Register FAQ / Rules Forum Spy Search Today's Posts Mark Forums Read
Go Back   MacRumors Forums > News and Article Discussion > MacRumors.com News Discussion

Reply
 
Thread Tools Search this Thread Display Modes
Old Feb 20, 2013, 11:28 AM   #1
MacRumors
macrumors bot
 
Join Date: Apr 2001
iPhoneDevSDK Details What Led to Apple, Facebook Hacking




In January, a number of Apple employees had their Macs compromised following visits to the popular iPhoneDevSDK forum. Employees from Facebook and likely dozens of other companies were compromised as well. In a blog post today, site owner Ian Sefferman shared some limited details* about what happened and what the site is doing about it.

Most notably, the attack was reportedly ended by the hacker on January 30, 2013, meaning the site believes that there is no ongoing threat.

Quote:
What we've learned is that it appears a single administrator account was compromised. The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain user's computers.

We're still trying to determine the exploit's exact timeline and details, but it appears as though it was ended (by the hacker) on January 30, 2013.

As with Facebook, it's important to stress that we have no reason to believe user data was compromised.
Eric Romang has done some additional detective work on the the attack, laying much of the blame on Java itself. Last month, Apple twice blocked Java 7 from working on users' Macs, perhaps after the company discovered that its own machines had been compromised.

* URL to blog post: http://iphonedevsdk.com/forum/site-news-announcements/111889-iphonedevsdk-compromised-what-happened-and-how-we-are-dealing-with-it.html -- We've avoiding linking it due to the recent hack at that site.

Article Link: iPhoneDevSDK Details What Led to Apple, Facebook Hacking
MacRumors is offline   0 Reply With Quote
Old Feb 20, 2013, 11:31 AM   #2
newagemac
macrumors 68000
 
Join Date: Mar 2010
Is it Java or Javascript? Those are two entirely different things. Java is a plugin with security holes and can be disabled. Javascript is not Java in any way, shape, or form and is not a plugin. It is now as basic to the web as HTML and CSS. You shouldn't disable Javascript unless you want to break pretty much any modern website.

One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.

Last edited by newagemac; Feb 20, 2013 at 11:38 AM.
newagemac is offline   12 Reply With Quote
Old Feb 20, 2013, 11:36 AM   #3
arn
macrumors god
 
arn's Avatar
 
Join Date: Apr 2001
Send a message via AIM to arn
Quote:
Originally Posted by newagemac View Post
Is it Java or Javascript? Those are two entirely different things.
sounds like js was included in the web page, possibly to load external code.

some additional details here:

http://eromang.zataz.com/2013/02/20/...-informations/
arn is offline   1 Reply With Quote
Old Feb 20, 2013, 11:36 AM   #4
jlgolson
Editor
 
jlgolson's Avatar
 
Join Date: Jun 2011
Location: Durango, CO
Send a message via AIM to jlgolson
Quote:
Originally Posted by newagemac View Post
Is it Java or Javascript? Those are two entirely different things.
Apparently they used a JavaScript exploit to inject Java code. It's all a little unclear at the moment. Hopefully Facebook or (less likely) Apple will post a play-by-play going into exactly what happened at some point.
__________________
Jordan Golson -- Editor at MacRumors -- jlgolson@macrumors.com -- @jlgolson
jlgolson is offline   3 Reply With Quote
Old Feb 20, 2013, 11:39 AM   #5
Sean4000
macrumors member
 
Join Date: Aug 2010
Location: Louisiana
and THIS is why "noscript" is mandatory on all of my company's computers.
__________________
"They say time is the fire in which we burn. Right now my time is running out. We leave so many things unfinished in our lives......."
Sean4000 is offline   4 Reply With Quote
Old Feb 20, 2013, 11:51 AM   #6
TouchMint.com
macrumors 65816
 
TouchMint.com's Avatar
 
Join Date: May 2012
Location: Phoenix
Still scared to start checking iphonedevsdk at work even on a windows machine. =/
__________________
TouchMint.com iOS App Site
Adventure To Fate iOS RPG Game Site
Indie iOS Game: Adventure To Fate : A Quest To The Core JRPG

TouchMint.com is offline   0 Reply With Quote
Old Feb 20, 2013, 11:57 AM   #7
Mr. Retrofire
macrumors 601
 
Mr. Retrofire's Avatar
 
Join Date: Mar 2010
Location: www.emiliana.cl
That happens, if you use browsers with enabled plugins, on sites where you do not need those plugins.

