Scammer Infiltrated Thousands of iCloud Accounts to Find Nude Photos

[bluespark]

uploading nudies to iCloud has got to be the most moronic computer activity a person can do

Why? People take these on their phones (typically intending them for private use only, but possibly across multiple personal devices) and the upload is automatic in most cases. iCloud is also extremely secure, as evidenced by the fact that highly-motivated criminals resort to phishing and social engineering to gain access.

 

[NBAasDOGG]

Nice, now the hackers can see my enormous big papa 😂

 

[MacBH928]

620000 pics / 320 users = 1900+ photos of nudes of each user stored online, people are nuts 🤣

I wonder if these users realise that those photos and videos are accessible by Apple employees and will be given to any goverment entity by any law order and then goverment employees will enjoy looking at them and maybe leak them too 🤣🤣

Also, Apple is making a free services of scanning all those pics in the near future!

 

[MacBH928]

Why? People take these on their phones (typically intending them for private use only, but possibly across multiple personal devices) and the upload is automatic in most cases. iCloud is also extremely secure, as evidenced by the fact that highly-motivated criminals resort to phishing and social engineering to gain access.

you do know that Apple employees can open those files and will hand them over to any goverment entity when they request them, right? You also know that if someone can break into it by however means including just guessing the password those images will also leak.

imo, there is zero reasons to take nude pictures of yourself and store them on a far away hard drive (the cloud).

 

[Analog Kid]

People who take obscene pics of themselves get what they deserve.

First rule of a free society: if what you do only affects yourself, you should be free to do it.

All of the people blaming the victims for either the types of pictures they keep or their susceptibility to a scam are missing the point. No one should be shamed for whatever personal photos they have and, while there are practical steps we should probably take to protect ourselves from the criminally minded, it's not a crime to not follow those steps and it is still a crime to violate people who don't.

If I leave a gold bar on my front porch and someone takes it without my permission, that is theft. It is not my fault, it is the thief's.

 

[Michael Scrip]

620000 pics / 320 users = 1900+ photos of nudes of each user stored online, people are nuts 🤣

Wait... I thought he took 620,000 pictures total...

I don't see where it says all those pictures were nudes...

 

[Wildkraut]

Now imagine a news line with “Scammer Infiltrated Thousands of iCloud Accounts with Child Porn”

Yeah yeah CSAM is safe. 🤣 Swatted!
Have fun explaining yourself to the FBI.

You: I got hacked😨😭…
FBI: Yeah sure… ⛓👊🔧💥😵🪦
Judge: Why did you beat him to death?
FBI: He attacked us…
Judge: Okay, no problem, thanks for making America great again!

 

[felixculpa]

And it took me less than a minute to find out exactly where he lives...

 

[1applerules1]

 

[BGPL]

Phishing emails are still #1 in cyber exploitation. 20+ years and counting.

 

[Rafagon]

A criminal from Los Angeles has pled guilty to felony charges after breaking into thousands of iCloud accounts to hunt down nude photos of women, reports The Los Angeles Times.

Hao Kuo Chi collected more than 620,000 private photos and videos by impersonating Apple customer support staff and sending out emails to trick his victims into providing Apple IDs and passwords.

Hao Kuo Chi? Isn't this the same Apple analyst that MacRumors is always quoting?

 

[Pezimak]

In a world where you can literally Google breast or knickers and have a world of porn you can’t even imagine, and people do this? Wow.

 

[mikethemartian]

In the not too distant future the fact that we would autheticate via username+password will look like the stone age.

In the future a password/key will still be used but it will be transmitted using the BB84 quantum key encryption protocol.

 

[Reed_College_Dropout]

Buah ha ha, pretty soon this will be...Apple. #iOS15

 

[Reed_College_Dropout]

First rule of a free society: if what you do only affects yourself, you should be free to do it.

All of the people blaming the victims for either the types of pictures they keep or their susceptibility to a scam are missing the point. No one should be shamed for whatever personal photos they have and, while there are practical steps we should probably take to protect ourselves from the criminally minded, it's not a crime to not follow those steps and it is still a crime to violate people who don't.

If I leave a gold bar on my front porch and someone takes it without my permission, that is theft. It is not my fault, it is the thief's.

If you leave a gold bar on your front porch and it ends up missing, that is absolutely your fault.

 

[blacktape242]

thoughts and prayers.......

