Yes, I was hacked. Hard.

http://www.emptyage.com/post/28679875595/yes-i-was-hacked-hard

by thibaut_barrere • 14 years ago

446 295 14 years ago

emptyage.com

growse2• 14 years ago

Well, if you will put complete remote control of all your devices behind a single, weak password.....

david_shaw• 14 years ago

> Well, if you will put complete remote control of all your devices behind a single, weak password.....

From the post:

> My password was a 7 digit alphanumeric that I didn’t use elsewhere.*

It sucks, but when you've got control of someone's iCloud account (email, and remote wipe of presumably their primary devices), you've put them in a tight spot. One of the many reasons that I use iCloud for my phone and iPad, but certainly not my primary machines (or email).

Rough night.

Zr402• 14 years ago

On your primary machines, you should have at least some form of local backup. I'm using Time Machine with a network drive. If my primary machine fails or gets wiped (whether I did it myself or someone obtained my iCloud password), I can still recover everything from the backup.

CamperBob25• 14 years ago

What difference does it make how strong the password is? It was a seven-digit alphanumeric password, right? Is iCloud going to permit up to 36^7-1 failed login attempts in a row without rate-limiting, banning, or launching missiles at the owner of the offending IP address?

Assuming the answer is no, there are only two remaining alternatives: 1) Someone targeted and keylogged him to obtain the password, in which case it doesn't matter how strong the password is; or 2) Someone hacked iCloud itself and stole their (presumably unsalted) password file.

In that case, yeah, a stronger password might've helped. Bad user. No cookie.

But if he thinks he's having a rough night, consider what scenario #2 would mean to Apple. The impact of an iCloud hack would be measured in multiple billions of dollars of market capitalization.

smadam95• 14 years ago

The strength of the password is relevant in the scenario where the password was actually brute-forced through an interface. If it was jesus01 (or something else common - typically religious), then it may be an easy hack for the hacker.

growse2• 14 years ago

It's a good point actually - does iCloud in any way prevent multiple account logins?

There's another possibility: he re-used his iCloud password on another account, that was compromised, and someone tried that successfully against his iCloud account.

The bigger issue, as someone else has said, is putting so much remote control behind a single point of security.

lambada• 14 years ago

The issue I have is that in this case, your AppleID is (normally, by default) the ID you use for everything Apple related - including the iTunes Store. I really have problems typing long 20 character passwords comprised of every kind of symbol on the iPhone keyboard. It was annoying enough trying to type my Twitter and FB passwords correctly the first time. To type that every time I want to update my applications for free, is not a nice experience for me. This means someone could wipe my iPod remotely, but I would note that I don't have (use?) any kind of Apple controlled email, so the impact for me would be limited to my card being charged for iTunes purchases.

zxoq• 14 years ago

With iOS 6 it's not necessary for updates, at least. Still required for installing paid apps though (which arguably it should be).

jrockway3• 14 years ago

This is why I use two factor authentication for my email. It's a usability nightmare, but not as much of a nightmare as losing all my accounts everywhere.

AncientPC• 14 years ago

Two factor is magnitudes better than password only, but it's not foolproof.

Security is only as strong as the weakest link. CloudFlare was hacked recently because the attacker was able to redirect voicemail to another account, then use the two-factor backup recovery phone option to take control of Google Authenticator.

https://blog.cloudflare.com/the-four-critical-security-flaws...

jrockway3• 14 years ago

You can no longer recover a Google account via a voicemail message, and AT&T now allows you to lock changes to your account with a passcode. And, the people that committed this particular attack are now in jail awaiting trial.

skeletonjelly• 14 years ago

Usability nightmare? It requires you reenter a code from your phone once a month.

jrockway3• 14 years ago

Google's is pretty easy to use, but the problem is that it doesn't scale to other providers. In addition to my phone, I also have a PayPal credit-card-sized token, and my brokerage only issues key-chain RSA keys. So now I have to have my phone, my wallet, and my keys with me in case I need to use certain websites. It would be better if everyone agreed on a standard algorithm and used it, but that's not what's happened.

Hence, a usability nightmare.

fjarlq2• 14 years ago

No backup? Seriously? Wow.

What do people like for backups these days? Crashplan seems pretty damn good to me.

thibaut_barrere• 14 years ago

I use a mixture of Crashplan (but only locally between machines because our DSL connection is waaay too slow) and DropBox.

I'd be curious to hear more about other people's solutions.

josephagoss• 14 years ago

Been using Crashplan for couple of years now. For a couple days pay you can backup so much.

Auguste• 14 years ago

I haven't tried Crashplan, but I recommend either Backblaze or SpiderOak. I used SpiderOak in the past when I had both a Windows and a Linux PC I needed to keep backed up, but now that I have one Windows PC I use Backblaze.

Backblaze really shines if you have a single Windows or OS X PC with a lot of data. For $50/year, it will allow you to backup unlimited data for a single computer. As far as I know there is no student discount.

SpiderOak really shines if you have multiple Windows, OS X or Linux PCs with a small amount of data between them. For $100/year, it will allow you to store up to 100GB of data between as many computers as you want to back up. If you're a student, it will only cost $50/year.

barrkel3• 14 years ago

Crashplan has a home plan that lets you back up unlimited data for all your machines. It works on Windows, OS X, Linux and Solaris, which is great for me; I back up all my machines to both the cloud and my Nexenta/Solaris NAS, as well as backing up the NAS. In fact, if you know other people who have lots of storage, you don't have to pay for Crashplan at all; you can back up to them, with encrypted data.

thaumaturgy4• 14 years ago

...Wait, you mean, an online backup service that sends emails (and password reset requests) to an email account that can be compromised?

Hm.

DeepDuh• 14 years ago

But, but, it must be in the CLOUD, don't you know?

barrkel3• 14 years ago

Crashplan does not require you to use its cloud storage, FWIW.

