Apple Suspends Over-the-Phone AppleID Password Resets

http://www.wired.com/gadgetlab/2012/08/apple-icloud-password-freeze/

by derpenxyne • 14 years ago

130 55 14 years ago

X-Istence• 14 years ago

"After Epic Hack [...]".

Sorry, not that epic. Yes, multiple steps were required but the biggest issue in security once again was the human element.

Epic would be finding the flaws in SSL/TLS that allows you to generate a valid cert for any domain (Moxie Marlinspike) or a bug in DNS that is such cause for concern that people have to upgrade their infrastructure (Dan Kaminsky) or intercepting GSM calls (Chris Paget) while making the device believe it is on a legitimate network.

This hack came down to social engineering and using flaws in two companies verification systems. That isn't epic. People have been calling companies and people on the phone for decades and having them hand over information without proper identification/verification. The guys stuff got remote erased, well damn, the system worked as it was supposed to work ... other than that the right person wasn't at the controls ... remote wipe worked as expected.

Yes, changes have to be made, and yes security and verification of identity has to be made more secure when there is a lot at stake, but this hack was by no means epic.

Xyzodiac• 14 years ago

Agreed, epic is a definite overstatement.

InclinedPlane• 14 years ago

I think the title "Epic Hack" is justified. Not epic in terms of the skills and technologies used to pull it off but epic in terms of the impact on the hackee. Whether you gain access to someone's apartment by rappelling from the roof, disabling the electronic alarm system, and picking the lock on the balcony door or merely by using social engineering on the building supervisor the result is the same.

I think that denigrating the significance of these "low sophistication" attacks is fundamentally the same error as venerating the importance of single-points of technological complexity independent of the end-to-end security of a system. It makes it easier to change the response from "oh crap, we got hacked so hard!" to "well, we just got socially engineered, ANYBODY can do that, no big deal". Social engineering is going to remain firmly in the "epic hack" category for the foreseeable future, even in a future age of quantum computers, synthetic consciousness, and ubiquitous use of one-time-pad encryption.

niels_olson• 14 years ago

Agreed. When Katrina came ashore, it was technically down to a category 2. Should I be less concerned? No, more.

notJim• 14 years ago

I think the description of it as epic refers to the amount and nature of the damage done, not the technical accomplishment. We expect that someone might be able to hack our online accounts, but that they could hack our online accounts and then use that to reach into our homes to nuke data off of our hard drives is different.

taligent2• 14 years ago

Remember that you have to explicitly enable this feature.

Remote wipe is NOT enabled by default.

stcredzero• 14 years ago

> This hack came down to social engineering and using flaws in two companies verification systems. That isn't epic.

Epic status is irrelevant. It was effective. It should not be. Full stop.

vm• 14 years ago

Wired mentions Apple 46 times in the article (including twice in the title)... and Amazon 3 times. In fact, most of the public and HN outrage about this incident has been directed at Apple.

That's the downside of Apple being so close to perfect. We expect perfection from them at all times. And when they make a mistake, it seems 100x more outrageous than if it were any other company.

Don't get me wrong, they made a terrible mistake in this case, but Amazon has gotten off lightly in comparison.

dman• 14 years ago

Afaik amazon didnt run ads pointing out how insecure their competitors were -

http://www.youtube.com/watch?v=GQb_Q8WRL_g

http://www.youtube.com/watch?NR=1&feature=endscreen&...

The downside to selling people on the idea that your platform is secure and infallible is that people will hold you up to it.

shadesandcolour2• 14 years ago

I'm sorry I thought that you were going to link to ads where Apple touts the security of it's iCloud platforms and its over the phone support service. Claiming to be immune to viruses that ran on windows and claming to be secure against social engineering are two very different things. The first poster is correct, Amazon needed less information to do things over the phone than Apple did. All Amazon wanted was your billing address and they would let you add emails to the accounts and then who knows what you could do. Both companies are at fault here.

pserwylo• 14 years ago

Don't get me wrong, I agree with your sentiment. However, I think in this case, it is about the fact that the stakes were much higher with the iCloud account.

Yes, I would be very annoyed if an account which had personal information, a history of purchases, and was linked to my credit got hacked (e.g. by social engineering). However, I would be even more annoyed if my laptop and phone got remote-wiped due to the same type of hacking.

