Apple's iCloud File Sharing Left Ex-Employees With Access to Secret Documents

[coolfactor]

Truly unhinged.

I'll never understand why iOS doesn't allow for multiple user accounts like the Mac has had for decades now. (I mean, I understand this is to drive device sales, but it's arbitrary and kind of awful.)

Not to drive device saies. A mobile device has much more limited resources than a fuller computer, and encryption is established on device boot-up.

Of the millions is devices sold, how many users would actually use multiple accounts? The percentage is probably super low, so why compromise everyone for a shall subset?

I agree that Apple needs to do a better job creating separate Personal and Work spaces.

 

[coolfactor]

I'll never grasp this mindset that some people have...

chip company Rivos claimed Apple intentionally lets former employees retain access to files "as part of a planned effort to generate a pretextual basis to sue the employees and their new employer for 'stealing' Apple material."

Such behaviour would be pure evil, and Apple doesn't have evil in its DNA.

 

[cybercommand]

Is Beta 5 anywhere in those iCloud files.

 

[xpxp2002]

Maybe if they didn't kill this feature they announced years ago, this problem would have been solved:

Separate iCloud accounts for personal and work lives?

Did anything actually happen with this feature they talked about at WWDC? YouTube links to timecode 01:02:09. "Have separate icloud accounts for personal and work lives? It seemed like an interesting idea for iOS 13/Catalina, but I can't find anything about it being implemented or what...

forums.macrumors.com

It's coming right after cross-device notification sync that was announced at WWDC umpteen years ago.

 

[Bkxmnr]

Sounds like HR forgot to add that to the offboarding checklist.

 

[WannaGoMac]

It's coming right after cross-device notification sync that was announced at WWDC umpteen years ago.

Still waiting for Facetime to be an open industry standard.

 

[bill38]

i would NEVER put my personal information into anything related to work. ever! crazy.

 

[bluecoast]

Wow that is staggeringly incompetent of Apple.

I’ve never worked at a big org that has sloppy security like this.

It’s normal practice at huge orgs to keep personal and work devices, accounts and permissions completely separate & to never ever to allow personal devices to access company files, logins etc.

That Apple doesn’t do this is incredible.

More foreboding - it makes me even further not trust Apple’s promises of iCloud security when their own corporate security seems to be a hot mess.

Are Apple so cheap that they won’t issue employees their own iPhones?

I think we all know the answer to that.

 

[ignatius345]

Not to drive device saies. A mobile device has much more limited resources than a fuller computer, and encryption is established on device boot-up.

You're telling me a recent iPhone or iPad doesn't have the horsepower of a MacBook Neo? 🙄

Of the millions is devices sold, how many users would actually use multiple accounts? The percentage is probably super low, so why compromise everyone for a shall subset?

Where's the compromise, exactly? You can choose to run exactly one user account on your Mac and you never even need to know it has the ability to do more. And that capability impacts your use not one bit.

And whatever the number of potential multiple-user setups on iPads or iPhones, we don't really know because it's not possible. Who can say how many people would happily share an iPad with a friend or partner if they could do without exposing any of their personal stuff to that other person. "The percentage is probably super low" is just random spectulation.

So, no, this isn't a technical limitation and it isn't a feature that would somehow "compromise" devices. It's a missing feature Macs have had for ages to let them be shared devices, and which iOS and iPadOS do not accomodate -- and which very conveniently makes it easier to buy a second device than try to share a single one.

 

[I7guy]

Apples security policies need an update I assume.

 

[bluecoast]

I'll never grasp this mindset that some people have...



Such behaviour would be pure evil, and Apple doesn't have evil in its DNA.

If this goes to court, Apple risks having their approach to corporate ‘security’ all over the news.

I’m not sure that they would want that, given it seems to be the kind of security policy that a 10 person start up would have.

 

[IAmStumped]

... for OpenAI?

