Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

iPhoneDevSDK Details What Led to Apple, Facebook Hacking

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,487
30,721



In January, a number of Apple employees had their Macs compromised following visits to the popular iPhoneDevSDK forum. Employees from Facebook and likely dozens of other companies were compromised as well. In a blog post today, site owner Ian Sefferman shared some limited details* about what happened and what the site is doing about it.

Most notably, the attack was reportedly ended by the hacker on January 30, 2013, meaning the site believes that there is no ongoing threat.

iphonedevsdk.jpg
What we've learned is that it appears a single administrator account was compromised. The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain user's computers.

We're still trying to determine the exploit's exact timeline and details, but it appears as though it was ended (by the hacker) on January 30, 2013.

As with Facebook, it's important to stress that we have no reason to believe user data was compromised.
Click to expand...
Eric Romang has done some additional detective work on the the attack, laying much of the blame on Java itself. Last month, Apple twice blocked Java 7 from working on users' Macs, perhaps after the company discovered that its own machines had been compromised.

* URL to blog post: http://iphonedevsdk.com/forum/site-news-announcements/111889-iphonedevsdk-compromised-what-happened-and-how-we-are-dealing-with-it.html -- We've avoiding linking it due to the recent hack at that site.

Article Link: iPhoneDevSDK Details What Led to Apple, Facebook Hacking
 
Article Link
https://www.macrumors.com/2013/02/20/iphonedevsdk-details-what-led-to-apple-facebook-hacking/
N

newagemac

macrumors 68020
Mar 31, 2010
2,091
23
Is it Java or Javascript? Those are two entirely different things. Java is a plugin with security holes and can be disabled. Javascript is not Java in any way, shape, or form and is not a plugin. It is now as basic to the web as HTML and CSS. You shouldn't disable Javascript unless you want to break pretty much any modern website.

One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.
 
Last edited:
jlgolson

jlgolson

Contributing Editor
Jun 2, 2011
383
8
Durango, CO
newagemac said:
Is it Java or Javascript? Those are two entirely different things.
Click to expand...
Apparently they used a JavaScript exploit to inject Java code. It's all a little unclear at the moment. Hopefully Facebook or (less likely) Apple will post a play-by-play going into exactly what happened at some point.
 
Mr. Retrofire

Mr. Retrofire

macrumors 603
Mar 2, 2010
5,064
518
www.emiliana.cl/en
That happens, if you use browsers with enabled plugins, on sites where you do not need those plugins.

And, i agree: No not use Safari. Use Firefox + NoScript + Adblock Plus.
 
C

coolfactor

macrumors 604
Jul 29, 2002
7,040
9,697
Vancouver, BC
newagemac said:
Is it Java or Javascript? Those are two entirely different things. Java is a plugin with security holes and can be disabled. Javascript is not Java in any way, shape, or form and is not a plugin. It is now as basic to the web as HTML and CSS. You shouldn't disable Javascript unless you want to break pretty much any modern website.

One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.
Click to expand...

The proper name for JavaScript is actually ECMAScript, of which JavaScript is one dialect.

In this case, JavaScript was used at the site to inject malicious code that then used Java (not JavaScript) to compromise the systems.
 
N

newagemac

macrumors 68020
Mar 31, 2010
2,091
23
jlgolson said:
Apparently they used a JavaScript exploit to inject Java code. It's all a little unclear at the moment. Hopefully Facebook or (less likely) Apple will post a play-by-play going into exactly what happened at some point.
Click to expand...

Looking at Arn's link, it appears a Javascript file was used to inject Java code targeting the exploited Java plugin. Javascript itself wasn't exploited. You might as well have said HTML was used to inject Java code which would be correct as well.

But like you said it seems a bit unclear at the moment. In any case, the Java plugin once again appears to be the problem and what is actually being exploited because of its security issues, not Javascript or HTML for that matter.
 
K

knucklehead

macrumors 6502a
Oct 22, 2003
545
2
Mr. Retrofire said:
That happens, if you use browsers with enabled plugins, on sites where you do not need those plugins.

And, i agree: No not use Safari. Use Firefox + NoScript + Adblock Plus.
Click to expand...

Well, I use Safari with Java disabled, AdBlock, and Click to Flash. I had been thinking of adding one of the NoScript extensions, but haven't gotten around to it yet. Unfortunately, I got suckered in by a Phishing attempt a few days ago (it's no longer safe to check your email before you're fully awake...) and am wondering what to do about it.
 
calaverasgrande

calaverasgrande

macrumors 65816
Oct 18, 2010
1,291
161
Brooklyn, New York.
I am actually surprised that it isn't a wordpress site. Last time I helped some folks set up a wordpress blog the comments section was filled with Nike Air Jordan and Dre Beats spam within 3 days.
Vanilla Forum looks kind of neat though. Too bad it seems to have a hole.
 
smithrh

smithrh

macrumors 68030
Feb 28, 2009
2,722
1,730
arn said:
some additional details here:

http://eromang.zataz.com/2013/02/20...watering-hole-attack-additional-informations/
Click to expand...

It's dead, Jim.

calaverasgrande said:
I am actually surprised that it isn't a wordpress site. Last time I helped some folks set up a wordpress blog the comments section was filled with Nike Air Jordan and Dre Beats spam within 3 days.
Click to expand...