 

[Analog Kid]

If you leave a gold bar on your porch and it ends up missing, that is absolutely your fault.

That's a bully's mentality. "I took it because you couldn't keep it".

There's always a bigger bully...

 

[Mrbti]

FBI don’t care about crime unless you impact a rich/powerful person. Moral of the story. Don’t hack rich people and the FBI don’t care.

 

[MacCheetah3]

I’m glad that worked out for you, but realistically it’s only doable in enterprise. I’m talking more about your average user as most iCloud accounts are probably personal accounts. How would you go about educating them systematically? Phishing attacks exists to exploit the knowledge gap of the average user and tech literate users. If all users are educated enough then phishing methods will evolve with it. At the consumer level it’s safer to design a product that has room for user ignorance and stupidity.

Technology, especially consumer technology, should be designed for people. If people are the problem then the technology was designed poorly. More often than not it’s low tech literacy, not outright stupidity. Most users probably didn’t bother with 2FA until they set up a new device or update the OS. It’s not realistic to expect everyone to be on the same page.

True. In any competent software development training, you are taught that users will do any and everything. For input, that includes assuming they might enter nothing or any combination of characters to text boxes; and in general, a user can click/tap and drag any or every UI element, press any combination of key combos, and more.

The three common reasons are:

• Lack of understanding what’s needed by the user — this may require more instructions as part of the UX
• Boredom or frustration — users will do actions and inputs the developer could never imagined
• Exploitation — for example, HTML injection attacks

Anticipating and compensating for these is one of the biggest design challenges, although, extremely important. It’s not the only safeguard, however, a great first line of defense can make the inner protections seem stronger.

In fact, a good test plan will involve at least one group of people who are significantly tech illiterate or cavalier in their device usage behaviors.

First rule of a free society: if what you do only affects yourself, you should be free to do it.

All of the people blaming the victims for either the types of pictures they keep or their susceptibility to a scam are missing the point. No one should be shamed for whatever personal photos they have and, while there are practical steps we should probably take to protect ourselves from the criminally minded, it's not a crime to not follow those steps and it is still a crime to violate people who don't.

If I leave a gold bar on my front porch and someone takes it without my permission, that is theft. It is not my fault, it is the thief's.

You’re correct, though naivety is excusable to an limit. Using your gold bar anecdote…. Yes, you're wrong to leave it there and wrong for someone to take it. However, you shouldn’t be surprised if the gold is missing in the morning and it is never found. Back to the nude photos topic… Indeed, you’re allowed to have nude snapshots/recordings of yourself — I can’t think of a reason that’s not 🤦‍♂️ but I digress. The problem is those nude media files are probably not for your own nostalgia; at the very least, they’ll be shared privately (or so a person thinks). Whether a cloud server or a seemingly trusted friend, the moment a copy of something leaves your control, it has the potential to go any and everywhere.

Does the iPhone ML recognize variable noses?

Human horn? (Futurama reference)

 

[TheMacDaddy1]

"with approximately 4,700 ‌iCloud‌ user IDs and passwords that he had been sent from his victims."

I almost bought a t-shirt the other day that said..."Stupid Should Hurt".

For the LAST 20+ years people have been told not give account info or money to anyone asking via email. This is not a new thing.

 

[Rychiar]

my god people are stupid. were these nude photos of grandma?

 

[lip008]

"unnamed public figure" ... I wonder how many peons complained until action was taken.

 

[Moonlight]

Has he not heard of *******? or onlyfans?

 

[Reed_College_Dropout]

That's a bully's mentality. "I took it because you couldn't keep it".

There's always a bigger bully...

No, "I lost it because I was a complete Muppet and left it unattended on my porch" is victim mentality. Unfortunately the world is rife with this pathetic mentality anymore. Besides, "I took it because you couldn't keep it" doesn't make sense.

 

[Analog Kid]

You’re correct, though naivety is excusable to an limit. Using your gold bar anecdote…. Yes, you're wrong to leave it there and wrong for someone to take it. However, you shouldn’t be surprised if the gold is missing in the morning and it is never found.

Naiveté is different from fault. I specifically made the point:

there are practical steps we should probably take to protect ourselves from the criminally minded

Violating the law is criminal. Criminals exist. We should save ourselves some hassle and unpleasant experiences by recognizing that fact. But the rule of law is predicated on equal protection and blaming the victim means you don't believe they deserve to be protected equally and thus don't believe in the rule of law.