Apple Sues OpenAI for Stealing Trade Secrets to Build AI Hardware

Apple today accused OpenAI of stealing Apple trade secrets and intellectual property in its effort to develop an AI hardware device. In a lawsuit filed with the Northern District of California, Apple said it uncovered evidence of a months-long scheme to steal confidential information.

www.macrumors.com

From the article:
'Apple told The Information that the OpenAI lawsuit is unrelated to any files left available on iCloud and that it does not pursue legal claims against former employees who accidentally have Apple documents in their personal iCloud accounts.'

 

[I7guy]

Wow that is staggeringly incompetent of Apple.

Nothing like some hyperbole.

I’ve never worked at a big org that has sloppy security like this.

It’s normal practice at huge orgs to keep personal and work devices, accounts and permissions completely separate & to never ever to allow personal devices to access company files, logins etc.

Not really. That is what an MDM is for, separation of personal and work.

That Apple doesn’t do this is incredible.

Beyond the hyperbole I don’t understand their security policy either.

More foreboding - it makes me even further not trust Apple’s promises of iCloud security when their own corporate security seems to be a hot mess.

Okay, so don’t trust iCloud security.

Are Apple so cheap that they won’t issue employees their own iPhones?

That must be the answer /s

I think we all know the answer to that.

I’ll challenge and say, no we don’t.

 

[anshuvorty]

Phew....I'm glad my company isn't the only company that suffers from this relatable issue....lol...if Apple's IT team can screw up like this, then, the SMB that I work for has an excuse as well...lol..

 

[anshuvorty]

Apple is finally getting a taste of what they have been forcing businesses to deal with for nearly 18 years. Let's hope they fix it.

Yeah, it will be subtly announced at their next WWDC keynote (if that); if not, then possibly in their MDM update session...

 

[actcyclist]

If you have access to something you shouldn’t have don’t you just tell work?
I somehow had access to all HR files due to an error and my work was very happy I told them.

 

[ttyRazor]

There are separate iCloud Accounts for Personal and Work. The work ones are called Managed Apple Accounts and can be integrated with an organization's SSO. BYOD iOS devices can sign into both at the same times.

About Managed Apple Accounts

Managed Apple Accounts have access to many Apple technologies, apps, and services. Some require a device with iOS 17, iPadOS 17, macOS 14, visionOS 1.1, or later.

support.apple.com

That was launched only last year, which might as well have been 5 seconds ago when it comes to rolling out major login changes across an organization the size of Apple's. There's no way they've unwound from this for every employee by now.

 

[CarAnalogy]

One of the things that died with Steve Jobs is any hope that anyone would ever touch iCloud again. It’s such an archaic system. And it literally took Steve Jobs personally cursing out a room full of people to even get that.

I sure hope Ternus has some fire ready because some teams at Apple are overdue for an asskicking.

 

[ttyRazor]

Not to drive device saies. A mobile device has much more limited resources than a fuller computer, and encryption is established on device boot-up.

Of the millions is devices sold, how many users would actually use multiple accounts? The percentage is probably super low, so why compromise everyone for a shall subset?

I agree that Apple needs to do a better job creating separate Personal and Work spaces.

That was true at some point, but we now have Macs running A-series chips without any kind of limitations to a single account. That also wouldn't account for iPads which have had M-series chips for years now.

At this point it's purely an issue with the permissions model of the OS, which iOS has been built around assuming there's only one user per device. If they were to change that assumption they would have to revisit every single feature that counts on it, many of which are security features that would have to be adjusted very carefully.

 

[jlc1978]

Apple needs to fix this issue, but this has to be one of the more ridiculous claims related to Apple in a lawsuit ever made: “Rivos claimed Apple intentionally lets former employees retain access to files ‘as part of a planned effort to generate a pretextual basis to sue the employees and their new employer for 'stealing' Apple material.’”

Never attribute to malice that which is adequately explained by stupidity,

 

[bluecoast]

Nothing like some hyperbole.

Not really. That is what an MDM is for, separation of personal and work.

Beyond the hyperbole I don’t understand their security policy either.

Okay, so don’t trust iCloud security.

