which is not substantiated) suggest iCloud security is fundamentally broken. Of course Matt is smart enough to not state the implication directly, relying instead on sarcasm and FUD.

Since you went ahead and stated opinion as fact (while cleverly pretending that you didn’t), can you provide an example where I dismissed a valid concern with a non sequitur? How do you reconcile the accusation that I assert “nobody should be concerned” with comments like this where I clearly outlined why the announcement should be concerning:

[1] https://news.ycombinator.com/item?id=28279776

[2] https://news.ycombinator.com/item?id=28165116

I’ll go further and say that I have sincere concerns with what was announced, but seeing how that Twitter account seeds legions of incorrect commenters who proliferate (and post intentionally clickbait material on HN, as the poster of this article themselves admitted on this very thread!) led me to the conclusion that Matt is doing plenty of harm, especially since he should know better.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#135

Post by foerbert »

potta_coffee wrote: post #114
bogwog wrote: post #67

Earlier quoted context omitted.

> Even tech savvy people get tricked into clicking links or downloading attachments. Like Jim Browning, the Youtuber famous for scamming scammers, who recently fell for a phishing scam himself and ended up deleting his Youtube account. ( https://news.slashdot.org/story/21/07/28/2023241/youtube-cha... )

This is one of those "play with fire long enough, and you'll get burned" situations.

It's not. It wasn't a targeted attack, or any kind of retaliation. The scammer never even saw any of his videos.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#136

Post by josho »

enricopulatzo wrote: post #19
shuckles wrote: post #10

Earlier quoted context omitted.

If you have two factor enabled, which is required for many iCloud features, every single Apple device you own will receive an alert with the location of login before you can reveal the 2FA code, even for iCloud logins. What more would you like to see?

Perhaps something in that 2FA request saying "Apple will only ask for your password in-person in a store or other authorized repair provider. Only allow this request if you know who requested it"?

You need to spend more time around non technologists. Many folks just dismiss computer prompts without reading, ignore emails, or any number of other similar behaviors that would likely drive you and I crazy by their lack of attention to detail.

Adding detailed prompts won’t solve the problem.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#137

Post by thephyber »

timdev2 wrote: post #129
thephyber wrote: post #123

Earlier quoted context omitted.

The problem with the US statute for CSAM is that possession is illegal, not just intentional creation/collection/distribution. The person being hacked has technically broken the law, even if they don’t get prosecuted. I don’t know how often unintentional possessors are prosecuted, but the US system of prosecution makes it easy for an innocent to get railroaded by threats of massive charges and comparatively leanient…

What strict-liability statute are you referring to?

This HN comment suggests that you are right that there is no strict-liability statute for CSAM: https://news.ycombinator.com/item?id=28235669

IANAL so I am very likely wrong.

US Code 18 Sec 2252 seems to state that possessing or looking at CSAM material requires that the action is done “knowingly”.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#138

Post by Tabular-Iceberg »

ryandrake wrote: post #32
glitcher wrote: post #9

Earlier quoted context omitted.

I agree that better education around Internet security is needed, especially for basic phishing attacks like this. OTOH, I believe Apple could be doing more to deter and/or detect this type of broad access, especially with the lack of sophistication behind this scheme! I feel like even Netflix does a better job at alerting me to access from a new device, and they aren't storing any of my personal photos.

Not just better education around security practices, but better understanding around control of your content, where it's stored, what happens to content when you press that button in an app. I don't want to victim blame here, and this guy is a total creep, but the victims uploaded their nudes to the Internet. At that point, the cat was out of the bag. Part safely using the Internet is having the knowledge and being a…

It boggles my mind that people have nudes of themselves on any digital medium. I say if you want to dabble in that, get a film camera and develop the pictures in your own basement.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#139

Post by brandon272 »

threeseed wrote: post #128
brandon272 wrote: post #70

Earlier quoted context omitted.

This comment assumes that Apple does a lot of heavy lifting to exonerate individuals who are found with CSAM beyond just reporting them to law enforcement. Of course metadata could exonerate someone who is a victim in a case like this. The question is will it ever see the light of day?

"A lot of heavy lifting" Also known as a 20 line script which checks the last modified date for a bunch of recently uploaded files and validates the IP address against the recently known list.

The code to extract metadata is easy. I’m talking more about whether or not there is a deliberate process in place to actually write the code, run the checks and provide all available metadata and context to law enforcement. Apple has not indicated that process exists, thus far.

Re: Man steals 620k photos from iCloud accounts from home without Apple noticing

#140

Post by mulmen »

thephyber wrote: post #130
threeseed wrote: post #25

Earlier quoted context omitted.

It's only an attack vector in the minds of people who haven't given it more than 10 seconds of thought. Apple knows the sync dates of all of the photos that are uploaded. So unless someone has hacked your account and has been directly trickle feeding CSAM for years (without you noticing) then it's going to look suspicious. A big dump of lots of CSAM at one particular timestamp is a pretty easy thing to spot. And then…

> A big dump of lots of CSAM at one particular timestamp is a pretty easy thing to spot. Only if that system / heuristic has been built. The same could have been said about Apple’s systems for identifying bulk account hijacks, but Apple didn’t, which I suppose is the value of this story. And companies aren’t allowed to Just inspect content once they identify CSAM. It is kryptonite for criminal liability. Companies ar…

Are they jumping into the dark or tossing their users over the edge and listening for a splash? Or maybe a splat.
Post reply on HN