Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Apple Says No Personal Data Was Compromised in Australian Teenager Hacking Incident
- Thread starter MacRumors
- Start date
- Sort by reaction score
I think it's arguably the case, given the info that's been reported.
Checking the original article:
There was also mention of an iPhone matching the IP of the intruder.
This is interesting then, there has to be something sent in the network traffic that allowed Apple to ID the machines.
Doesn’t say what operating system he was running. It could have been El Capitan for all we know.... or even Windows.
Again, depending on the service access, it could very well pass the serial number along. I have not seen any mention of what service was used during this attach.
Real pros that don't get caught use something like Parabola Linux on Thinkpad flashed with Libreboot BIOS.
There's nothing puzzling about it. The companies are just too large and not everything can be protected. I know two individual who are responsible for Apple's security. They're both excellent individuals who really know their stuff. But the reality is a network the size of Apple is impossible to secure. Even if the business wasn't constantly overriding security professionals advice there's only so much you can do. The reality is a business which hasn't been hacked will be hacked (or has been hacked and they either don't know it or haven't reported it). So business / individuals need to just suck it up and accept this it the world we live in today.
0 chance he will do any jail time. In any case it will be wiped off his record when he turns 18.
I don't think you know what encrypted means.
It's got nothing to do with preventing a hack. It prevents the hacker from reading any data from the hack.
In all likelihood the data the kid download was encrypted, which means totally useless to him, just data blocks he can't make sense of - and if it wasn't encrypted then it wasn't important.
That was my first thought. Makes me wonder what my Mac is sending to Apple. Maybe he left the "send diagnostics to Apple" box checked, then some hacking tool crashed and sent a report?
I haven't read the details of the hack but I'm going to disagree with you. Data can be encrypted at rest or in transit. You appear to be referring to the former (i.e. he downloaded an encrypted file and therefore is useless). A lot of remote data compromises happen via DB, typically through the application layer. An application which has valid need for the data. As such the data would not be encrypted (otherwise it would be useless to the application). SQL injection is a prime example of how encrypted (at rest) data can be obtained in clear text.
Likewise don't assume just because it wasn't encrypted it was therefore unimportant. Too much important data is left unencrypted.
Cyber-crime is a bit different, with the blame falling more on the victim than the attacker because the security is supposed to be flawless. Provided the attacker doesn't abuse the stolen data, which it sounds like he didn't, and that the attack isn't something dumb and destructive like DDoS.
Last edited:
I had to laugh at the following:That was my first thought. Makes me wonder what my Mac is sending to Apple. Maybe he left the "send diagnostics to Apple" box checked, then some hacking tool crashed and sent a report?
"Apple’s servers are widely believed to be unhackable…"
Those who think that are naïve.
[doublepost=1534535919][/doublepost]
Only if you're an Apple fanboy who believes Apple is infallible.
Dang, I should've done all my hacking before I turned 18. Now I'd go to real jail if I did it.
A standard database client-server setup will use TLS to secure the connection, so the data is also encrypted in transit between the DB and the app server. Sometimes this is disabled on a private network because that's already encrypted at a lower layer, but I'd think they'd leave it enabled.
Real pros use their brain and not brawn and aren't full of excuses. Plus, there are options other than DYI.
https://puri.sm/
Which is irrelevant if the compromise is through the app server.
Don’t get me wrong, when you posted that you immediately reminded me of a guy I goto school with who walks around with his $100 thinkpad from eBay, libreboot, etc. and he’s absolutely brilliant... if just a bit paranoid. Haha
