Celebrity iCloud Accounts Compromised by Weak Passwords, Not iCloud Breach

[C DM]

I don't know if other companies like Microsoft and Google have been breached in a similar manner to iCloud, but if they haven't perhaps it's due to this:

Online services such as Microsoft or Google implement two-factor authentication in a different manner, asking their customers to come up with a second piece of an ID when attempting to access their services from a new device. This is supposed to prevent anyone stealing your login and password information from gaining access to your account from devices other than your own, verified PC, phone or tablet.

http://blog.crackpassword.com/2013/05/apple-two-factor-authentication-and-the-icloud/

None of that would really help or apply of people aren't using those extra measures, as most aren't and those who would have things taken from them don't.

----------

The example was that "the value of the target has to match your security". Murderers walk through doors too.

Insurance companies are nothing but pragmatic. They don't care about right and wrong, they care about expected values. They therefore expect you to protect their risk, it's in the contract you sign, and is enforced by law.

Your point about the freedom to do bad things to yourself though is a different conversation. When Budweiser says "drink responsibly" it's so they aren't held as liable for also telling you that you're sexy and fun when you're drinking their beer.

It varies a lot by jurisdiction but, in most places I'm aware of, the law makes no distinction as to whether the door was locked, closed or if a space is merely occupied or private-- that is, whether the password was 16 random unicode characters or 1234 or the contents were simply not yours.

If you say both parties are to blame, you are saying that the criminal is not fully to blame.

No doubt better security would have saved these women some unpleasantness. I feel bad and wish they'd been more careful, but it's not their fault that their private property was stolen.

Why can't the perpetrator still be blamed for the crime, while the victim still be educated about what they didn't do and could have done and/or did do but shouldn't have done? These aren't exactly mutually exclusive things, nor should either one of those things be overlooked/ignored.

 

[Trapezoid]

you can re-read apples' statement.

I just did. Apparently you should too.

 

[iBug2]

The example was that "the value of the target has to match your security". Murderers walk through doors too.

I suggest you go back and read everything. The example was about robberies.

Insurance companies are nothing but pragmatic. They don't care about right and wrong, they care about expected values. They therefore expect you to protect their risk, it's in the contract you sign, and is enforced by law.

And they aren't wrong.

It varies a lot by jurisdiction but, in most places I'm aware of, the law makes no distinction as to whether the door was locked, closed or if a space is merely occupied or private-- that is, whether the password was 16 random unicode characters or 1234 or the contents were simply not yours.

If someone walks into your home, does not steal anything and walks out through a door you left open, that's trespassing. It's not breaking and entering. And the punishment is severely different.

If you say both parties are to blame, you are saying that the criminal is not fully to blame.

Countless posts where I said the opposite and you are still stubborn to not get it, somehow. I think you are just doing it intentionally now.

No doubt better security would have saved these women some unpleasantness. I feel bad and wish they'd been more careful, but it's not their fault that their private property was stolen.

If they didn't do what's expected of them, it is their fault yes.

 

[okwhatev]

I work with a lot of celebrities, and just two weeks ago one of them (a very attractive and famous one) asked me what the hell an imessage sent to her asking for her credentials was. The imessage source was claiming to be Apple. I said never give anything to ANYONE and that believe me, Apple already has her information.

Anyhow, this is the same text many celebs got around the same time. Im guessing that this script mixed with some social engineering was able to figure out the user names with a bit of work, then they simply used the forensic software mentioned to actually download everything.... which... being reverse engineered to specifically avoid timeout detection or server-side automated responses, wouldn't have sent warnings to the account holders. This is a weakness in apple's end, as there should be redundancy checks on Apple's end that would survive a reverse engineered gateway app. I'm guessing this is some really great hacking work possibly helped along by someone previously at apple who helped the reverse engineering take shape.

Regardless... iCloud is in general extremely secure. To say apple doesn't care about security is absolutely idiotic. This is the same company that now scrambles MAC addresses on their devices each time you connect to the internet in iOS 8. They care. They care a LOT.

this was an unfortunate case where passwords were provided by the celebrities themselves in an iMessage phishing scam masquerading as apple. The forensic program allowing restores to be downloaded with account passwords from apple's servers without engaging the usual system of alerts to the user's account is no doubt being investigated and patched now but it's not some easily preventable flaw that they overlooked, but likely rather a overflow discovered in whatever Linux server racks apple happens to use.

 

[Dilster3k]

It's a shame that iCloud is getting all the blame.

 

[samcraig]

OK, Let's talk about each one


Ok, you found two. Congrats. Notice none of them was mine.

But the others you extrapolated to something they didn't actually say. Can you at least be honest when you argue about something so I can respect what you have to say?

Let's not talk about each one since your request was to find ONE. You clearly stated NO ONE. You even emphasized it by putting it in ALL CAPS. I understand - for someone like you, it's hard to be proven wrong. You're better served just replying back "Ah - ok - I was wrong. It appears at least one - and possibly others do feel that way." then to reply back trying to negate what is obvious to many.

I also never claimed any were yours. Are you introducing a strawman argument now? Talking about "honest." Or trying to further bait a discussion. It's not going to work because after this post, I won't be replying to you on this topic.

Lastly - I don't give a fig whether you respect what I have to say. Even less so that after proven that you're wrong you still want to twist the "argument" around as if you "won."

But thanks for the laugh this morning. You're funny.

 

[Analog Kid]

What you are labeling as "blaming the victim"
...
I am calling "learning how to protect yourself BEFORE something bad happens". We can't give this kind of advice without someone like you calling it "blaming the victim" so there can't be any simple way to help people avoid being victims.
...
What you are doing is protecting people AFTER they have been victimized, when it's too late and doesn't really matter much in the scheme of things. What I am doing is protecting people as much as one can BEFORE they are victimized. ... You shouldn't require laws to force you to protect yourself.
...
You also seem to be one of those annoying types of people who always posts about theoretical worlds that don't actually exist. I am a logical person living in a real world where most people don't always act the way they "should".
...
P.S. Most people can separate in their minds the ideas of people protecting themselves and criminals being punished. The two aren't mutually exclusive.

You aren't reading, you're just arguing with a straw man.

I'm pretty sure you won't find the label "blame the victim" in any of my comments.

The first sentence of my comment, on a line by itself, was:

There is a difference between expecting something bad to happen and assigning blame.

and I clearly said:

I'm well aware of the imperfections of the world, and I wouldn't council any woman I know to do such a thing, but I wouldn't blame them for the consequences.

The conversation was about who is at fault for the crime, now you're making it about how to protect yourself from crime. I never suggested that people shouldn't protect themselves, only that they shouldn't be blamed for bad things that others do to them. Those are totally different conversations that shouldn't be difficult to separate.

Which is kind of the point you make at the end... Did you pivot just to continue arguing?

 

[tbrinkma]

Yep. But usually a far lower percentage of citizens do per annum, than those who do not follow best practices and good safety procedures.

Follow the numbers. The numbers are a stronger hint than a random person's opinion on who to blame or not.

Basic numeracy.

Ok, you tell me. At what point does 'basic numeracy' lay the blame for a criminals action on the victim?

How many people does it take getting mugged before it's *not* the criminal's fault any more? Before we start prosecuting the *victim*, because somehow it's *their* fault that the mugger chose to commit a crime?

Seriously?

----------

But celebrity nudes are like Gold Bricks... If you just left gold bricks on your kitchen table or underware drawer, then yeah, it's kinda your fault. Put them somewhere SAFE.

No, it's *not* "your fault" (not even "kinda") when someone commits a crime and you are the victim.

----------

And I'm saying that it's your fault partly. Don't confuse fault with guilt please. The robber would still get the same punishment but you are faulty in one case and not faulty in another. You being faulty does not take away the guilt from the robber.

Is it really so hard to understand that what we are discussing is simply opinions and neither me or you is wrong?

I think you are to blame if you leave your door open. The robber is guilty.

I think you are less to blame if you lock your door but leave the key under the mattress. The robber is guilty.

I think you are even less to blame if you lock your door and take the key inside. The robber is guilty.

I think you are even less to blame if you double lock your door and windows. The robber is guilty.



The more you do, the less you are to blame. The robber is guilty.

That does not mean you have to have "everything in humanities disposal" to protect your house unless live in the Fort Knox.

The value has to match the security.

And protecting your nude photos with an easy password or easy security questions is "LESS" than what's expected of you.

You made a mistake, and if you do not believe this, then phone these celebrities and ask them if they have chosen better passwords after August 31st. I bet anything that those same people won't be hacked the same way ever again because they paid a heavy price for their mistake and "LEARNED".

The victim blaming in this post couldn't be more explicit if you tried, and you *still* don't seem to understand that you're doing it. Wow.

Once again, the *CRIMINAL* is guilty of the crime.
The *CRIMINAL* is to blame for the criminal's actions.
The *CRIMINAL* is responsible for the criminal's actions.
The *VICTIM* in no way shares guilt, blame, *or* responsibility with the *CRIMINAL* for the actions the *CRIMINAL* took.

I am responsible for *MY* actions. You are responsible for *YOUR* actions. The CRIMINAL is responsible for the CRIMINAL's actions.

----------

By that logic, I guess women can stroll down any street at 3 am completely naked and obliterated drunk and expect nothing bad to happen to them and if it does, it's absolutely not their fault in any way. Good to know. Not in any way a practical way to think but not everyone lives in the real world apparently.

Oh, goody! Someone thinks that the victim is at fault in a sexual assault!

There's a difference between being a victim of crime where doing simple things could have avoided it and being a completely innocent victim where no easy fix could have prevented it. You need to work on your black and white style of thinking. there are all sorts of shades of grey in between you are missing.

It's pretty simple to have a steel-framed door installed. What was your point supposed to be?

Not just wide open. Since they are female celebrities it's like having a pile of money in front of the open door with a spotlight shining on it.

Q. How big of a pile does it have to be, and how bright does the light have to be before it's not the criminal's fault? At what point does it justify the criminal act?

A. *NEVER*

 

[tbrinkma]

It's definitely not easy or we'd be hearing more about this...

How much more do we have to hear about things like this before you actually pay attention? How long has it been since there has been a month where someone famous *hasn't* been hacked in some form or another? Or do you only pay attention when there's nudity involved?

 

[MasterChat]

How to better protect yourself?

There are really people who have demons among them. Their motive is what drives them to commit crimes. With the recent iCloud issue, it is better not to save images or videos that might put their names at risk, ending up in the internet like wildfire.

 

[Analog Kid]

I suggest you go back and read everything. The example was about robberies.

So people are only at fault if they're robbed when they don't do what's expected of them. If they're murdered you have different rules again?

And they aren't wrong.

Yes the insurance company is right to defend their contract. The thread I've been following is about who's to blame for the theft and distribution of personal photos. I didn't realize there was an insurance claim involved. Why are we talking about insurance companies?

If someone walks into your home, does not steal anything and walks out through a door you left open, that's trespassing. It's not breaking and entering. And the punishment is severely different.

If you want to know more about breaking and entering, please consult a lawyer for your jurisdiction. Many jurisdictions don't even have "breaking and entering" laws, simply burglary. Sometimes burglary can only be committed at night. It's a fascinating subject.

As far as this conversation goes, however, let's simply agree that if these women posted these pictures on the web from their server without forbidding you entry and you went to their server to view them, that in itself is not a crime.

Again, not sure why we're discussing that particular scenario though as it doesn't seem to apply here. Something was stolen. Security was circumvented to achieve that. Nothing in your example has a parallel.

If you say both parties are to blame, you are saying that the criminal is not fully to blame.

If they didn't do what's expected of them, it is their fault yes.

Doesn't sound opposite to me...

 

[laurim]

Ok, you tell me. At what point does 'basic numeracy' lay the blame for a criminals action on the victim?

How many people does it take getting mugged before it's *not* the criminal's fault any more? Before we start prosecuting the *victim*, because somehow it's *their* fault that the mugger chose to commit a crime?

Seriously?

----------



No, it's *not* "your fault" (not even "kinda") when someone commits a crime and you are the victim.

----------



The victim blaming in this post couldn't be more explicit if you tried, and you *still* don't seem to understand that you're doing it. Wow.

Once again, the *CRIMINAL* is guilty of the crime.
The *CRIMINAL* is to blame for the criminal's actions.
The *CRIMINAL* is responsible for the criminal's actions.
The *VICTIM* in no way shares guilt, blame, *or* responsibility with the *CRIMINAL* for the actions the *CRIMINAL* took.

I am responsible for *MY* actions. You are responsible for *YOUR* actions. The CRIMINAL is responsible for the CRIMINAL's actions.

----------



Oh, goody! Someone thinks that the victim is at fault in a sexual assault!



It's pretty simple to have a steel-framed door installed. What was your point supposed to be?



Q. How big of a pile does it have to be, and how bright does the light have to be before it's not the criminal's fault? At what point does it justify the criminal act?

A. *NEVER*

Congrats for twisting everything I said to suit your argument.

For one, the criminal is always wrong and deserves full punishment. I don't know why that concept keeps going over your head. Like I said in a previous post, there's no mathematical equation involved here so quit trying to force one on it. My agenda is to avoid being a victim in the first place. Your agenda is to avoid any culpability in your becoming a victim because you failed to adequately protect yourself. My agenda is to be as strong a person as I can be. Your agenda is to defend purposely remaining a weak and vulnerable person.

Why you think it's idiotic to suggest women not make themselves more vulnerable to assault when they don't need to, I don't know. Remember, I'm a woman myself and travel alone frequently, something many women are afraid to do. In 50 years, I've never been assaulted even though I go out alone at night in strange cities and talk to all sorts of people. Oh, men have tried to take advantage of me many times but I took control of my situation and avoided being a victim. Not saying I could never be assaulted but I make it less likely as much as I can without restricting myself to the point where I can't enjoy my life. In many situations, there's nothing a woman could have done to avoid being victimized and that is an awful situation in any case. However, I see women all the time getting too drunk to defend themselves, hopping into random men's cars. Is it really that awful that I would suggest they not do that? Doesn't excuse what happens in any bit but how about we avoid the bad event in the first place, huh? I'm not asking women to stay home or wear a burka. Just not be so naive and careless.

You and people like you are so busy "defending" victims you are totally missing the opportunity to change basic behaviors to avoid being a victim in the first place. Call me crazy but I would rather avoid being a victim than be a victim. You don't want to be accountable for anything you do to make yourself vulnerable. Don't be surprised when other people aren't as sympathetic as you want them to be when it's obvious you could have easily avoided the situation in the first place without any big effort on your part.

 

[Carlanga]

I just did. Apparently you should too.

GL understanding the next contract you sign then.

 

[bawbac]

There aren't any shades of grey in your world, are there?

I'm a woman and I'm not afraid to say that women shouldn't get drunk or high to the point of incoherence in a wild party full of men. Not that she deserves to be raped but she contributed just a bit to the situation she found herself in. The man who takes advantage of the situation should be punished, no doubt. But the woman should have taken better care of herself to avoid the situation in the first place. And it does her ZERO good to say she can continue to live recklessly and simply hope she never ends up around that type of man again. I live my life controlling as many things as I can to avoid injury, only taking risks I've determined are worth it. I don't live my life completely under the control of the assumed good graces of everyone around me. Anyone who does that is in for a world of hurt. Reality. Deal with it.

Yeah, Jody Fosters character in the Accused was asking for it.

 

[firewood]

Ok, you tell me. At what point does 'basic numeracy' lay the blame for a criminals action on the victim?

How many people does it take getting mugged before it's *not* the criminal's fault any more?

It's always the criminals fault, legally. But fault, other than legal, doesn't always have to be singular.

If there is on-going unsolved crime wave, and you can do stuff that strongly statistically reduces it, then not laying blame on yourself is a way out of responsibility for what you could have done (if you can't catch and stop the real criminals) to reduce this continued harm. Basic numeracy can help inform you of how much is going on and how much you might be able to stop with how much effort on your part. So yes, blame the victims if they encourage more ongoing unsolved crime, and thus even more victims, without taking reasonable, perhaps easy steps within their control to do their part to reduce criminal activity.

Everybody needs to do their part. Blame the lazy ones as well.

 

[laurim]

Yeah, Jody Fosters character in the Accused was asking for it.

Good grief. I can't explain it any more to people who are so stuck on the whole "asking for it/deserved it" distortion. You will never understand what I am saying so I give up trying to explain it to you. I get it. Women are totally weak and helpless and will always get victimized no matter what they do and there's no way to avoid it so why even try. Maybe I should just kill myself now before it inevitably happens to me.

----------

It's always the criminals fault, legally. But fault, other than legal, doesn't always have to be singular.

If there is on-going unsolved crime wave, and you can do stuff that strongly statistically reduces it, then not laying blame on yourself is a way out of responsibility for what you could have done (if you can't catch and stop the real criminals) to reduce this continued harm. Basic numeracy can help inform you of how much is going on and how much you might be able to stop with how much effort on your part. So yes, blame the victims if they encourage more ongoing unsolved crime, and thus even more victims, without taking reasonable, perhaps easy steps within their control to do their part to reduce criminal activity.

Everybody needs to do their part. Blame the lazy ones as well.

Save your breath. These people will never understand you. They don't want to be responsible for themselves. They want everyone around them to take care of them. There's a reason some people always have "bad luck" in their life. It's not bad luck. It's bad mindset.

 

[trifid]

It's a shame that iCloud is getting all the blame.

The Find my iPhone exploit was exclusive to iCloud. This exploit had been available for 1+ year, during which hackers could attempt an infinite number of times guessing a password. It's not a shame, Apple deserves this not only for this exploit but also for their half-baked job at the 2-way verification system that applies to iCloud login but leaves iCloud backup vulnerable, where all the extractable user data is at.

 

[C DM]

The Find my iPhone exploit was exclusive to iCloud. This exploit had been available for 1+ year, during which hackers could attempt an infinite number of times guessing a password. It's not a shame, Apple deserves this not only for this exploit but also for their half-baked job at the 2-way verification system that applies to iCloud login but leaves iCloud backup vulnerable, where all the extractable user data is at.

In this case it doesn't seem like that exploit was used. That doesn't mean it's not Apple's fault for having that exploit or not patching it sooner but it seems like the underlying issue was simpler than that in this case. As for 2-factor authorization, that should be extended to more parts of the ecosystem. That said, the main issue in this case was that really poor passwords were used, easy ways of resetting them through easily answerable secret questions, and/or social engineering and other similar methods to obtain passwords. Again other means can help block someone from abusing things, but once they have the password there is a huge issue right there on its own.

Bottom line is that even if that exploit wasn't even there at any point and even if 2 factor authorization applied to everything when enabled, it seems that what happened in this situation would have still happened pretty much as it did.

 

[Rogifan]

Interesting piece by Ben Thompson where he wonders if Apple needs to think about partnering with someone like Microsoft on cloud services. Doubt that will ever happen. Just makes incorporating Touch ID into all their products all that more important.

http://stratechery.com/2014/icloud-apples-founding-myth/

 

[bawbac]

Good grief. I can't explain it any more to people who are so stuck on the whole "asking for it/deserved it" distortion. You will never understand what I am saying so I give up trying to explain it to you. I get it. Women are totally weak and helpless and will always get victimized no matter what they do and there's no way to avoid it so why even try. Maybe I should just kill myself now before it inevitably happens to me.

----------



Save your breath. These people will never understand you. They don't want to be responsible for themselves. They want everyone around them to take care of them. There's a reason some people always have "bad luck" in their life. It's not bad luck. It's bad mindset.

No one is being or asking to be a victim here.
Only your hyperbole statements are making these claims so you have a foundation for your position.

Sorry but you sound like a sour Tea Party supporter looking to take a stab at the "other" team who takes "hand outs" and take no responsibility for anything..... EVER !
Right?


I bet anyone who gets shot by an intruder at home is well, asking for it if they didn't have a weapon ready when the intruder knocked the door down while they were napping in the living room.

 

[samcraig]

No one is being or asking to be a victim here.
Only your hyperbole statements are making these claims so you have a foundation for your position.

Sorry but you sound like a sour Tea Party supporter looking to take a stab at the "other" team who takes "hand outs" and take no responsibility for anything..... EVER !
Right?


I bet anyone who gets shot by an intruder at home is well, asking for it if they didn't have a weapon ready when the intruder knocked the door down while they were napping in the living room.

You will never "win" this discussion.

 

[laurim]

No one is being or asking to be a victim here.
Only your hyperbole statements are making these claims so you have a foundation for your position.

Sorry but you sound like a sour Tea Party supporter looking to take a stab at the "other" team who takes "hand outs" and take no responsibility for anything..... EVER !
Right?


I bet anyone who gets shot by an intruder at home is well, asking for it if they didn't have a weapon ready when the intruder knocked the door down while they were napping in the living room.

Actually, I am a progressive democrat but thanks for generalizing, lol. And while I'm pro more gun regulation and limited magazine size, I do believe people have the right to defend themselves from intruders in their own home. AND gun owners are obligated to keep their guns secure from children or others getting hold of them. You see, I actually make decisions for myself, not based on what other people tell me to believe to belong to a certain political ideology. And I've lived long enough and done enough in my life to know how the world works and what my responsibilities are to protect myself from harm and accept responsibility for my contribution to any bad situations I find myself in. Hopefully someday you'll get there, too, so bad things don't just "happen" to you all the time and you don't know why.

P.S. Again with the whole "asking for it" meme. Talk about a one track mind that has nothing to do with the actual discussion...That's why you'll never "win" the discussion. You aren't having the same discussion I and the others who think the same way are having. Your beef is with the two or three people who said the women deserved to be hacked, not with us.

 

[C DM]

No one is being or asking to be a victim here.
Only your hyperbole statements are making these claims so you have a foundation for your position.

Sorry but you sound like a sour Tea Party supporter looking to take a stab at the "other" team who takes "hand outs" and take no responsibility for anything..... EVER !
Right?


I bet anyone who gets shot by an intruder at home is well, asking for it if they didn't have a weapon ready when the intruder knocked the door down while they were napping in the living room.

No hyperbole there at all.

 

[RenoG]

Wow just wow, reading this one single page of all the back and forth has me extremely fatiuged mentally, how on earth do you guys do it? To go all in like you do you MUST have something of great value to gain (college course credits etc), is it really this serious???

 

[laurim]

Wow just wow, reading this one single page of all the back and forth has me extremely fatiuged mentally, how on earth do you guys do it? To go all in like you do you MUST have something of great value to gain (college course credits etc), is it really this serious???

It's the classic war of logic vs emotion. I find it both frustrating and fascinating at the same time.