And after you've logged in to Crashplan, it's not clear to me that you can do a whole lot of damage via the website; the password used to encrypt your data is specified on the client side, and there is no reset mechanism for it. I mean, they could update the credit card settings, or modify the configuration options like excluded directories or send rates, but not a whole lot else.

crazygringo• 14 years ago

Question: could an attacked delete my CrashPlan backup via the website?

It seems like they should be holding on to files for 30 days period or something. Does anyone know?

ejdyksen• 14 years ago

You can configure CrashPlan to encrypt your archives such that you must have your password to decrypt them. There's a big warning that if you lose your password you're screwed.

Also, you can just specify your own encryption key. Everything is encrypted locally.

Legion• 14 years ago

CrashPlan has swooped in and knocked every cloud backup system I previously used to use out of contention.

They've made an awesome product and they provide it at an awesome price.

Previously, I was a user and big proponent of Jungle Disk, but that product has become all but completely abandoned since being gobbled up by Rackspace. (I love how their solution to comments about going radio silent and not updating their blog in over a year was to just take the blog down and put up a "The Jungle Disk blog is currently unavailable" message, as if the blog were just temporarily offline. One of their last blog posts was a "Future of JungleDisk" post, outlining tons of features that, 16 months later, were nowhere to be seen).

I had been recommending Carbonite to friends and family for an easy-for-normal-people backup solution, but their performance falls short of CrashPlan, and their heinous near-silent default exclusion of video files from backups would have led to serious tears if we had ever actually needed to restore from backup. (Automatic backing up of video files is reserved as a feature for the new $150/yr HomePremier plan - which at least now makes this fact somewhat visible. Previously, there was damn little to indicate that this exclusion was happening). That made Carbonite something much less than the "set it and forget it" backup for my non-technical friends and family that it was supposed to be.

CrashPlan is nice and friendly, has no hidden "gotchas" that I have found yet, and has a great PRO service as well. The client GUI can even be made to connect to the daemon on a headless server through an SSH tunnel, just with a simple change in port number in the config and forwarding the remote port through the tunnel.

gurkendoktor• 14 years ago

I absolutely love CrashPlan, but it is only friendly if you never need to change the backup selection. It gets tough when you want to deselect just the right folders to avoid spamming your backup destinations with useless crap like Xcode docsets and Safari caches.

deno2• 14 years ago

Custom backups using Duplicity+GPG to multiple clouds. Wuala[1] if you want something working out of the box. I have 18.5 GB of free storage just from coupons found with little Googling[2].

[1] https://www.wuala.com/

[2] http://static.deno.pl/pub/wuala-storage.png

chmars2• 14 years ago

Wuala is great but not recommendable for backups if you care for Mac metadata and an app running silently in the background. I have no idea why Wuala has not implemented these features after all the years. Crashplan is Java-based too and has both features.

graue2• 14 years ago

Looked into Wuala. I like this part:

"Wuala is completely private and secure. When you store a file in Wuala, the file [..]gets encrypted before it leaves your computer. [..]Your own password is very important here: it never leaves your computer, so we do not know it. Hence, not even we can access your data."

- https://www.wuala.com/en/support/faq

But it seems pointless in light of:

"Do you plan to open the source code?

Currently not. Opening the source code of Wuala would consume quite some time and effort, and commitment to maintain it. If you are a software engineer and would like to see how Wuala works, feel free to apply for a job at Wuala."

- https://www.wuala.com/en/support/faq/c/21

It would be trivially easy for them to hide a backdoor and/or leak data in their closed-source code. So at the end of the day, the message is "Trust us." So what purpose does the client-side encryption serve? Empty marketing. At best, it makes it _slightly_ harder for them to read your files.

Tarsnap (www.tarsnap.com), which does have client source code available, doesn't suffer from this problem. Unfortunately it's a fair bit more expensive.

jmacdotorg2• 14 years ago

I recommend BackBlaze to my friends for the simple reason that it's saved my bacon once, after a laptop theft. I'd have lost years of data otherwise. It also helped me give the police information that resulted in my laptop's physical recovery.

Full story, from last fall: http://prog.livejournal.com/983354.html

piffey• 14 years ago

Hate to repurpose a cliche, but never put all of your eggs in one basket.

tomjen3• 14 years ago

On the contrary.

Put all your eggs in one basket and then watch that basket.

smadam95• 14 years ago

>>7 digit alphanumeric

...could mean anything from myacct1 to iS2xd45

Since the password is no longer in use (only assuming), it would be interesting to know what it was - perhaps the reason that it was hacked was that it simply was easy to brute force due to common dictionary words?

Just throwing an (possibly wrong) idea out there.

bigiain6• 14 years ago

That still rasies some questions. You're either implying Apple allow enough login attempts for brute force against their live web services to be possible, or that someon somehow got hold of the password hash.

Without knowing the guy, I strongly suspect a reused password that was exposed somewhere other than Apple/iCloud. Anyone want to bet against this Gizmodo guy's password being in the Gawker password dump?

bigiain6• 14 years ago

I guess I owe @mat an apology here - it seems Apple's customer service was at fault, not @mat's password reuse practices…

nicholassmith2• 14 years ago

I'm amazed that Apple isn't running something to check for brute force attacks on iCloud.

dekz• 14 years ago

As am I, considering almost weekly I used to get my iTunes account reset from failed attempts (maybe an old app or suspicious activity?).

More likely the writer erred and reused the password.

nicholassmith2• 14 years ago

Or had his password shoulder surfed or something similar.

danso4• 14 years ago

"Weekly" resets? I've never had a rest in the years I've used the same password. I would be paranoid if I were you

0x07• 14 years ago

That's it, I'm disabling "Find my mac". I guess it wouldn't work anyways if a thief is far away from my home or work wifi. So in essence, it's a remote wipe backdoor for when the device is in my possession, and useless if it's stolen.

FileVault2 should take care of the theft problem anyways.

Too bad you can't partially-enable Find my mac for the location service, while disabling the remote wipe and lock services.

sgdesign2• 14 years ago

Why do you think it wouldn't work if the thief is far away from your home or work?

0x07• 14 years ago

How would it connect to the iCloud services? The mac doesn't have a built-in 3G connection, so the only way it can go online is through previously-stored wifi associations.

Zr402• 14 years ago

Instead of only disabling Find my Mac, please make sure your backups are functional and enabled. That way, if your machine fails or gets wiped (whether it's by you, a thief or someone with your iCloud password), you can still recover everything.

0x07• 14 years ago

Sure. But should something like this happen, I'd prefer to not waste time having to sit through a complete reinstall before I can start damage control by changing passwords online, etc.

pilif3• 14 years ago

If he really hasn't used that password anywhere else and it was not based on a dictionary word, then I highly doubt OP's password was brute-forced.

Brute-forcing the iCloud password is an online attack and would probably (hopefully) be caught by apple.

What is more likely is a keylogger or similar malware at which point even a longer password would not have helped. The days where macs are free of malware are unfortunately over.

0x07• 14 years ago

Or maybe there's a problem with the iCloud auth protocol, and it was snooped? For example, that in-app purchase hack (which involved a MITM attack after installing a custom SSL CA) revealed passwords were being sent "in the clear" inside the SSL transport.

This is just speculation.

pilif3• 14 years ago

Very good point. As a reporter of Gizmodo he might have tried the hack.

I do believe though that sending a password "in the clear" over SSL is totally sufficient. SSL was designed exactly for sending sensitive information like passwords.

We can't blame Apple for not designing a protocol (it might be just plain HTTP basic over SSL) with people in mind that turn off SSL security in order to get access to paid content without paying.

I was voicing this exact concern here: https://news.ycombinator.com/item?id=4240124

nikcub• 14 years ago

My first impression is that either a session token or password was intercepted from iCloud either via malware or MITM. But the post mentions that the iCloud password was reset, which means the account may have been hacked via Apple ID security questions[1]

When I just did this for my own account, the first security question is your date of birth, which is easy to find for anybody via Facebook. The second was a generic security question.

These are easy to guess or to find out via social media. You could spearfish a user by sending them a free account to a web service and asking them the same security questions on registration.

The security isn't adequate, considering the data that is held behind an Apple ID. I also can't believe they have a delete feature that can not be undone.

For my own account I have done a few things. First I have a secret email address for online accounts that require higher security. These emails are unique for each service and are not published anywhere. I have also removed all of my personal information from my social accounts, such as date of birth, name of school, etc. and my security answers are always random strings.

The other option is that malware was used, or a transparent proxy. If iCloud doesn't verify the server certificate it would be straight forward to proxy the HTTPS requests. iCloud will also always send out connection attempts every x minutes, so if you accidentally connect to a public WiFI hotspot or personal network with an intercepting proxy setup, you can have your password stolen in a matter of minutes.

I am also not super-confident about two-factor auth. I noticed that with Google Apps the verification SMS messages can be read using the web interface for my telco provider. A web interface that is protected by nothing more than an email address and password with the same weak security questions.

I think it is very feasible to hack around second-factor SMS notifications by first hacking the telco provider web interface and reading then deleting the SMS alerts. You are only as secure as the weakest link in the chain.

[1] https://iforgot.apple.com/cgi-bin/WebObjects/DSiForgot.woa/w...

lostlogin3• 14 years ago

See update to story, it wasn't brute forced it seems.

Orva• 14 years ago

Remote data wipe access to devices from cloud service. What could go wrong?

duaneb• 14 years ago

Well it's still much preferable to not being able to wipe data from stolen hardware.

michaelt• 14 years ago

Better still would be encryption that meant there was no need to wipe data from stolen hardware.

tylermenezes2• 14 years ago

Everyone's focusing on the security of the password and iCloud, but I just wanted to take a second to say: fuck who did this. Yes he should have backups, but erasing someone's things is such a juvenile thing to enjoy.

Edit: Surprised to see Cloudflare is proxying their website. I understand wanting to be impartial, but I think it's fairly easy to draw the line at groups breaking the law.

smadam95• 14 years ago

I'm sure most feel bad for the guy, but although the hacker's actions were malicious, that doesn't allow the victim to just get off the hook for having a silly password - if that was the case.

dkroy2• 14 years ago

He didn't "get off the hook". His files got wiped.

cstross2• 14 years ago

erasing someone's things is such a juvenile thing to enjoy

I don't know what part of the world you're in, but here (in the UK) it'd actually be a criminal offense carrying a multi-year prison sentence under the Computer Misuse Act.

I'm wondering at what point the police or law enforcement get involved in the US?

tylermenezes2• 14 years ago

Generally if the person is important enough.

This is the only case I can think of where non-classified information leaks were prosecuted: http://en.wikipedia.org/wiki/Sarah_Palin_email_hack (There are probably more, but I can't imagine any would actually disprove my point.)

sgdesign2• 14 years ago

I actually didn't even know that enabling "find my X" also enabled that remove wipe option. I just disabled it for my MacBook Pro, Undercover is a much better solution anyway: http://www.orbicule.com/undercover/

muppetman2• 14 years ago

Do people really think these services are actually much good though?

Sure there's a few amazing stories they use for the marketing campaign, but that's about it. If you actually loose it (i.e. not stolen) then they work.

Most people that steal them though know exactly what they're doing and how to wipe them properly. Same with mobile phones etc.

I guess something is better than nothing, but really it seems to me they're selling you the same as the dream of winning lotto without mentioning the actual odds.

racbart• 14 years ago

This is one of the reasons why I have different Apple ID for app purchases (with weaker password which I'm more comfortable to type over and over again when purchasing apps) and different for iCloud (which I need to type only once, configuring the device).

I saw many people buying their apps in public and the password input in iOS isn't really secure from bystanders. As a Gizmodo reporter he probably went to dozens of events where he was pitched to try someone's app and maybe even given App Store codes. If he used to download apps on such events that might be the source of his leaked password. Someone could simply see what password is he typing.

As long as Apple requires you to type the password with each purchase, it is wise to separate your sensitive data/services with the App Store credentials.

wamatt2• 14 years ago

Never understood Apple's insistence on asking for the password all the time.

For such a customer focused company, it just seems so bad.

hrktb• 14 years ago

If you get the chance to watch a kid playing with an iPhone it's an eye opener. The 15min no auth required again window after an app purchase is the devil's time.

Someone• 14 years ago

Relevant argument for the other case: http://www.pcworld.com/businesscenter/article/259769/its_a_h...

user49598• 14 years ago

Passwords: Don't try to remember them. Use a service like passpack to generate and store random ones for every account. Two pass authenticate into it.

Data: Back it up. Backup your backups. Stop fucking around. If you don't get hacked, your storage will fail.

Software: Don't install shit you don't trust. Don't trust shit you can't verify.

Passwords: Don't try to remember them!!

It's 2012, not following these simple rules is inexcusable.

bigiain6• 14 years ago

Unfortunately, my AppleID password is one I _do_ need to remember - I need to use it often, and in places that 1Password won't auto fill. At least: the iCloud website login, various iDevices when using app store, and iTunes on several machines (all on the home sharing network). The alternative seems to be to have all those devices "remember" my AppleID password, which seems like a security lose.

nl8• 14 years ago

Unfortunately, my AppleID password is one I _do_ need to remember - I need to use it often, and in places that 1Password won't auto fill.

Write it down on a piece of paper (or use a password manager that will show your password).

Back in the 1990's "writing down passwords" was considered a huge security hole.

Now day's attack vectors have changed and it is probably more safe than using a memorable password.

The alternative seems to be to have all those devices "remember" my AppleID password, which seems like a security lose.

If your devices are physically safe, and iCloud has remote log-out (does it?) then this may be more safe too.

katbyte• 14 years ago

There are strong/long passwords that are easy to remember:

%Thisspasswordd1s1nhonor..ofmy246catSS!!

http://xkcd.com/936/

having a 20-30 character long password is fairly easy, it may not be 100% random, but (correct me if i'm wrong) a password that long with just a handful of random extra letters and numbers is going to be rather easy to remember and probably going to be just as had to brute-force.

EvilTerran2• 14 years ago

Software: Don't install shit you don't trust. Don't trust shit you can't verify.

This one is pretty tricky. There's a lot of little tools out there that I find invaluable, and haven't screwed me over yet (as far as I know), but fall firmly in the "downloaded it off someone's little personal website" category.

I'd say we need better fine-grained permission systems for software, so people can install programs without needing to trust them, safe in the knowledge that they'll get the opportunity to deny any malicious behaviour before it actually happens.

SoftwareMaven2• 14 years ago

That's what the Mac App Store is starting to do, but unfortunately, it's "completely sandboxed in the store" or "not in the store". I'd like a model that started completely sandboxed but let me choose if I want to let it out of the sandbox in certain, well-monitored cases.

wlesieutre• 14 years ago

That's what Apple's shooting for with the App Store's sandboxing requirements, but I'm sure the typical HNer will continue to have a few programs that need to operate outside the limited entitlements that the App Store allows. Still, it'll be better to have a single digit count of those on your computer instead of anything being able to erase your home folder without asking.

aw3c2• 14 years ago

> When I set it up, years and years ago, that seemed pretty secure at the time.

If you did not change your password in those many years, an attacker had years and years of time to find or crack it. Regularly change your passwords. And use special characters.

robomartin2• 14 years ago

Every machine we have has local backup in the form of a sizable external USB drive. Some also backup to a network drive. Windows and Mac. With dozens of machines it is hard to justify paying for remote backup. Although, every time I say or think this I also think: fire, theft, earthquake. I wish there were a reasonably priced multi-machine remote backup service at an affordable price with storage measured in terabytes. One hundred gigs doesn't even begin to scratch the surface.

Soliah• 14 years ago

There is Backblaze[1]. Unlimited backup at $50/year/computer.

[1] http://www.backblaze.com/

jasonlotito• 14 years ago

My wife recently started using this. She wanted to have another source backing up her photography (being a photographer and all...), and this was highly recommended by all her friends with expensive cameras and even more expensive lenses.

I was shocked, mostly because the price was fairly inexpensive, and her lot love to spend lots of money on small things.

I take pictures with my iPhone. =/

barrkel3• 14 years ago

Like was suggested earlier, Crashplan. It can do both local and remote backup, and remote backup to multiple locations if you know other people who also run it and have free space for you to use. Home plan is multi-machine unlimited; however, in practice, I only use about 800GB or so.

robomartin2• 14 years ago

I checked out CrashPlan+ and it looks good, except that I am having trouble finding their definition of "personal data". It says that CrashPlan+ is licensed for "personal data" but I am not sure what this means.

http://www.crashplan.com/business/compare.html

rickmb• 14 years ago

One thing that worries me about iCloud is that it puts a lot of data and services behind one single password.

Said password is therefor used a lot, with a lot of chances for interception. But most of all, it's used for trivial matters in which password typing is a nuisance (installing a cheap iPhone app), which pretty much invites people to use a weak, easy to type password.

iCloud should have multiple, completely separate forms of authentication for services like Find My Mac, instead of using the same login for wiping all your Apple hardware as you use to download Angry Birds...

mileswu• 14 years ago

Perhaps it should ask an additional security question or passphrase for 'dangerous' operations like remote wipe.

Two-factor authentication (using say your phone like Google) wouldn't work however because typically it's your phone that is stolen and you are trying to wipe.

Jach• 14 years ago

You could use something besides a phone for 2-factor authentication--e.g. YubiKey.

radicalbyte• 14 years ago

That's why google let you use multiple phone numbers to verify.

Lose your main phone? No problem, login to your account using the two factor code from your landline (or partner's phone).

TazeTSchnitzel2• 14 years ago

Same reason why I worry about Google Accounts.

Your email, contacts, calendar, location, phone security, documents, files, music, videos, games, apps, credit card details, merchant account, search history, web app hosting, etc., all on one account.

nl8• 14 years ago

Turn on 2-factor auth.

