Wired Writer Hack Shows Need For Tighter Cloud Security

← Back to Stories (view on slashdot.org)

Wired Writer Hack Shows Need For Tighter Cloud Security

Posted by timothy on Tuesday August 7, 2012 @02:57AM from the internet-I-think-they-mean dept.

Nerval's Lobster writes "Between 4:52 and 5:12 on August 3, attackers used Wired writer Mat Honan's Apple ID to wipe his MacBook, before seizing control of his Gmail and other online identities ('My accounts were daisy-chained together,' he wrote in an Aug. 6 postmortem on Wired), and posting a message on Twitter for all to see: 'Clan Vv3 and Phobia hacked this twitter.' In the wake of Honan's high-profile hack, there are some key takeaways. Even if a typical user can't prevent a social-engineering attack on the company hosting their cloud account, they can armor their online life in ways that make attacks more difficult. First, two-factor authentication can prevent an attacker from seizing control of those vital 'hub' accounts (such as Gmail) where users tend to store much of their most vital information. Google offers two-step verification for signing in, as does Facebook. The truly security-conscious can also uncouple their cloud accounts; for example, making sure that iCloud and iTunes use two different sets of credentials. That might rob daily life in the cloud of some of its convenience, but it could also make you a harder target." Update: 08/08 01:17 GMT by S : This high-profile security breach has had an impact already: Apple has suspended password resets through customer support, and Amazon no longer lets users call in to change account settings.

91 of 132 comments (clear)

Min score:

Reason:

Sort:

So much for ... by PPH · 2012-08-07 02:59 · Score: 5, Insightful

... single log on across the 'Net.

--
Have gnu, will travel.
1. Re:So much for ... by fuzzyfuzzyfungus · 2012-08-07 03:02 · Score: 1
  
  Apparently, the 'single sign-on' of the future will be practically any trivially available biographical information...
2. Re:So much for ... by Hatta · 2012-08-07 03:50 · Score: 2
  
  Single sign on vs multiple sign on is irrelevant when the attacker gets control of your main PC where all your credentials are.
  
  --
  Give me Classic Slashdot or give me death!
3. Re:So much for ... by sexconker · 2012-08-07 04:23 · Score: 3, Interesting
  
  Single sign on vs multiple sign on is irrelevant when the attacker gets control of your main PC where all your credentials are.
  No one got control over his PC in this case.
  And why would anyone store credentials on their PC?
4. Re:So much for ... by Anonymous Coward · 2012-08-07 04:31 · Score: 1
  
  I've known full tier 3 system admins (aka: Sr Sys Admins) store plain text passwords on their desktop in txt files labled "god_servername.txt".
  There is also a huge amount of admins that keep password safe like programs on their local machines instead of in a "safe" location.
5. Re:So much for ... by Hatta · 2012-08-07 04:33 · Score: 1
  
  Oh, I figured they used his Apple ID to log into his Macbook, where they could harvest the rest of his credentials. But instead, he gave all his log in info to Apple who gave it to the attacker. Duh.
  Something like SSH agent would have easily prevented this attack.
  
  --
  Give me Classic Slashdot or give me death!
6. Re:So much for ... by Anonymous Coward · 2012-08-07 04:49 · Score: 1
  
  Storing plaintext passwords in a text or KeePass database can be decently secure... provided they are stored on something with reliable security.
  I personally like a TC volume on an IronKey [1]. This provides two layers, and in addition, some anti-brute force capability since the IronKey will zap itself after ten failed attempts.
  [1]: They are now sold by Imation. I hope the new models keep the security features of the old ones before the changeover.
7. Re:So much for ... by macshome · 2012-08-07 05:10 · Score: 1
  
  How would SSH agent help here? They used social engineering at Amazon to get common account info, then further used social engineering to get the password reset on his Apple ID.
  
  Once they had his Apple ID they logged into the iCloud service and issued remote wipes on all his devices that he had activated the wipe option on. Since he used the same credentials everywhere they were able to get into Twitter and Google as well.
  
