Scammer Infiltrated Thousands of iCloud Accounts to Find Nude Photos

[urnotl33t]

Having retired from a network-security-related job I have to disagree. Ok, stupidity and/or ignorance. Sometimes willful ignorance.

I did a thing unusual in the I.T. field. Something the vast majority of SysAdmins will insist does not work: I relied greatly on end-user education and cooperation for my employer's defense. To a degree such that it took higher precedence than anti-virus and anti-malware. By any measure it was a successful strategy. In the twenty-five years I was on the job, there was only one significant incident, it was due to a new type of zero-day vulnerability, and the primary vector had actually done everything right.

yep. #CanConfirm

User education is incredibly effective.

 

[rsgon]

Did something happen? Is porn not still available online for free? ?

 

[Damian83]

At least 620,000 photos/videos of people having sex have been uploaded to iCloud? Come on people!

yeah, everybody knows you are supposed to put those on google Drive. come on

well most users have icloud enabled by default without even knowing what is cloud....such people dont even know and dont even care how that photos can magically be again on a new iphone they just bought, after logging with their apple id...

 

[TheDailyApple]

People who take obscene pics of themselves get what they deserve.

After all, what doesn’t exist can’t be stolen!

 

[Bandaman]

No amount of protection can fix ignorance.

 

[daved2424]

So just to be clear, a legal act, that your narrow mind disagrees with, should be punished with an illegal one? Now that’s quite the oxymoronical high ground to take my good friend.

 

[BigBlur]

At least 620,000 photos/videos of people having sex have been uploaded to iCloud? Come on people!

620,000 photos from 306 people. Over 2000 nude photos per person?

Admittedly, I have at least that number of lascivious cat photos on my camera roll…

No... He collected at least 620,000 photos, and within those he was trying to find the nudes. The entire collection wasn't nudes.

 

[Psychicbob]

In the not too distant future the fact that we would autheticate via username+password will look like the stone age.

Yep. Your phone will need to authenticate you against your nude photo

 

[szw-mapple fan]

Having retired from a network-security-related job I have to disagree. Ok, stupidity and/or ignorance. Sometimes willful ignorance.

I did a thing unusual in the I.T. field. Something the vast majority of SysAdmins will insist does not work: I relied greatly on end-user education and cooperation for my employer's defense. To a degree such that it took higher precedence than anti-virus and anti-malware. By any measure it was a successful strategy. In the twenty-five years I was on the job, there was only one significant incident, it was due to a new type of zero-day vulnerability, and the primary vector had actually done everything right.

I’m glad that worked out for you, but realistically it’s only doable in enterprise. I’m talking more about your average user as most iCloud accounts are probably personal accounts. How would you go about educating them systematically? Phishing attacks exists to exploit the knowledge gap of the average user and tech literate users. If all users are educated enough then phishing methods will evolve with it. At the consumer level it’s safer to design a product that has room for user ignorance and stupidity.

 

[Skewlovevism]

At least 620,000 photos/videos of people having sex have been uploaded to iCloud? Come on people!

I know what you mean. Not enough
just joking

 

[redscull]

Apple recommends two-factor authentication

No.. Apple harasses you incessantly and constantly logs you out of iCloud on your devices until you're so mentally fatigued that you give up and enable two-factor auth.

 

[AreaB]

Seems like he probably should’ve learned a lesson the first time back in 2007:

https://www.reuters.com/article/us-bestbuy-lawsuit-idUSN1234841420070412

(I’m guessing this is the same guy based on location and age…)

 

[szw-mapple fan]

The same is also available from banks, everything looks "totally real". But who reacts to such nonsense. Just stupid people. And some are so stupid that they even don't activate 2FA, as you could read in the article.
People are the problem.

Technology, especially consumer technology, should be designed for people. If people are the problem then the technology was designed poorly. More often than not it’s low tech literacy, not outright stupidity. Most users probably didn’t bother with 2FA until they set up a new device or update the OS. It’s not realistic to expect everyone to be on the same page.

 

[visualseed]

He ran this scam out of his own home ?

First rule of life: Never **** where you eat

 

[jarman92]

...the FBI found more than 500,000 emails with approximately 4,700 iCloud user IDs and passwords that he had been sent from his victims.

I know it's gauche to say it, but damn people are stupid.

 

[Dreamweaver12]

No.. Apple harasses you incessantly and constantly logs you out of iCloud on your devices until you're so mentally fatigued that you give up and enable two-factor auth.

Yeah, for exactly this reason, doofus.

 

[AlexanderUK]

yep. #CanConfirm

User education is incredibly effective.

You've never met my parents, they're 72 and have trouble working a mobile phone, let alone understand the concept of security on a computer. The last time I tried explaining what the password was (and why she shouldn't just tell other people about it) I ended up having to use one of my younger sisters teddy bears as part of the demonstration to show how an attack works... Then my mum said she understood, wrote the password down with a big chunky permanent marker down on the inside of her phone case and wondered off thinking she was ready to beat the world.

After an hour of exhaustive explanation I have only confirmed you should never work with children, animals... or family.

 

[AstroRob]

Did something happen? Is porn not still available online for free? ?

This isn't about porn. This is about predatory behavior that sounds like in some cases may have led to assault.

It's about hundreds of awful men on forums getting/hiring a truly reprehensible man like this to intentionally and selectively target individuals who have done nothing wrong (beyond being the target of unwanted sexual harassment) and through lies and intimidation steal their most private personal datasets.

This is not in any way, shape, or form, funny.

I can only hope the individuals who solicited this data and provided the targets get to spend some time in jail as well.

And in our integrated lifestyles it's not that hard to overlook the fact that for probably most smartphone users the simple act of snapping a photo results in it being transferred to a cloud service. Apple/Google/Dropbox/etc/etc go out of their way to make this all so seamless and transparent it isn't hard to overlook possible consequences.

 

[tridley68]

What kind of idiot's save nude pictures on i cloud apparently quite a few everyone knows you save them on a flash drive ????

 

[Wildkraut]

Sure, nevertheless nothing works against the stupidity of those iCloud customers

Yep, the same i say to people who are against sideloading and fears downloading apps from the web. ?

 

[robjulo]

People who take obscene pics of themselves get what they deserve.

"Obscene"? Nudity is "obscene"? Get over yourself.

 

[_Spinn_]

The NSA has been doing the same for years, according to snowden. Why does this guy go to jail and not them?

I'm not sure what your point is - because I'm not ok with the NSA doing this either.

 

[macfacts]

Looks like apple out sourced the CSAM scanning.

 

[Wildkraut]

People who take obscene pics of themselves get what they deserve.

Hmmm looks like someone from the Amish People found a lost iPhone.

 

[Wildkraut]

Yep. Your phone will need to authenticate you against your nude photo

Does the iPhone ML recognize variable noses?