I thought about it and worried about it and thought about it some more, and finally did it.

And I had no problems at all - it works really well.

justincormack4• 14 years ago

They are gradually adding more options. There are now single use passwords for some services (I have them for Chrome and Android). Plus they support two factor authentication.

pjmlp5• 14 years ago

Easy, just don't use them.

16s3• 14 years ago

I agree. For years I have believed that "Single Sign On is Single Compromise", but users and auditors love it.

lostlogin3• 14 years ago

That damn account password kills me. A single password which you have to enter heaps of times on iOS. If having one password meant you only entered it once id cope, but its for email, iCloud, imessage, home sharing music, home sharing video, notes, find my phone, AppStore. It's so slow to set a device up, especially if you have a decent pasword. I wish they would fix it.

nicky0• 14 years ago

You can use a different Apple ID for the App Store that you use for iCloud, on the same device.

mtkd2• 14 years ago

"He and Gawker’s Scott Kidder then got on the phone with contacts at Google and Twitter trying to help me put the brakes on."

Of all the issues surrounding this event, this one concerns me most. Most users would not be able to escalate like this. Hosted services need to be providing this level of support to all customers 24/7/365 - or at least offer it as a premium option.

mhansen• 14 years ago

For Google Apps paid users: http://googleenterprise.blogspot.com.au/2011/11/24-x-7-phone...

mtkd2• 14 years ago

I have this - and I had reason to call it recently due to a technical issue.

In short: I'd advanced paid for a 1 year Apps account a month before the monthly billing came in to place. My credit card expired with 11 months of the contract left, but they suspended the account as that appears to be policy with new monthly billing system. I received no email asking to update the card prior to suspension. This suspended all the services it was connected to. Call centre couldn't help, account was down for 18h - they just said wait for new card to propagate.

I'm sure if a journalist from Gawker had posted this to HN it would have been resolved with more urgency.

nubela• 14 years ago

why is this news?

muppetman2• 14 years ago

Because it shows people the effect that someone getting your iTunes password can have, especially if you've enabled Find my X in your account?

It shows that (maybe) it's possible to brute force an Apple password?

Because it's generally interesting reading, in the same way that people like to rubberneck at car crashes. I'm not saying that's right, but it's human nature.

pjmlp5• 14 years ago

Specially because people are dumb enough to rely important data to third parties, instead of having it at home.

419• 14 years ago

>>They weren’t able to stop the wipe on my Macbook. Or give me a pin to log into it.

I don't use a mac so this question might seem a little off.

Wouldn't disabling the computer's internet access stop his data from being entirely wiped?

justincormack4• 14 years ago

Yes but he didnt realise what was happening. Ran for the computer not the wifi router.

thaumaturgy4• 14 years ago

Damn, poor dude. The remote wipe was a pretty big asshole move.

I'm pretty curious about the initial break-in on his .mac account. I suspect that either he's misremembering and he has used the password elsewhere (and it was compromised there -- easy to happen over so many years of use), or it wasn't very strong to begin with and it got guessed after a handful of attempts.

There are a handful of takeaways from this:

- Backups, obviously. A lot of people here so far are mentioning online backup services, but those would be just as vulnerable to this kind of attack, since they're accessible online and use an email account for password resets. Online backup services and physical offline backups solve different problems and it's a good idea to use both.

- Since I haven't seen this mentioned anywhere else: I wonder if it's time to consider keeping a "secret" email account that's only used as the password-reset account for all of your services? Something that you never use for communication, never publish anywhere, something with its own entirely separate password.

- Be careful about owning multiple devices from a single vendor that provides remote access and other kinds of control to those devices. Mobile devices are inherently insecure; they shouldn't carry sensitive personal information, ever. There are a lot of really good reasons for going with a single vendor, and remote wipe is a really valuable tool in case of theft, but the downside is ... well, this.

- Use some kind of password storage mechanism. (I prefer something that's not tied in to a publicly-accessible service.) I've made a game out of memorizing horrible passwords, and can recall quite a few without any patterns or mnemonics or the like. Still, I use KeePass every day anyway.

And maybe most of all: I doubt there's a single one of us that has a moral high horse to ride on this. Everybody always has something better to do than set up a new backup system or dick around with something that will only maybe hurt them someday. I'm constantly harping on other people about backups, but only a couple of days ago got my development machine on our network backup system; I'm pretty anal about passwords, but still I'll panic pretty badly if my laptop is ever stolen, because in there, somewhere, is probably a plain text password stored in a file that I've forgotten about, and there'll be a chance that I'll forget to change that particular password if I find myself having to suddenly change every single password for everything I've got access to.

mike-cardwell4• 14 years ago

If you hack into my email account, you still can't read any password reset emails that are sent to it: https://grepular.com/Automatically_Encrypting_all_Incoming_E...

krickle• 14 years ago

This is a fantastic idea.

wahsd• 14 years ago

That's all wonderful, really; but it's not exactly practical for everyone to do for themselves.

Groxx• 14 years ago

I really like the idea, but what if someone hacks into your email server and just turns off the encryption step / reads the incoming traffic? I assume they won't have your private key in that case, but crazy-few sites require and check (or even allow?) encrypted emails as validation, so they could still masquerade as you until someone checked the numbers.

thaumaturgy4• 14 years ago

I remember this showing up on HN before! It's really cool, and it's been on my to-do list for my mail server ever since.

bigiain6• 14 years ago

OK, so now I know that I need to hack your dns server or your registrar instead - then I'd just publish MX records for your domain and head off to all the "I forgot my password" links I can find.

It's turtles^h^h^h^h^h^h^hsecurity problems all the way down…

nonane• 14 years ago

> but still I'll panic pretty badly if my laptop is ever stolen, because in there, somewhere, is probably a plain text password stored in a file

You really should consider using using whole disk encryption like FileVault or PGP-WDE. Encrypting a single directory or a home directory is not a good solution.

ricardobeat6• 14 years ago

and remember to use a different password from your iCloud account.

barking• 14 years ago

You should encrypt all PCs, laptops that contain anything valuable with with something like truecrypt.

fjarlq2• 14 years ago

Two-factor authentication should make it much harder for somebody to break into your email account (secret or otherwise) and reset your passwords.