  As for loosing all his data, he should have had a backup. Apple makes this super easy on iOS using iCloud and on OS X using Time Machine.
8. Re:So much for ... by icebike · 2012-08-07 05:13 · Score: 2, Insightful
  
  Exactly.
  As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keys
  were stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing over
  access to his account, and once one password was known, the hacker could log in everywhere.
  What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Apple would do such a thing. Yet Social Engineering is one of the primary methods of spectacular security breaches.
  Still one has to ask, why this guy was chosen as a target. I suspect the attacker had just that little piece of inside knowledge that gave him just enough to nudge the Apple tech over the brink.
  
  --
  Sig Battery depleted. Reverting to safe mode.
9. Re:So much for ... by Hatta · 2012-08-07 05:28 · Score: 2
  
  How would SSH agent help here?
  People use the same credentials on multiple web sites for convenience. Something like SSH agent could provide the same convenience, while allowing people to have different keys for different systems AND keeping all those keys in one secure place.
  
  --
  Give me Classic Slashdot or give me death!
10. Re:So much for ... by sexconker · 2012-08-07 05:49 · Score: 1
  
  Exactly.
  As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keys
  were stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing over
  access to his account, and once one password was known, the hacker could log in everywhere.
  What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Apple would do such a thing. Yet Social Engineering is one of the primary methods of spectacular security breaches.
  Still one has to ask, why this guy was chosen as a target. I suspect the attacker had just that little piece of inside knowledge that gave him just enough to nudge the Apple tech over the brink.
  He was chosen as a target because he had a 3-character twitter account name that the attacker wanted.
11. Re:So much for ... by macshome · 2012-08-07 05:50 · Score: 1
  
  Sure, for things that can use ssh keys it works great. This is how I connect to various git servers.
  
  But in the case of this hack the services that were compromised were Amazon, Gmail, and iCloud web pages. All things that authenticate with user/password and not SSH keys.
12. Re:So much for ... by Hatta · 2012-08-07 05:55 · Score: 1
  
  That's why I say "something like SSH agent". There's no technical reason we can't have a web based authentication mechanism that works the same way SSH agent does. Getting such a standard widely implemented would be the hard part.
  
  --
  Give me Classic Slashdot or give me death!
13. Re:So much for ... by tchuladdiass · 2012-08-07 06:58 · Score: 4, Interesting
  
  For those that don't know how ssh-agent works:
  You have two parts to your key, one part encrypts only (public key) and the other part decrypts only (private key). The remote server sends a random message encrypted with the public key; that message is sent to the ssh-agent program, which decrypts the message with your private key which it has in memory. This decrypted message is sent back to the remote server -- if it matches what it randomly generated, it know that your are in possession of the private half of the key and lets you in. The secure part is that your private key is never sent over the wire, and never leaves the memory of the ssh-agent program (unlike a regular password).
  Now one thing I've done in the past to make this more secure (when I carried a Nokia N900 linux-based phone) is I ran the agent on my phone only, and forwarded the connection to my PC via Bluetooth. I had it set up so that it would auto pair with PCs that I trusted (and play a particular sound on the pone during pairing and key usage), and require an accept button on the phone for other machines. I've been meaning to pick up Android programming so that I could port this over to my current phone. Oh, and when the agent program gets started on the phone, it requires a symmetric decryption key (protects it if the phone is stolen). Probably security overkill, but in my case I used it more for convenience than anything else.
14. Re:So much for ... by Anonymous Coward · 2012-08-07 07:39 · Score: 1
  
  What? No, his passwords weren't the same. His email *addresses* followed a recognizable template, i.e. mhonan@whatever.com, and his password-recovery addresses were daisy-chained so that when they got into his Apple ID, they could reset his GMail, which could reset his Twitter.
  +5 Insightful my ass. RTFA, it's long and detailed:
  http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/
15. Re:So much for ... by Jerslan · 2012-08-07 08:18 · Score: 1
  
  In OS X and iOS this is called the Keychain. It already exists as an encrypted database that you can only get into with the password you put on it. Ideally this is something other than your login password, but most people probably don't think about it and use the same one anyways.
  
  So for them to get at the private keys and/or stored passwords he must have used the same password for both login and the Keychain...
  