And, i agree: No not use Safari. Use Firefox + NoScript + Adblock Plus.
__________________

“Only the dead have seen the end of the war.”
-- Plato --
Mr. Retrofire is offline   0 Reply With Quote
Old Feb 20, 2013, 12:21 PM   #8
newagemac
macrumors 68000
 
Join Date: Mar 2010
Quote:
Originally Posted by jlgolson View Post
Apparently they used a JavaScript exploit to inject Java code. It's all a little unclear at the moment. Hopefully Facebook or (less likely) Apple will post a play-by-play going into exactly what happened at some point.
Looking at Arn's link, it appears a Javascript file was used to inject Java code targeting the exploited Java plugin. Javascript itself wasn't exploited. You might as well have said HTML was used to inject Java code which would be correct as well.

But like you said it seems a bit unclear at the moment. In any case, the Java plugin once again appears to be the problem and what is actually being exploited because of its security issues, not Javascript or HTML for that matter.
newagemac is offline   1 Reply With Quote
Old Feb 20, 2013, 05:31 PM   #9
CShort
macrumors regular
 
Join Date: Aug 2011
Quote:
Originally Posted by jlgolson View Post
Apparently they used a JavaScript exploit to inject Java code. It's all a little unclear at the moment. Hopefully Facebook or (less likely) Apple will post a play-by-play going into exactly what happened at some point.
But then it's not a JavaScript "exploit", it's just JavaScript doing a run-of-the-mill call, it's still a problem with Java and not Javascript.
Saying that a Javascript exploit was used still doesn't cut it to me - but this is Apple and a HTML exploit was used for Macdefender malware right? So I guess anything is possible.

Just take note, my Apple computer now requires a password for absolutely anything, it's like windows was back in 2002. My Windows 8 computer now is basically password free. I think Apple is in the security defensive mode that Windows was in a long time ago, Windows has (maybe?) got security relatively down pat and doesn't require authentication multiple times just to move a file but Apple is doing anything to prevent it's flaws being exploited, that's my assessment of the security situation.

Update: Macdefender did use Javascript (but IIRC required the user to input admin password so it was "social engineering" rather than a flaw in Javascript). The updated version of MacDefender called MacGuard simply used the "download safe files" option in Safari to automatically download a file that elevated itself to Admin and installed the malware... hmmm

Links:
http://www.pcworld.com/article/22684...e_to_macs.html
http://www.pcworld.com/article/22895...s_variant.html

Last edited by CShort; Feb 20, 2013 at 05:34 PM. Reason: added links
CShort is offline   0 Reply With Quote
Old Feb 20, 2013, 11:59 AM   #10
coolfactor
macrumors 65816
 
Join Date: Jul 2002
Location: Vancouver, BC CANADA
Quote:
Originally Posted by newagemac View Post
Is it Java or Javascript? Those are two entirely different things. Java is a plugin with security holes and can be disabled. Javascript is not Java in any way, shape, or form and is not a plugin. It is now as basic to the web as HTML and CSS. You shouldn't disable Javascript unless you want to break pretty much any modern website.

One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.
The proper name for JavaScript is actually ECMAScript, of which JavaScript is one dialect.

In this case, JavaScript was used at the site to inject malicious code that then used Java (not JavaScript) to compromise the systems.
coolfactor is offline   1 Reply With Quote
Old Feb 20, 2013, 01:42 PM   #11
leman
macrumors 68040
 
Join Date: Oct 2008
Quote:
Originally Posted by newagemac View Post
One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.
This is why I always call it ECMAScript
leman is offline   0 Reply With Quote
Old Feb 20, 2013, 02:44 PM   #12
newagemac
macrumors 68000
 
Join Date: Mar 2010
Quote:
Originally Posted by leman View Post
This is why I always call it ECMAScript
Doesn't matter if everyone else is calling it Javascript. Also doesn't help that the extension browsers recognize is "js" not "es" and the browsers list it as javascript. The masses go to their browser preferences and turn off the Java plugin and see "Javascript" and think they have to turn that off too. Not good.
newagemac is offline   0 Reply With Quote
Old Feb 20, 2013, 11:31 AM   #13
PinoyAko
macrumors 6502
 
Join Date: Nov 2012
The Java update yesterday was magical and revolutionary.
PinoyAko is offline   2 Reply With Quote
Old Feb 20, 2013, 01:34 PM   #14
iGrip
Banned
 
Join Date: Jul 2010
Send a message via ICQ to iGrip Send a message via AIM to iGrip Send a message via MSN to iGrip Send a message via Yahoo to iGrip Send a message via Skype™ to iGrip
Insecure?