Instead of memorizing horrible passwords, have you tried making a non-horrible passphrase by rolling dice and picking words out of a dictionary? Arnold Reinhold calls it Diceware:

http://world.std.com/~reinhold/diceware.html

It isn't easy to develop these habits, but my data is priceless to me. I know that too well because I've lost some of it, and it still hurts. So I've made it a tradition to chip away at it on daylight savings sundays: update clocks, check smoke detectors, work on backups, shame friends into doing same....

16s3• 14 years ago

I like diceware a lot. The only drawback is that the pass phrases are too long for some sites.

speleding• 14 years ago

While two-factor authentication may be a good idea to gain access to sensitive information, I'm not sure it would be practical to use it for remote wiping devices. Typically the device you would want to wipe is one of the two factors.

(Which underlines the point that you need to do backups...)

strictfp• 14 years ago

+1 for the moral high horse. Everytime something gets hacked the hacker community blames the victim for using less-than-optimal security. Well guess what? There is no foolproof system. The same reactions are seen when sites go down. 'Oh, but they should have used a distributed, redundant buzzword compliant system in a multitude of nuclear bunkers and this would never have happened'. Every system has weaknesses. And every person or team is imperfect. Sure there are lessons to learn, but lets show some sympathy and ask the persons involved what they would improve, not assume that we understand everything and dictate what they should have done.

mchanson2• 14 years ago

Not having any backup is, for a technically capable user, indefensible.

yulerhow2• 14 years ago

I bury encrypted backups in my backyard. It's not foolproof but it seems much more secure than depending on an online backup. /highhorse

alexqgb• 14 years ago

Except in this case we're talking about a solved problem. The simple rule - and is really is simple - is 3/2/1: three copies, two local, and one remote. Anything less is "backup", not backup.

Time Machine (a free utility that ships with OSX, not a military-grade absurdity) would have handled the full restoration of the laptop, which could then restore the wiped iPad and iPhone fully. He'd still have the email hacks to contend with, but at least he'd have his tools back.

It's not his fault that he became a target, and blame for the attack should be firmly limited to the agressor. But the severity of the consequence was clearly amplified by substantial incompetence and / or indifference on his part.

tripzilch3• 14 years ago

> +1 for the moral high horse. Everytime something gets hacked the hacker community blames the victim for using less-than-optimal security. Well guess what? There is no foolproof system. The same reactions are seen when sites go down. 'Oh, but they should have used a distributed, redundant buzzword compliant system in a multitude of nuclear bunkers and this would never have happened'. Every system has weaknesses.

In this case, the guy had ALL his shit wiped. Not a clumsy move at work causing months of extra work, or some dickhead hacker having some fun with your account credentials, no they actually thoroughly deleted a huge chunk of his personal data.

See it's like, if a pyromaniac burns down someone's home, maybe there were ways to prevent that, but you don't go blaming the victim then either. Some times the first thing is sympathy. There's times to be heartless and times to be not.

Remote-wiping all his personal stuff was so unnecessarily malicious, sympathy comes first. And besides, in this case, not having any non-remote-wipeable backups, the only thing you could possibly maybe blame him for is putting all his stuff in the cloud. Yeah no not smart, maybe, but it simply doesn't weigh up to the fact that someone actually went through the trouble of meticulously deleting all of it. Not stealing, or defacing, but deleting.

Tloewald2• 14 years ago

Online backup systems should, generally, be ok even if temporarily compromised since they will keep copies of stuff even if you delete it. (Dropbox does this for FREE accounts.)

The problem is backing up big stuff -- I've got my working docs backed up the wazoo (I can even backup large multimedia/game projects to Dropbox) but my photo and media libraries are unmanageable.

gbog• 14 years ago

Happy to see someone else not willing or not able to let files disappear in the cloud. For photo and media I keep them on two 500Gb usb drives, one at home and one at office, and keep them in sync with the wonderful tool unison.

SoftwareMaven2• 14 years ago

I have redundant backups. Everything's gets backed up locally with Time Machine very regularly. Then nightly (or more, depending on volume) it gets shipped off to Backblaze.

It gives me quick responses if I need to restore something, but if my house blows up, I'm only $100 and a FedEx visit away from having everything back.

MiguelHudnandez4• 14 years ago

Keep big backups locally.

"The only secure computer is one that's unplugged, locked in a safe, and buried 20 feet under the ground in a secret location..." -- Dennis Huges, FBI.

The same goes for USB disks. I prefer to have one of my backup drives inactive most of the time and out of plain sight (in case of theft from my home).

Because he was a mac user, he should've been using Time Machine. It can be hosted on a network partition at your home so you don't even have to remember to plug in a backup drive. And in OS X 10.8, you can assign multiple disks and it'll keep them all up to date if they're accessible at the time. So one can be on your home network, another at your work network, and yet another on a physical drive that you can keep locked away in a safe or something. Just pull it out once a month to back up all your macs.

pnathan• 14 years ago

Macs have Time Machine.

I found that grabbing an external HD and plugging it in started time machine right up. I do that every week or so.

(Which reminds me, I should go do that in a few minutes!)

rsync• 14 years ago

Every week or so a potential client comes to us and describes, in one way or another, this general scenario. They ask "what if someone breaks into my server that I am backing up to you, and then using the SSH key, logs into my rsync.net account and wipes all of that out as well.

So for the last 6 years or so (we've been providing offsite backup since 2001) we have offered "pull backups" to our customers that request it. We give them our public SSH key, and we log in and rsync their data back to us.

Also, RE: the previous comment about not having your data consolidated to a single provider, we run an ad on reddit regularly making the same point:

http://www.reddit.com/comments/hg9oa/your_platform_is_on_aws...

nl8• 14 years ago

I suspect that either he's misremembering and he has used the password elsewhere (and it was compromised there -- easy to happen over so many years of use), or it wasn't very strong to begin with and it got guessed after a handful of attempts.