Wordpress and comments aren't a good combination, that's for sure. You can certainly get good mileage out of WordPress though - but you need to be careful, which is ironic as WordPress seems to be designed for people without web design experience.
 
iGrip

iGrip

macrumors 68000
Jul 1, 2010
1,626
0
Insecure?

So lots and lots of big giant companies were hacked. It was the fault of some third party.


But all we hear about is that Apple was hacked! Apple has lousy security! Anybody who owns any Apple anything is in SERIOUS DANGER! Run for the hills, but only after destroying all Apple products!

Typical. Apple is just the whipping boy of the mainstream media.

They go into a frenzy and let everybody else have a pass. But not Apple. They act like it is all Apple's fault. They pick on Apple. It is not FAIR! Apple is a scapegoat. Everybody who owns any Apple anything is seen as a lesser person because of this stuff. A complete and total idiot.

I for one am sick of it.

/s

----------
knucklehead said:
Well, I use Safari with Java disabled, AdBlock, and Click to Flash. I had been thinking of adding one of the NoScript extensions, but haven't gotten around to it yet. Unfortunately, I got suckered in by a Phishing attempt a few days ago (it's no longer safe to check your email before you're fully awake...) and am wondering what to do about it.
Click to expand...

Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
 
uncle.zed

uncle.zed

macrumors member
Nov 17, 2009
54
57
To be honest I don't see the point in going around web without javascript. usage is like 20%, looks like 10% and safety is like maby +5%...
 
L

leman

macrumors Core
Oct 14, 2008
19,183
19,029
newagemac said:
One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.
Click to expand...

This is why I always call it ECMAScript ;)
 
K

knucklehead

macrumors 6502a
Oct 22, 2003
545
2
iGrip said:
Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
Click to expand...

And here I was just thinking of diving out the window ...
 
M

maxosx

macrumors 68020
Dec 13, 2012
2,385
1
Southern California
PBG4 Dude said:
Just use an iPad for browsing. :) that's what I do anyway.
Click to expand...

I do, however that's just for news, special interests etc.

Conversely I _work_ in a web based environment & thus have no choice but to stay as educated & aware as possible, practice safe computing, and follow the companies guidelines as close as possible.
 
R

runeapple

macrumors 6502a
Mar 5, 2010
663
123
PBG4 Dude said:
Just use an iPad for browsing. :) that's what I do anyway.
Click to expand...

Not always easy especially when coding - it's far easier to copy the code and amend it the way you want it - to typing it all out.

Also downloading isn't possible/easy and various websites don't work properly on iPad.

I do try and browser on my iPad as much as possible but when doing app development work it's far easier on a Mac - and that site is used for development.
 
R

rekoil

macrumors newbie
Jul 22, 2002
13
0
From my reading, it was an administrator account that was compromised, not the site itself. This points to malware that made it onto an admin's workstation (not necessarily a vulnerability in the website itself), and from there a keylogger (or maybe an ssh key or other stored password file) allowed the intruder admin access to the site. From there, the attacker was able to inject javascript which visiting clients then executed in order to load the exploited Java code via the Java browser plugin.

This is usually how these attacks work - find a small foothold, then iterate from there for wider penetration.
 
N

newagemac

macrumors 68020
Mar 31, 2010
2,091
23
leman said:
This is why I always call it ECMAScript ;)
Click to expand...

Doesn't matter if everyone else is calling it Javascript. Also doesn't help that the extension browsers recognize is "js" not "es" and the browsers list it as javascript. The masses go to their browser preferences and turn off the Java plugin and see "Javascript" and think they have to turn that off too. Not good.
 
S

SeattleMoose

macrumors 68000
Jul 17, 2009
1,960
1,670
Der Wald
After all this java stuff, I went into Safari and disabled Java (not JavaScript) and guess what? Safari is INDEED snappier!!! (no joke...it really is).

And I agree with a previous poster, Apple is the media's favorite whipping boy right now. Wallstreet's lapdog, the media, is being used to manipulate AAPL stock prices via fear and gloom. When they have driven it down low enough...the sharks will buy-up AAPL yet again...run a bunch of positive articles (PUMP)...followed by yet another DUMP when it gets to their target "high" value. Then they'll place puts on AAPL, run more gloom and doom stories, and make money on the way down too. And then you have Einhorn, the hedge fund "humanitarian" who simply wants to raid the APPL cash pile for his elite clients. It has already been proven that AAPL stock volatility was tied directly to hedge fund manipulation. Expect more...unfortunately. Wallstreet is just a steaming pile.
 
spazzcat

spazzcat

macrumors 68040
Jun 29, 2007
3,663
4,759
iGrip said:
So lots and lots of big giant companies were hacked. It was the fault of some third party.


But all we hear about is that Apple was hacked! Apple has lousy security! Anybody who owns any Apple anything is in SERIOUS DANGER! Run for the hills, but only after destroying all Apple products!

Typical. Apple is just the whipping boy of the mainstream media.

They go into a frenzy and let everybody else have a pass. But not Apple. They act like it is all Apple's fault. They pick on Apple. It is not FAIR! Apple is a scapegoat. Everybody who owns any Apple anything is seen as a lesser person because of this stuff. A complete and total idiot.

I for one am sick of it.

/s

----------



Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
Click to expand...

If he gave his SS, he will want to lock(freeze) all this credit reports.

----------
leman said:
This is why I always call it ECMAScript ;)
Click to expand...

Sounds like it was JavaScript first...

http://en.wikipedia.org/wiki/ECMAScript
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom