Hackers Using Law Enforcement Tools to Access iCloud Backups Unprotected by Two-Factor Authentication

[iBug2]

I'd really love to implement the 2-factor but I leave in a french territory with a different phone code (+687) than the main french one (+33) so when want to register my mobile phone the number is wrong... I'm busted.
So for all of us left out from the system defalt 2-factor verification is impossible

No, just call Apple and ask them. There surely must be a way to do it.

 

[byke]

So at what point does law enforcement justify the use of hacking?
Committing a crime to detect a crime?

 

[tinous98]

No, just call Apple and ask them. There surely must be a way to do it.

Unfortunately we don't have any apple store around and when I visited one in Australia they could not help me. Apple servers automatically put the code +33 on front of our phone numbers in their 2-factor form when they should give us the possibility to enter a different international code. But we are such a small number of people that this would be a miracle if it was implemented...

 

[iBug2]

Unfortunately we don't have any apple store around and when I visited one in Australia they could not help me. Apple servers automatically put the code +33 on front of our phone numbers in their 2-factor form when they should give us the possibility to enter a different international code. But we are such a small number of people that this would be a miracle if it was implemented...

Just call them and ask.

 

[SchneiderMan]

iCloud does not feature two-factor authentication.

 

[Velin]

Pretty sure you don't have to use iCloud (even for contacts) if you don't wan to.

Search the forums. There was a period where, if you had Address Book contacts on your desktop, there was no way to get the address book contacts onto your iPhone, except via iCloud. No other way.

In fact, I think I even had a post on these forums about it.

Only recently was it reverted back to where you can once again do a local iTunes sync. This was a huge problem, many people complaining.

Here is the post, one of several complaining about it at the time: https://forums.macrumors.com/threads/1659397/

 

[Phil A.]

IMO, Apple's 2 factor verification isn't really 2 factor authentication and shouldn't be called that - it's only used in limited situations whereas true 2 factor authentication would be used every time you access the account for any reason from an untrusted device

Even Microsoft do it properly for outlook.com accounts (including single use app passwords for things like IMAP access that don't support the 2 factor auth with a separate verification code) - Apple really need to step up and get it implemented properly!

 

[ghettochris]

And to those who want to make it the victims fault that these photos were stolen: You are messed up in the head.

Easiest way to prevent naked photos of yourself to be stolen, is to not have naked pics of you taken. They all consented to the photos or took them themselves, it's not like this was a peeping tom. In this digital age, famous young girls especially should keep this in mind.

It's fine to expect privacy, but to take pics that you would be mortified and want to die if they were released to the net, then store them in the cloud is just not smart and they are at fault somewhat too. think "what if this leaks" before every pic you have taken. I'm sure most boob shots would be like "who cares" and carry on.

----------

Search the forums. There was a period where, if you had Address Book contacts on your desktop, there was no way to get the address book contacts onto your iPhone, except via iCloud. No other way.

In fact, I think I even had a post on these forums about it.

Only recently was it reverted back to where you can once again do a local iTunes sync. This was a huge problem, many people complaining.

Here is the post, one of several complaining about it at the time: https://forums.macrumors.com/threads/1659397/

strange, I have always synced contacts manually in itunes, never noticed a time that didn't work. I also have gone long periods between phone syncs/updates though.

 

[Rogifan]

This is on the Drudge Report right now. Links to a Daily Mail article that is 2 days old.

Go to the Daily Mail website and they have an entire section devoted to what they call the "Apple hacking scandal". Quite irresponsible to call it an Apple hacking scandal considering the fact that there is no conclusive evidence that iCloud was hacked (and Apple says it wasn't) or that FMI brute force was the source.

“In reviewing months worth of forum posts, image board posts, private emails, replies for requests for services, etc. nowhere was the FindMyPhone API brute force technique (revealed publicly and exploited in iBrute) mentioned,” Cubrilovic reports. “This doesn’t mean that it wasn’t used privately by the hackers – but judging by the skill levels involved, the mentions and tutorials around other techniques and some of the bragged about success rates with social engineering, recovery, resets, rats and phishing – it appears that such techniques were not necessary or never discovered.”
https://www.nikcub.com/posts/notes-on-the-celebrity-data-theft/

Color me highly skeptical that it's just a coincidence this leaks now right before Apple has a big event scheduled.

 

[justperry]

I think you need to change the headline for this article, so you are not claiming that someones opinion is fact.

Hackers Using Law Enforcement Tools to Access iCloud Backups Unprotected by Two-Factor Authentication

Should be changed to:

Hackers May Be Using Law Enforcement Tools to Access iCloud Backups Unprotected by Two-Factor Authentication

It's just one word, what is the bigg diff?

€100.000 or €1.000.000, from one (zero more) I can live the rest of my life on Bali without a job, the other not so much.

 

[S.B.G]

It's just one word, what is the bigg diff?

Words make a big difference and even one word changed can change the context and meaning of a sentence or a whole article.

In this case, the word 'using' in the title implies that the law enforcement tools are being used against iCloud. Change 'using' to 'may be using' removes the implication altogether and leaves the door open to other possibilities of different tools being used against iCloud or none at all.

The first interpretation makes a statement from authority while the second does not.

Words mean things.