This may not be the case. Computers are very fast at checking passwords, and if Apple doesn't deliberately slow the login process for all authentication scenarios it is easy to check a lot of passwords in parallel.

mlloyd2• 14 years ago

No - turns out Apple let the hacker in.

Tycho• 14 years ago

Decent idea there with the password storage secret email account... Anyone else agree?

KingMediocre• 14 years ago

Best guess for initial break-in is phishing. I've always thought there should be a "sudo" light/display on the monitor that can only be accessed by the superuser, making attackers unable to completely mimic a dialog requesting secure access.

BryanB55• 14 years ago

The secret email account only for password recoveries is a great idea. Same issue cloudflare had back when they were hacked.

I use Google apps for business for email hosting and even setup a secret email account that is used as the admin account (which can setup users and change passwords). I think most people that use google apps set up their primary email address as the admin account, but if that account gets compromised its incredibly easy to reset the password on every account on your domain.

jjb123• 14 years ago

And you could even add 2-factor auth to just this secret email account for added measure.

jmitcheson• 14 years ago

That's a good idea. This article explains more about the Cloudflare breach, if anyone's interested.

http://www.smh.com.au/it-pro/security-it/attackers-hit-twofa...

OmIsMyShield• 14 years ago

Is there some background concerning the author that I'm not aware of? Asking because some comments (at Emptyage, not here) seem unusually hostile.

dctoedt• 14 years ago

I wonder why the article author was (seemingly) targeted? And who else might the criminal be targeting?

Or could this be completely untargeted? That might mean that anyone with a password vulnerability is at risk of having their digital life wiped out. That seems pretty extreme for lulz.

danso4• 14 years ago

Don't know if this has been mentioned yet, but Gawker was completely hacked to pieces two years ago

http://www.wired.com/threatlevel/2010/12/gawker-hacked/

The most visible consequence was that the entire user DB was compromised and the site rooted. But other consequences were that the hackers had cracked a large number of Gawker staff accounts and even had access to internal emails and chats.

I think it feasible that enough internal info was linked to compromise Gawker's staff for years. Some of them probably thought resetting their gawker.com account was enough, and forgetting that that password might have been used elsewhere. Also unclear is how long the hackers were snooping around before the hack was discovered...in that time, they could have download dumps of staff email and gmail accounts.

The upshot: someone out there might have several GB of personal gawker staff info. Ever email yourself your ID number to your email account? Has anyone ever emailed you credentials that you forgot in the heat of the moment? How many times does your social security number appear in your Gmail, thanks to attached billing/app files at you originated from there.

And remember that the hackers had root access to everything at Gawker, even the site source code. How positive is everyone there (remember that the owner's laughable password is one of the main reason that Gawker got crushed) that no key-loggers had been secretly installed and have been running all this time? It doesn't even require anything that sophisticated...all it takes is one security-unsavvy staff member...and this is a staff of mostly culture writers...to do something insecure.

I'm not sure if Mat was employed by Gawker all this time but even if he came after the hack, you can see how one massive data breach can have almost permanent implications within an organization.

That said, what an awful incident and thank you to him for writing a thorough account of how he coped...this is a valuable lesson to everyone and I hope they find the punks who did it.

* To underscore my point, I didn't realize that Honan is recently a former Gawker employee. Yet he had enough credentialed access for an outsider to break into Gizmodo's twitter account. I bet Gizmodo didn't think that an amicable departure of an employee was enough to warrant a password change to Twitter...but if his emails contained the password, then it's an easy hack. If I were Gawker, I would change EVERYTHING...not just gizmodo info, but all of its sister Gawker site credentials. They should assume the worst and that someone out there has all of Honan's emails, including every time he might have been emailed credentials in plaintext

also, Honan's current employer, Wired, should do the same. Change all the keys.

ck2• 14 years ago

My guess is they used brute force to get the password

How can a system allow login attempts so fast and often that a 7 digit word with numbers can be hacked?

That's hundreds of thousands of attempts.

CamperBob25• 14 years ago

About forty billion attempts, to be specific.

It wasn't brute-forced, unless somebody got their hands on the iCloud password database.

alpb• 14 years ago

That made me say thanks to Google 2-step verification.

bdz• 14 years ago

The online backup service advice sounds good but what about the people, like me, who have an upload speed of only 64kb/s? No Blackblaze or Crashplan for me... Neither can I upgrade my internet connection. So what to do? I have two Time Machine backups (one hourly at home and one daily at another place).

uncoder02• 14 years ago

I hope the password wasn't:

g1zm0do

uncoder02• 14 years ago

Social Engineering... we never had a chance.

dbecker• 14 years ago

The hostility towards this guy in the comments is astounding. I already had low expectations for comments on blogs, but this took it to a whole new level.

ricardobeat6• 14 years ago

Impressed by that too. It gives the impression that some of the commenters are involved with the stunt.

masterzora• 14 years ago

Honestly, it gives the impression that some of the commenters are from the internet. As sad as it is, you can kind of expect shit like that from completely disinterested parties who just want to be assholes.

31433• 14 years ago

He's a writer for Gizmodo who was already widely disliked. That's why so many people are posting such mean comments.

Xyzodiac• 14 years ago

Why would anyone store that much data behind one password? Apple really shouldn't give the ability to remotely destroy all data on multiple devices with a single password.

I love my MacBook and all, but I would never use such a stupidly insecure service.

idiotblu• 14 years ago

Well that sucks. Big time.

shocks• 14 years ago

Google two-factor auth doesn't work if you have IMAP or POP enabled.

gglanzani• 14 years ago

In a sense it does. They provide different random 16 characters passwords for each of the client that request access to your data and does not support two-factor.