So lots and lots of big giant companies were hacked. It was the fault of some third party.


But all we hear about is that Apple was hacked! Apple has lousy security! Anybody who owns any Apple anything is in SERIOUS DANGER! Run for the hills, but only after destroying all Apple products!

Typical. Apple is just the whipping boy of the mainstream media.

They go into a frenzy and let everybody else have a pass. But not Apple. They act like it is all Apple's fault. They pick on Apple. It is not FAIR! Apple is a scapegoat. Everybody who owns any Apple anything is seen as a lesser person because of this stuff. A complete and total idiot.

I for one am sick of it.

/s

----------

Quote:
Originally Posted by knucklehead View Post
Well, I use Safari with Java disabled, AdBlock, and Click to Flash. I had been thinking of adding one of the NoScript extensions, but haven't gotten around to it yet. Unfortunately, I got suckered in by a Phishing attempt a few days ago (it's no longer safe to check your email before you're fully awake...) and am wondering what to do about it.
Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
iGrip is offline   4 Reply With Quote
Old Feb 20, 2013, 01:40 PM   #15
uncle.zed
macrumors newbie
 
Join Date: Nov 2009
To be honest I don't see the point in going around web without javascript. usage is like 20%, looks like 10% and safety is like maby +5%...
__________________
iMac 27" 2011 i7 12GB RAM 1TB HDD | MacBook White 2007 2Ghz 2GB RAM 250GB HDD intel950.... | iP5
uncle.zed is offline   0 Reply With Quote
Old Feb 20, 2013, 01:44 PM   #16
knucklehead
macrumors 6502a
 
Join Date: Oct 2003
Quote:
Originally Posted by iGrip View Post

Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
And here I was just thinking of diving out the window ...
knucklehead is offline   0 Reply With Quote
Old Feb 20, 2013, 02:01 PM   #17
PBG4 Dude
macrumors 65816
 
Join Date: Jul 2007
Just use an iPad for browsing. that's what I do anyway.
PBG4 Dude is online now   0 Reply With Quote
Old Feb 20, 2013, 02:13 PM   #18
maxosx
macrumors 68020
 
Join Date: Dec 2012
Location: Southern California
Quote:
Originally Posted by PBG4 Dude View Post
Just use an iPad for browsing. that's what I do anyway.
I do, however that's just for news, special interests etc.

Conversely I _work_ in a web based environment & thus have no choice but to stay as educated & aware as possible, practice safe computing, and follow the companies guidelines as close as possible.
maxosx is offline   0 Reply With Quote
Old Feb 20, 2013, 02:18 PM   #19
Anaemik
macrumors 6502
 
Join Date: Feb 2009
Edit: ignore
Anaemik is offline   0 Reply With Quote
Old Feb 20, 2013, 02:25 PM   #20
runeapple
macrumors 6502
 
Join Date: Mar 2010
Quote:
Originally Posted by PBG4 Dude View Post
Just use an iPad for browsing. that's what I do anyway.
Not always easy especially when coding - it's far easier to copy the code and amend it the way you want it - to typing it all out.

Also downloading isn't possible/easy and various websites don't work properly on iPad.

I do try and browser on my iPad as much as possible but when doing app development work it's far easier on a Mac - and that site is used for development.
runeapple is offline   0 Reply With Quote
Old Feb 20, 2013, 03:42 PM   #21
iGrip
Banned
 
Join Date: Jul 2010
Send a message via ICQ to iGrip Send a message via AIM to iGrip Send a message via MSN to iGrip Send a message via Yahoo to iGrip Send a message via Skype™ to iGrip
Quote:
Originally Posted by knucklehead View Post
And here I was just thinking of diving out the window ...
That may still be your best bet in the long run, bit I was thinking more along the lines of a short-term solution.

