Apple iCloud Security Incident, (Tue, Sep 2nd)

There’s lots of interest in the recent iCloud incident, where apparently several “celebrity” accounts were compromised.

Sorry to say, it’s not a rumour.  It’s also something that could and should have been prevented.  It turns out that the API for the “Find My iPhone” app did not have protections against brute force attacks.

This, combined with the first couple hundred lines of a common password dictionary (often downloaded as the filename  “500 worst passwords”) resulted in some targeted accounts being compromised.  And of course once an account password is successfully guessed, all iCloud data for that account is available to the attackers.  So no rocket science, no uber hacking skills.  Just one exposed attack surface, basic coding skills and some persistence.

Having gone through that password file, you really wonder how much folks using any of those passwords valued their data in the first place.

Apple quickly fixed the vulnerability, so it is no longer in play (unless your account was compromised prior to the mitigation and you haven’t changed your password).  The code is on github if you are interested.

This just reinforces the common theme that – to put it mildly – trusting personal data to simple passwords is not recommended.  If you can’t use complex passwords (for me, that’s greater than 15 characters) or don’t have a second factor, then don’t use the service.

Rob VandenBrink

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.