So if someone hacks your gmail password, they still cannot login via IMAP or POP, as they require different password (which you shouldn't write down or remember anyway).

oinksoft• 14 years ago

Wow, who would give a program like "iCloud" access such that it could wipe your mobile, tablet, and PC? I hope the author can recover his data, but it sounds like he set himself up for disaster by linking all his systems so strongly.

verelo• 14 years ago

The comments on that blog post make me remember all the things i hate about the Internet.

Jimbotron• 14 years ago

Indeed - I found the comments on the post almost as bad as the malice of the hack....

jstalin• 14 years ago

I created https://uncrackablepassword.com/ to generate passwords online that I don't need to remember.

tadhgk• 14 years ago

Personally I think all web services should be using aliases (so you don't login with the username that other people see) and pass phrases rather than passwords.

rdl• 14 years ago

Probably was hacked through email, then iCloud password recovered through it.

I wish there were a special high security password recovery email mailbox, separate from routine communications mailbox, in apps. Would be really hard to get adopted, and t that point, you might as well push for something better than passwords.

Zenst• 14 years ago

Very well written story and also very educational on the faith peopl put in cloud backups. Even if you have a cloud backup/syncronised it is still worth popping over your mum's or a good freinds with a some burned DVD's or external USB drive (if you have two you can swap them every time you visit). This approach is good as a cheap offsite backup and also social at the same time.

As for linked accounts, that again is another education many of us have probably overlooked and I would say if you do have a 2-factor facility that uses SMS, maybe think about digging out an old phone and getting a PAYG SIM with a token credit and using that number. But security is a never ending drive bordering on paranoia and in that you do what is enough to help you sleep at night after reading the article.

Don't think I have seen a article doing a test on how easiy it is to recover a hacked account and how long it takes. I certainly have never seen any speed comparisions, nor consumer reviews in that area. Anybody know of any at all?

koevet• 14 years ago

It should also be noted that on the iCloud web site there is no link to change password. This is the url to access the "My Apple Id" page and change the global password: https://appleid.apple.com/cgi-bin/WebObjects/MyAppleId.woa/

dkroy2• 14 years ago

Haha, oh wow those comments on his post are horrible.

emptyage3• 14 years ago

Hi, I'm Mat Honan (the guy who was hacked). I've been in touch with the person who hacked my account. He says it wasn't brute force, or guessed. I'll publish more when I know more.

To be clear, the password was unique. I use 1password as a password manager and even double checked to make sure that I wasn't using it anywhere else.

tricolon• 14 years ago

Have you considered (temporarily) disabling comments on your blog? Many of them are quite hostile, and might as well be deleted.

emptyage3• 14 years ago

They're rabid. But I think it's kind of an interesting side note at this point.

rcthompson• 14 years ago

So via your iCloud account someone can remote wipe all your Apple devices? That seems like a questionable design. Does anyone know the rationale behind this? I guess it would be useful to deny access to your data in the case where your device is physically stolen.

Maybe there should be a significant time period (hours?) after a password change where this functionality (and any other data-destruction functionality) is disabled. Or maybe a password change should require you to re-auth every device before data remote deletion features can be used on it.

31433• 14 years ago

It's so that you can remote wipe your own devices if you lose them, in case you have sensitive data on them. For example, my employer requires that you enable this feature if you want to get your work email on your phone.

r00fus2• 14 years ago

For this one reason alone, I have a pain-in-the-ass long AppleID password - 100+ bits entropy. It's a right pain to setup a new device (or even app) that can't be imaged off an existing backup, but it's worth it.

wrekkuh• 14 years ago

After hearing how this attacker was able move from one linked account to the next, ultimately gaining a snow-ball effect of moving through, defacing and wiping your data, from a security standpoint i can't say i'm surprised (of course that doesn't mean i don't feel for you and wish it never happened to you). I've made several avenues available to mitigate these types of effects, none of which involve administration at Twitter like most of the world.

Now i don't mean to insult you, but one basic avenue is two physical, offline & secure back-ups of everything i have on and off of the Cloud... with no connection to any network. I do have to say that it took a little bit of time to realize i did actually have to do this because my reliance on that data crept up like a ninja! And before i knew it i had well over 30Gigs of data up there in the Cloud, not backed-up.

fullfilldreams• 14 years ago

Mat Honan's statement on being hacked scared me into changing every password. You'll prob feel the same way, too.

CamperBob25• 14 years ago

Not really. This was clearly a targeted attack, whether he realizes it or not.

A security problem, not a password problem, in other words.

breckinloggins• 14 years ago

Regarding Google services:

When you enable Two-Factor Authentication, they give you the option of printing a "one time pad" with six codes on it. You then print this out and keep it safe somewhere. That way you can get into your account even if your phone and other contact points are compromised.

This won't do you any good if someone has deleted your google accounts or reset the 2FA system, but for more "normal" scenarios it can be a life-saver.

at-fates-hands• 14 years ago

Once again another cautionary tale about why you should be paranoid about the security of your devices and accounts.

When securing anything, the best philosophy is to just assume you're going to get hacked and act accordingly. Linking accounts, weak passwords, and no encryption? You're just putting a target on yourself.

Best advice? Keepass, Whole disk encryption and using anonymous information is a good start. Keep your stuff and accounts in separate silos, and stay in the shadows.

gcr• 14 years ago

This article inspired me to begin using a password manager instead of putting everything in `.netrc`, `getmailrc`, and plaintext passwords everywhere else. Thanks.

dendory• 14 years ago

The thing I keep thinking about when reading this is how many others, perhaps thousands or more, get hacked like that but don't have his clout? No direct line to Twitter, Google, etc..

mlloyd2• 14 years ago

It's both better than and worse than it appeared/feared. It turns out it wasn't a password hack, it was a social hack against Apple. Looks like someone recently watched the movie Hackers and wanted to see if that stuff still works. Hint: It still works.

Update Three: I know how it was done now. Confirmed with both the hacker and Apple. It wasn’t password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions. Apple has my Macbook and is trying to recover the data. I’m back in all my accounts that I know I was locked out of. Still trying to figure out where else they were.

Yes, I was hacked. Hard.

Related Stories