  He should also look into FileVault... Even if Apple resets the login password, they don't have the decrypt password for the account or the master decrypt password (set by the primary user or an admin when setting up FileVault the first time). Prior to Lion FileVault stored your user directory as an encrypted volume that would be "unlocked" and mounted at login. If the password is reset, none of that data loads (causing some errors) and only giving the attacker access to system level resources. From Lion on, FileVault2 has been Whole-Disk Encryption which is even better.... Can't decrypt the drive contents if you don't have the password. Apple Support isn't ever supposed to ask for, know, or give out those kinds of things, so you're safe from a Social Engineering attack on your personal system.
16. Re:So much for ... by kaws · 2012-08-07 16:46 · Score: 1
  
  False, from my experience with at least reseting a password through the itunes side, you are required to give 3 bits of information not counting your apple id. I don't know if it's different for icloud but I'm planning on checking soon. Remote-wipe is a part of find my mac which includes remote wiping.
17. Re:So much for ... by itsme1234 · 2012-08-08 05:01 · Score: 1
  
  Where else would you store them? In your head?
18. Re:So much for ... by milkmage · 2012-08-08 13:07 · Score: 1
  
  SSH? over the phone? for social engineering? enlighten me.
  http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/all/
  "Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information."
But first.. by js3 · 2012-08-07 03:01 · Score: 5, Insightful

we need a tighter way to detect reposts

--
did you forget to take your meds?
1. Re:But first.. by Anonymous Coward · 2012-08-07 03:30 · Score: 1
  
  What? The previous article was about Gizmodo editor Matt Honans. This is about Wired writer Mat Honan. Obviously two completely different people.
2. Re:But first.. by paiute · 2012-08-07 04:05 · Score: 2
  
  What? The previous article was about Gizmodo editor Matt Honans. This is about Wired writer Mat Honan. Obviously two completely different people.
  He's not fooling anyone.
  
  --
  If Slashdot were chemistry it would look like this:Cadaverine
3. Re:But first.. by ColdWetDog · 2012-08-07 04:13 · Score: 1
  
  Maybe his psychiatrist.
  
  --
  Faster! Faster! Faster would be better!
4. Re:But first.. by thePowerOfGrayskull · 2012-08-07 04:36 · Score: 1
  
  That would've been funnier if you'd said "Wired write Mat Herman".
is there a way to turn it on without a phone #? by Trepidity · 2012-08-07 03:03 · Score: 2, Informative

When I try to turn on two-factor authentication at Google, it gives me a screen that asks me for a phone number, and doesn't seem to have a way to bypass this. I'd rather not give them my phone number.
Their help pages say that you don't have to use SMS-based authentication. Apparently there is a setting, once two-factor authentication is enabled, to switch from receiving the codes via SMS, and instead either write down a batch of 10 "backup codes" at a time, or else install the Google Authenticator app, initialize it with a key, and then use it to generate tie-synchronized codes thereafter. Either of these solutions is fine with me. But how do I enable them without having to give Google my phone number on the initial screen?

--
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
1. Re:is there a way to turn it on without a phone #? by fuzzyfuzzyfungus · 2012-08-07 03:08 · Score: 4, Insightful
  
  Well, for 20-ish dollars you can set yourself up with a burner prepaid phone and a very meagre SMS allotment...
  Aside from that, though, I suspect that Team Google wants your convenient personal identifier for totally altruistic security reasons...
2. Re:is there a way to turn it on without a phone #? by Terrasque · 2012-08-07 03:18 · Score: 1
  
  As far as I could tell, they don't verify the number. I had no problems setting it to a landline instead of my mobile phone.
  When I last configured it I got the "10 burn codes" and an option for a phone number, where a robot would dial and read up some numbers.
  So app on my phone, plus that piece of paper hidden away, plus a stable landline to someone I trust.
  
