Researcher Takes Credit for Security Breach of Apple's Developer Center

[MacRumors]

The Next Web points to a comment on a TechCrunch article taking credit for last week's unauthorized access of Apple's Developer Center last week. The comment comes from independent security researcher Ibrahim Balic, who claims that his effort was not intended to be malicious and that he reported his findings to Apple just hours before the developer site was taken down by the company.

In total I have found 13 bugs and have reported through http://bugreport.apple.com. The bugs are all reported one by one and Apple was informed. I gave details to Apple as much as I can and I've also added screenshots.

One of those bugs have provided me access to users details etc. I immediately reported this to Apple. I have taken 73 users details (all apple inc workers only) and prove them as an example.

Balic claims to have accessed details on over 100,000 users, but only released to Apple details on 73 of its own employees in order to prove the seriousness of the issue.

I have emailed and asked if I am putting them in any difficulty so that I can give a break to my research. I have not gotten any respond to this... I have been waiting since then for them to contact me, and today I'm reading news saying that they have been attacked and hacked. In some of the media news I watch/read that whether legal authorities were involved in its investigation of the hack. I'm not feeling very happy with what I read and a bit irritated, as I did not done this research to harm or damage. I didn't attempt to publish or have not shared this situation with anybody else.

Balic's tactics and motives have, however, been questioned by some, with scattered reports suggesting an unusually high level of password reset requests on Apple developers' accounts over the past few days.

Apple's Developer Center remains down today, some four days after the company took it down in order to investigate the breach, update its software, and rebuild its developer database.

Article Link: Researcher Takes Credit for Security Breach of Apple's Developer Center

 

[ka-spot]

And what he is researching for? The new Haswell retinas?

 

[Michaelgtrusa]

This needed to happen.

 

[ctdonath]

He will now spend the next 15 years in court.

 

[recklesslife85]

Couldnt he have done this after Beta 4 release - DAMN HIM!

 

[dennno]

Sounds fishy. But the unusually high number of password resets could come from users who have obviously heard about this breach.

 

[crackbookpro]

Very interesting...

 

[Rudy69]

If he's being honest and will actually delete all the data he downloaded, it's much much better for us than someone who would have leaked the data. Unfortunately there will never be any guarantee that he deleted the data

 

[iapplelove]

lol so no beta 4?

 

[HenryDJP]

This needed to happen.

And why exactly did it "need" to happen?

 

[Konrad9]

And why exactly did it "need" to happen?

Because Apple is clearly not keeping it's security systems up to par, and it's better for someone to do this and make it public, than for someone to do this and steal and sell as much information as he could.

 

[millarj]

"Security researcher" Yeah, that's it. Is the guy "testing" my front door with a crowbar also a security researcher?

It is nice that he gave apple a couple of hours to respond. Classy of 'im.

 

[SILen(e]

Sounds fishy. But the unusually high number of password resets could come from users who have obviously heard about this breach.

Correct.
With rumors of a security breach, some tried to use this situation to grab passwords of nervous developers.

 

[Bhatu]

I think Samsung gonna hire him!

 

[gnasher729]

He should be prepared to get sued by any single app developer.

----------

If he's being honest and will actually delete all the data he downloaded, it's much much better for us than someone who would have leaked the data. Unfortunately there will never be any guarantee that he deleted the data

When he gets sued, I'd take that as destruction of evidence.

 

[mumph]

They haven't responded because their lawyers will have told them not to. Now they will sue him for costing Apple and possibly the developers money (ironically by showing them how they could lose money from being hacked).

It's good that he is helping to highlight flaws but is there not a less havoc wreaking way of doing so?

 

[Reason077]

The most amazing revelation with this story that is suggests someone at Apple actually reads bug reports submitted through bugreport.apple.com!

This seems completely contrary to my own experience - perhaps it's actually worth reporting bugs to Apple after all.

 

[ValSalva]

I think Samsung gonna hire him!

Maybe they already have

 

[NanoTubeReturns]

Balic Smash!!

 

[dennno]

And why exactly did it "need" to happen?

Well if it didn't happen Apple wouldn't have taken measures to improve security. Pretty straightforward.

 

[napabar]

Well if it didn't happen Apple wouldn't have taken measures to improve security. Pretty straightforward.

OK. No problem then. I'll be over tonight to break into your house. I'm not a thief. I just want to make sure your dwelling is secure.

 

[tbrand7]

Here's to the crazy ones. This guy is indeed crazy...

 

[scbn]

100,000 users? I thought all information was encrypted.

 

[bacaramac]

Some of the people are just to dumb for their own self. They do one thing good, act dumb.

I mean seriously, if you want to hack something, talk to the company and get their approval to "test" their systems on a site that is not the actual public site or something like that. If they (Apple) refuses to acknowledge, then take it to the news and make it public, that way Apple has to do something. Don't just hack and say sorry. Just wow.

 

[iglobe]

Well if it didn't happen Apple wouldn't have taken measures t improve security. Pretty straightforward.

+1-2=?
Is there any need to expose real info for Security researchers on utube