But to be honest, I haven't been following the story that closely, so I am happy to be proven wrong on the perceived difference between the social engineering of Amazon vs Apple support .

cdcarter• 14 years ago

The stakes are higher on iCloud for this user, but not someone who has their business on AWS still connected to a personal Amazon account.

suresk• 14 years ago

The bulk of the damage was done as a result of the breach in Apple's security - all the Amazon breach did was give the attacker the last 4 digits of a card, which is not super private anyway. It isn't 100% fair - and to be clear, processes at both companies were pretty poor - but I don't think people are out to get Apple here.

And, while Apple is very good, they are nowhere near perfect - especially when it comes to online services. Apple fans playing the victim card for them is just as tiring as people jumping all over them when they slip up.

Kerrick• 14 years ago

> all the Amazon breach did was give the attacker the last 4 digits of a card, which is not super private anyway.

Precisely. Go to any mall, restaurant, or shopping center in the U.S. and you're bound to find at least one discarded receipt with the last four digits of the shopper's credit card number on it, possibly with their name and/or signature.

jmillikin• 14 years ago

People expect security measures to be correlated to potential damage. Articles are focusing on Apple because they exhibited the largest gap between expected and actual security measures.

Using nearly-public information, the attacker was able to convince a human to grant access to the victim's account, and therefore to destroy the victim's data.

If the compromise of an iCloud account had merely given the attacker access to the @me.com address, I don't think Apple would be receiving nearly as much bad press. Email accounts are compromised all the time, usually with no more damage than some spam mail sent to friends.

Similarly, if the attacker had gained remote-wipe ability by some elaborate deception, customers would be more willing to cut Apple a break. Suppose Apple accepted passports as a recovery mechanism, and the attacker showed up to an Apple store in person with a forged US passport. That would sell a lot of newspapers, sure, but Apple would be blameless.

PsyGeek• 14 years ago

This is such a great point. Deceiving others to obtain certain information could have happened anywhere. The fact that Apple is recognized on such a large scale would most certainly make a situation like this get blown way out of proportion. I doubt this would make headlines to the same degree this has if it was a smaller less-known organization. These kinds of attacks on victims like Honan happen all the time, but why do we only hear about it the most when it involves a large reputable company.

trontron• 14 years ago

The article was also about apples policy change. The corresponding article about amazons policy change (1) had 14 mentions of amazon and 3 mentions of apple. (1): http://www.wired.com/gadgetlab/2012/08/amazon-changes-policy...

eli• 14 years ago

The last 4 digits of your credit card are not really meant to be secret. They typically printed on every receipt for anything you buy.

Your Apple cloud password, however, is supposed to be secret.

csmeder• 14 years ago

Did you read the full article? Didn't you notice how the attacker got the last 4 digits?

### Amazon actually gave the attacker full control of the Amazon account. ###

All the attacker had to do was simply call amazon and ask to add a new credit card, the only verification was billing address. The attacker called back in 5 mins asking to change the email account on file, which required the last 4 digits of the fake card just added. The attacker then did a password reset.

Basically, most people don't realize Amazon had a HUGE GAPING wide whole in their security. Any attacker could steal any ones Amazon account! These are accounts that have thousands of dollars of affilate money, AWS servers running major web sites, credit cards on file, etc.

So yes, the fact that Amazon gave the last 4 digits out isn't a big deal, you are right. These numbers are printed on receipts. However, the fact that they gave the whole account away is a big deal.

willfulwizard• 14 years ago

> In an earlier attempt on Tuesday to change an AppleID password (which is the same password used to log into iCloud and iTunes), Apple customer service offered up a different response, saying that passwords could only be changed over the phone if we were able to supply a serial number for a device linked to the AppleID in question — for example, an iPhone, iPad or MacBook computer.

Adding (or worse, substituting) a serial number helps, but seems insecure in the event of a lost/stolen phone. A device serial number, plus all the already mentioned info: name, address, last 4 characters of a credit card, are all reasonably easy to extract from a stolen phone. Would be nice if some piece of info not usually stored on a phone were required. I suppose that a lost phone is already a security breach, but any containment would be an improvement.

ryannielsen2• 14 years ago

On many Apple devices, the only way to access the serial is to actually log into the device and open Settings or About this Mac. If the attacker's able to do that then – in the majority of cases – they likely already have access to your mail and probably many other accounts as well. At that point, it's pretty much game over for you; containment's impossible.