----------

Quote:
Originally Posted by PBG4 Dude View Post
Just use an iPad for browsing. that's what I do anyway.
I have difficulty with the old-school narrow-screen aspect ratio. It may be good for watching reruns of I Love Lucy, but for anything else, I much prefer the normal aspect ratio.
iGrip is offline   0 Reply With Quote
Old Feb 20, 2013, 03:55 PM   #22
TouchMint.com
macrumors 65816
 
TouchMint.com's Avatar
 
Join Date: May 2012
Location: Phoenix
Just read a report that suggests even after apple knew developers were at risk they did nothing to contact iphonedevsdk of the problem (I know its not their job to fix this but you really couldn’t help them out?). This is just more evidence that Apple does not care about anyone but themselves. They defiantly don’t care about developers this is just another sign.


http://www.cultofmac.com/216711/appl...-about-attack/
__________________
TouchMint.com iOS App Site
Adventure To Fate iOS RPG Game Site
Indie iOS Game: Adventure To Fate : A Quest To The Core JRPG

TouchMint.com is offline   1 Reply With Quote
Old Feb 20, 2013, 04:45 PM   #23
Peace
macrumors P6
 
Join Date: Apr 2005
Location: Space--The ONLY Frontier
Quote:
Originally Posted by TouchMint.com View Post
Just read a report that suggests even after apple knew developers were at risk they did nothing to contact iphonedevsdk of the problem (I know its not their job to fix this but you really couldn’t help them out?). This is just more evidence that Apple does not care about anyone but themselves. They defiantly don’t care about developers this is just another sign.


http://www.cultofmac.com/216711/appl...-about-attack/
cultofmac has no clue about Apple's dealings with developers.

First off developers shouldn't have to go to that website when Apple hosts a developer discussion site. Officially.

"It seems unconscionable that Apple wouldn’t contact the site administrators. iPhone Dev SDK is a portal and resource for the very developers who have made iOS great. To not warn the site administrators is to allow the developers who use the site to become compromised."

Had I been Apple I would have had the website shut down for breaking Apple's NDA for developers.

The only unconscionable act going on is the website knowingly hosting discussions about confidential information.

Furthermore I would have fired the Apple engineers that visited the site.

And for your information Apple is looking into bettering relationships for IOS developers.

If anybody ever visited the ADC discussions they would know that.

Apple has become way too loose about IOS seeding. Every script kiddie and their little brother has a copy of IOS dev seeds.

I do think that is all changing as we type.
Peace is offline   0 Reply With Quote
Old Feb 20, 2013, 03:38 PM   #24
spazzcat
macrumors 68000
 
spazzcat's Avatar
 
Join Date: Jun 2007
Quote:
Originally Posted by iGrip View Post
So lots and lots of big giant companies were hacked. It was the fault of some third party.


But all we hear about is that Apple was hacked! Apple has lousy security! Anybody who owns any Apple anything is in SERIOUS DANGER! Run for the hills, but only after destroying all Apple products!

Typical. Apple is just the whipping boy of the mainstream media.

They go into a frenzy and let everybody else have a pass. But not Apple. They act like it is all Apple's fault. They pick on Apple. It is not FAIR! Apple is a scapegoat. Everybody who owns any Apple anything is seen as a lesser person because of this stuff. A complete and total idiot.

I for one am sick of it.

/s

----------



Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
If he gave his SS, he will want to lock(freeze) all this credit reports.

----------

Quote:
Originally Posted by leman View Post
This is why I always call it ECMAScript
Sounds like it was JavaScript first...

http://en.wikipedia.org/wiki/ECMAScript
spazzcat is offline   0 Reply With Quote
Old Feb 20, 2013, 04:08 PM   #25
mtngoatjoe
macrumors regular
 
Join Date: Jun 2008
Is there ever a reason to suspect user data was stolen? I mean, no one wants to admit user data was stolen, so I'm not sure any company has a reason to look for evidence. Why would they want to know?
mtngoatjoe is offline   0 Reply With Quote

Reply
MacRumors Forums > News and Article Discussion > MacRumors.com News Discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Similar Threads
thread Thread Starter Forum Replies Last Post
Apple Employees Hacked By Visiting iPhoneDevSDK MacRumors MacRumors.com News Discussion 63 Feb 20, 2013 09:14 PM
Where can I see all my Apple account details? desertman Mac Basics and Help 5 Feb 19, 2013 05:18 PM
People who Know A Lot About Hacking/Encryption. What do U Think About Apple's Claims VideoNewbie iPhone 22 Oct 14, 2012 07:37 PM
iPhoneDevSDK gone? KarlJay App Store Business, Legal and Marketıng 51 Jul 19, 2012 05:48 AM

Forum Jump

All times are GMT -5. The time now is 08:29 AM.

Mac Rumors | Mac | iPhone | iPhone Game Reviews | iPhone Apps

Mobile Version | Fixed | Fluid | Fluid HD
Copyright 2002-2013, MacRumors.com, LLC