That must be the answer /s

I’ll challenge and say, no we don’t.

If the below is really the case…

‘Apple files get mixed in with employees' accounts because the company encourages them to use their personal Apple Accounts with their work ‌iCloud‌ account. Employees are given a 2TB ‌iCloud‌ plan and are able to merge the storage with their existing Apple Account or create a new account. Since only one primary account can be signed in at a time, most opt to use their existing account to avoid having to carry two iPhones.’

… Then that is terrible way for a $4-5tn company to manage its business data. I’m sorry but it is.

I’m not a cyber security expert, but I very much doubt that anyone who is and who is worth their salt would look at that and sign it off.

As I said in another comment, I’d expect a BYOD policy like this from a start up.

 

[ttyRazor]

I'm not surprised at all after having seen this article from a few years ago. I doubt much if anything has changed since then, especially for any files already shared using this setup:

Apple cares about privacy, unless you work at Apple

Employees say Apple hasn’t done enough to protect their data.

www.theverge.com

Apple employees also can’t use their work email addresses to sign up for iCloud accounts, so many use their personal accounts.

 

[MacAddict1978]

There are separate iCloud Accounts for Personal and Work. The work ones are called Managed Apple Accounts and can be integrated with an organization's SSO. BYOD iOS devices can sign into both at the same times.

About Managed Apple Accounts

Managed Apple Accounts have access to many Apple technologies, apps, and services. Some require a device with iOS 17, iPadOS 17, macOS 14, visionOS 1.1, or later.

support.apple.com

This is not the same thing at all.

What you are desribing is usually using a third part tool like mobile iron or a microsoft tool - it lets the end user access their corporate apps like email or cloud portals, m365, etc. on a personal device that can be wiped and be required to have certain apps installed.

Work stuff is sandboxed - but not by using two different iCloud accounts. The user is usina their WORK CREDENTIALS - SSO stuff - and then for Apple, using their own personal iCloud accounts or creating new ones if they don't have one.

Let me tell you - I administered MacBooks - and when they would forget their iCloud passowrds, the pain it was.

Apple's problem is they've never implemented from 2013 the ability to have more than 1 iCloud account per device - and they have the same pain points all companies do with Apple devices which his hillarious!!!!

 

[MacAddict1978]

Wow that is staggeringly incompetent of Apple.

I’ve never worked at a big org that has sloppy security like this.

It’s normal practice at huge orgs to keep personal and work devices, accounts and permissions completely separate & to never ever to allow personal devices to access company files, logins etc.

That Apple doesn’t do this is incredible.

More foreboding - it makes me even further not trust Apple’s promises of iCloud security when their own corporate security seems to be a hot mess.

Are Apple so cheap that they won’t issue employees their own iPhones?

I think we all know the answer to that.

Most companies are Microsoft and all those files can be cut off and unauthenticated easily when an employee leaves.

Apple - doesn't use that - or Gsuite or anything of the sort, and they've never built the tools that segregate the two. This is why many companies IT departments HATE when people want to add Apple devices to the networks because it's always a two pronged solutiuon. The tools Apple claims for device management for business are fine if you only use Apple devices with comapny owned accounts and no other software outside of the Mac or IOS app stores. Once you got beyond that - it's a dumpster fire.

 

[I7guy]

If the below is really the case…

‘Apple files get mixed in with employees' accounts because the company encourages them to use their personal Apple Accounts with their work ‌iCloud‌ account. Employees are given a 2TB ‌iCloud‌ plan and are able to merge the storage with their existing Apple Account or create a new account. Since only one primary account can be signed in at a time, most opt to use their existing account to avoid having to carry two iPhones.’

… Then that is terrible way for a $4-5tn company to manage its business data. I’m sorry but it is.

I’m not a cyber security expert, but I very much doubt that anyone who is and who is worth their salt would look at that and sign it off.

As I said in another comment, I’d expect a BYOD policy like this from a start up.

I’m not debating that Apple may have made a mistake, I’m debating your assertion that two phones are REQUIRED to separate work and personal.