(Two big loopholes on the Mac side are guest accounts and the recovery partition. Both of those offer ways to get your machine's serial number which do not require the attacker to log into your account.)

lloeki• 14 years ago

The serial is engraved/printed on the case of my Macbook Pro and iPhone 4.

jsz0• 14 years ago

Does Apple do in-store password resets? I'm thinking with their retail presence this would be a good solution. If you want your password reset come into the store with a photo-ID and the physical credit card on your account. Doesn't get much better than that. I realize not everyone has an Apple Store nearby but many do.

majormajor• 14 years ago

"I realize not everyone has an Apple Store nearby but many do."

That could be a handy additional service to offer, but they'd still have to provide a non-in-store method for all the people who don't, so it wouldn't be any more secure.

Kadrith• 14 years ago

Facetime?

josteink• 14 years ago

If your solution to a technical problem is an Apple store, you have been drinking too much juice.

7952• 14 years ago

Whenever you do a password reset their is a possibility that it was performed by an attacker. However much you check their identity this will always be a risk. Therefore it makes sense for Apple to try and contact the user via several different methods. Call them on the phone, send a letter etc to inform them of the password reset. It must originate from apple, and be out of band. Having people go to the apple store does not achieve this.

craz• 14 years ago

I think having to re-enable remote wipe on each device after a password reset would be a reasonable compromise.

lparry• 14 years ago

I also find it strange this isn't the case. I changed my apple password and instantly my phone started complaining that it was wrong for iMessage and other services. Why is it still fine to remote wipe the device?

Zenst• 14 years ago

Would be nice if they offered the option to remote encrypt and you can only decrypt with a visit to a Apple store. But nomatter what you offer, there will always be a way to offer a little more.

Your approach does leae users open to there own hindsight and if you lost a device you might in some situations reset the password first and then thing about remotely wiping the device and in those situations you will be a bit erked. That said it would be nice to at least have that option, options are nice as they allow the user to pick the level of control they want, more options more choice. Still be nice if a device being remote wiped checked its location and went - oi hang on your at home I need to verify this first, scary but doable.

aufreak32• 14 years ago

I see no reason not to use a password manager (ex: keychain on macos) to keep different usernames and passwords for each account. It is very little overhead (at least with keychain).

And yes I mean different user names even if it is required to be a valid email id. If you use gmail, you can use "yourid+RandomNumberOrAnything@gmail.com" as the email address. This is additional protection against remote hackers since guessing the account name of one account doesn't get you the names of accounts on other services.

And yes ABSOLUTELY NO reason to not have 2 factor auth for your google account.

shadesandcolour2• 14 years ago

You didn't really read the article about what happened did you? It didn't really come down to the email address especially since part of it was concealed. This came down to both companies letting you do things over the phone with minimal personal information.

aufreak32• 14 years ago

This is merely things that I practice that I think may be useful to some. I did read the full article and not just this one all the others including Matt Cuts post on 2fa. The companies are to blame, yes, but the "victim" is also responsible to some extent. "Only the paranoid survive." (I think that's by Andy Grove).

Honan owned up to not backing up, for example. Would it have been an "epic hack" if he could restore up to date data because he had a time machine backup?

xentronium• 14 years ago

Please, take your time to understand what happened before blaming the victim.

yalogin• 14 years ago

Interestingly Google will not get into this situation because they do not offer over the phone support. That is the advantage of being a free service I guess! People do not expect customer service beyond a point.

Of course they offer two factor authentication.

sigkill3• 14 years ago

Google have their own problems with Youtube's aggressive Content ID system and pulling down of public domain NASA videos on the grounds of (wtf?) copyright infringement.

nileshtrivedi• 14 years ago

Wouldn't it be much better if video calls (or Facetime) became ubiquitous (and mandated for auth)? The mere fact that the attacker needs to show his face for getting the password reset should improve things a lot because it would make detection as well as post-facto investigation much easier.

Apple Suspends Over-the-Phone AppleID Password Resets

Related Stories