 

[maflynn]

using ElcomSoft's software to download an iPhone's backup successfully circumvents two-factor verification as the two-factor authentication system does not cover iCloud backups or Photo Stream.

I don't use either one, but I'm still shocked to find out that two-factor verification is not used through the iCloud service.

 

[xbjllb]

How incredibly stupid does someone have to be...

...to put nude photos and/or porn of any kind on the cloud?

How incredibly stupid. Like putting it up on the web and hoping no one will see it.

 

[casperes1996]

Are you also depressed over the world?

It's just ****ing sad that this kind of abusive is happening.
That celebrities are harassed like this.

Calling these celebrities stupid, etc. for having these pictures and videos on iCloud is just victim blaming. Yeah, I wouldn't keep that **** on the cloud, but that doesn't mean it's not their right to keep their private files on their private cloud.

It makes me sick to think of the people who attained and published the pictures and videos. To violate another human being's privacy like that.

 

[Rogifan]

Great piece from Matthew Panzarino on Tech Crunch:

http://techcrunch.com/2014/09/02/why-apple-should-be-more-transparent-about-security/

While I think this leak was a concerted effort to tarnish Apple's reputation right before a big event I still think Apple needs to get better at cloud services and security. If WWDC told us anything it's that Apple is making a big bet on iCloud. This stuff needs to "just work" and not have people concerned that their data isn't secure. Perhaps Cook needs to split up Eddy Cue's duties and bring someone on to the executive team who's really experienced in cloud services to oversee iCloud and all Apple's back end stuff.

 

[arbitter]

The security questions are really ********* though. If you fill them in correctly they are so generic anyone can fill them in for you, and if you are clever and don't fill it in correctly you won't remember next year what you filled in.

 

[Smartass]

...to put nude photos and/or porn of any kind on the cloud?

How incredibly stupid. Like putting it up on the web and hoping no one will see it.

One would think that the worlds most valuable brand, like Apple, would implement a system that would be really hard to crack and wont let some third person to just "walk pass by the security guard". Guess that isnt the case.

 

[gotluck]

...to put nude photos and/or porn of any kind on the cloud?

How incredibly stupid. Like putting it up on the web and hoping no one will see it.

Hope you don't use iCloud backups.

If you do, I hope you consider everything on your phone public domain

Essentially you are saying it is incredibly stupid to use iCloud backups

Somehow I feel like apples intention isn't for iCloud backups to be public domain, otherwise i need to be changing my settings..and telling everyone I know too..

 

[jpn]

yikes

Apple also probably forgot about encrypting authentication tokens on the user's computer.

The Forensic Edition of EPPB allows downloading of iCloud data without the password of the Apple ID, because the Forensic Edition will obtain the authentication tokens used by the computer for iCloud syncing.

Apple should encrypt the authentication tokens itself with AES-256.

yikes

thanks for this info.

pls, apple, get better on all of this. real soon. pls.

 

[cyberlocke]

This is why it was a terrible idea to force IOS users to use iCloud for contacts info. I never wanted anything in iCloud, including contacts. Let us sync contacts locally, in iTunes.

Screw iCloud.

iCloud does make it convenient, but I agree, you're opening yourself up by using anyone else's server. Local, local, local. I mean, does the "inconvenience" of using iTunes really outweigh the potential downsides of letting your lack-of-self-control nudie photos (or any other personal data) into the wild?

 

[Padmini]

Law Enforcement should never, ever have been provided with tools to do this.

You can fantasize about their needs for it, but it is just that...a fantasy. A fantasy that comes from watching too many crime shows on TV, where every week there is a new dastardly criminal that needs to be brought down by any means possible.

It's just not real. All this software does, in the wrong hands, is allow for misuse, and leaks, and torrents, and basically....this.

None of what I just said has anything to do with what happened here, or whether it not it would have happened. But it was a good opportunity to voice my concern that law enforcement has been given keys to things that they never should have. Ever.

 

[VenusianSky]

Indeed.

I use fake answers and not always in English. Like "what is your hometown" might be Atlantis. "What was the model of your first car?" Hot air balloon. Written in Klingon. And so on.

I loved when system let me create my own questions. For my question I might put something like "stroking a cat" and the answer is biscuits. The logical progression between the two is something I will remember but not even my friends are likely to figure out and a random stranger wouldn't.

This is good. For passwords, I make up fake words or passphrases that make absolutely no sense. Maybe throw in a special character or two for good measure.

 

[Padmini]

This is on the Drudge Report right now. Links to a Daily Mail article that is 2 days old.

Image

Go to the Daily Mail website and they have an entire section devoted to what they call the "Apple hacking scandal". Quite irresponsible to call it an Apple hacking scandal considering the fact that there is no conclusive evidence that iCloud was hacked (and Apple says it wasn't) or that FMI brute force was the source.



Color me highly skeptical that it's just a coincidence this leaks now right before Apple has a big event scheduled.

Without any doubt, Samsung paid to have this happen.

 

[762999]

I suspect by year end, Photos in iCloud, iCloud Backups, everything, will all be encrypted.

it should have been encrypted day one. This was predictable. The device and backup should always been encrypted.

 

[lewisd25]

Another option that is easy to remember is for the hometown question, spell it backwards. You always know your hometown and so may someone else but will they think of spelling it backwards?

They will now.