Dictionary attacks are incredibly effective. Humans have a hard time coming up with unique passwords.
And most services with password strength requirements, for that matter.
AppleID password brute force proof-of-concept
31–40 of 83 posts
Re: AppleID password brute force proof-of-concept
#32He's dead Jim https://twitter.com/hackappcom/status/506383498333007872 Still, I expected better from Apple. Props for the fast patch.
Not so fast. This can very well be the leak used to access the celebs nude pics.
Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there.
What do you guys think?
Addendum: the way it went down on 4chan points towards someone that is not an expert on extortions. You don't go to the public for some pocket change when you can have publications or the celebs paying you hundreds of thousands of dollars for those pictures. Anyway, I hope the FBI gets this freak and put him in the can for as long as they're able to.
Re: AppleID password brute force proof-of-concept
#33He's dead Jim https://twitter.com/hackappcom/status/506383498333007872 Still, I expected better from Apple. Props for the fast patch.
Not so fast. This can very well be the leak used to access the celebs nude pics. Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there. What do you guys think? Addendum: the way it went down on 4chan points towards someone that i…
Sounds plausible. And if it’s not this particular bug it may very well be some other. I find it hard to believe that someone just hacked his way into 400+ phones without any kind of glitch in the system. And judging by the fact that he went only for pictures and videos it doesn’t sound like an elaborate scam that could use high profile hacks like a fake connection antenna or something equally sophisticated.
Re: AppleID password brute force proof-of-concept
#34How is it ethical to distribute this without first disclosing to apple and waiting for a fix at least a few days?
Easy answer: It is not.
Re: AppleID password brute force proof-of-concept
#35Earlier quoted context omitted.
Not so fast. This can very well be the leak used to access the celebs nude pics. Script kiddie gets access to the script. Tests it again some easily guessable celeb. emails (or emails he already knows somehow). Gets lucky. Gets access to many other celebrities' emails, gets even luckier. The whole thing snowballs from there. What do you guys think? Addendum: the way it went down on 4chan points towards someone that i…
Sounds plausible. And if it’s not this particular bug it may very well be some other. I find it hard to believe that someone just hacked his way into 400+ phones without any kind of glitch in the system. And judging by the fact that he went only for pictures and videos it doesn’t sound like an elaborate scam that could use high profile hacks like a fake connection antenna or something equally sophisticated.
Before the bug got public, I was thinking of some sort of Bluetooth honeypot attack at a big event, say the Oscars, or Grammys
Re: AppleID password brute force proof-of-concept
#36How is it ethical to distribute this without first disclosing to apple and waiting for a fix at least a few days?
It is not and it probably had consequences (celebrity nude pics leak).
Re: AppleID password brute force proof-of-concept
#37does this mean that you can bypass the icloud activation ?
No it has nothing to do with it.
It's just a script exploiting the former lack of a brute force containment measure on Find My iPhone's login interface, now patched.
Re: AppleID password brute force proof-of-concept
#38I guess some female celebrities are going to reconsider Android next time they buy a smartphone.
Re: AppleID password brute force proof-of-concept
#39Does anyone else prefer to entirely avoid signing up for an Apple ID? I absolutely refuse to do so, and therefore use only software that doesn't require it. I suspect I'm not entirely alone out here on the sidelines...
Is it actually possible to use an iDevice without one?
Yes. You just can't download apps or use iCloud services.
Re: AppleID password brute force proof-of-concept
#40This whole "exploit / massive celebrity pics leak" is surreal... Is this Apple's answer to Cloud to Butt Google Chrome's extension?
That's the reason why I will never trust the cloud for personal stuff (for non-critical professional stuff is ok)... I'd only be willing to test MaidSafe, after they reach a stable release...