  --
  It's The Golden Rule: "He who has the gold makes the rules."
3. Re:is there a way to turn it on without a phone #? by 0100010001010011 · 2012-08-07 03:42 · Score: 4, Informative
  
  You have to have a phone to set it up. You can then disable the phone and re-enable it with:
  > Mobile application
  > Switch to an app to get codes even when you don't have cell coverage.
  And then remove your phone #. So at minimum it's going to cost you a burner phone.
  The awesome thing about Google Authenticator is that it's open source. You can download and compile a PAM package (and it's in the Debian repositories). http://code.google.com/p/google-authenticator/ So anything that uses PAM can use google authenticator.
  I have it setup on my outward facing SSH server so to get into my house's server you're going to need my password and one of my devices.
4. Re:is there a way to turn it on without a phone #? by dell623 · 2012-08-07 04:29 · Score: 4, Insightful
  
  You have something important enough (maybe email) on Google that you want 2-step authentication, and you're concerned about them having your phone number? What exactly are you afraid they can do with it? (I get the point of not wanting other information online)
5. Re:is there a way to turn it on without a phone #? by travisco_nabisco · 2012-08-07 04:30 · Score: 1
  
  Be sure to turn on two-factor authentication on the second secondary email as well. Maybe you can use your main email as a place to receive the authentication code.
6. Re:is there a way to turn it on without a phone #? by oakgrove · 2012-08-07 04:42 · Score: 1
  
  This is precisely what I was wondering. If anything I want to establish more of a personal relationship with whichever cloud provider I throw my lot in with. On the off chance that Google abuses the personal contact information then you cut them off and blog to the heavens about it. I guarantee you the internet will eat it up and blog ads will more than pay for the pain and misery you suffered.
  
  --
  The soylentnews experiment has been a dismal failure.
7. Re:is there a way to turn it on without a phone #? by icebike · 2012-08-07 05:36 · Score: 2
  
  You don't have to give them YOUR phone number, nor does the phone have to be able to receive SMS.
  Google will use a computer voice to read the digits to you. This number does not need to be your permanent number.
  You just need ANY phone number that you can answer.
  You will need it exactly twice.
  Once to set things up on your computer.
  Then again to get the Google Authentication app authorized. From then on you don't need to give them your phone number.
  
  --
  Sig Battery depleted. Reverting to safe mode.
8. Re:is there a way to turn it on without a phone #? by icebike · 2012-08-07 05:41 · Score: 2
  
  Sign up for a google voice (or voip or something) account?
  Maybe with a different password.
  Second point in the FAQ:
  Why you shouldn’t use Google Voice to receive verification codes
  
  If you use Google Voice to receive verification codes, you can easily create a situation where you’ve locked yourself out of your account.
  For example, if you are signed out of your Google Voice app, you might need a verification code to get back in. However, you won’t be able to receive this verification code because it will be sent to your Google Voice, which you can’t access.
  
  --
  Sig Battery depleted. Reverting to safe mode.
9. Re:is there a way to turn it on without a phone #? by icebike · 2012-08-07 05:48 · Score: 1
  
  There is no reason to turn on two factor authentication for some secondary email, or even use a Gmail account for this.
  You get non-descript messages with some digits in this email, and they are use-once codes. You can paste them on the bulletin board after you use them and nobody could use them again.
  Once you get the Google Authentication app on your phone, you need never use this again.
  Lose your phone?
  
  --
  Sig Battery depleted. Reverting to safe mode.
10. Re:is there a way to turn it on without a phone #? by stormguard2099 · 2012-08-07 08:52 · Score: 1
  
  I think Google says it all in their description of their 2-factor authentication
  
  2-step verification drastically reduces the chances of having the personal information in your Google account stolen by someone else
  
  Emphasis mine but yeah, straight from their site
  
  --
  http://greenobyl.com/ please.... think of the children!!
Pissants by benjfowler · 2012-08-07 03:08 · Score: 1

I'm sure there's people out there who are saying 'ooooh hacker skills', in that somebody managed to hack this guy's mail account (or snag his password). Bunch of amateur script kiddies who'd otherwise be huffing hair spray and smashing up bus shelters.
1. Re:Pissants by benjfowler · 2012-08-07 03:18 · Score: 2
  
  No, indeed, Gmail for a lot of people is the weakest link because it basically acts as the master key to one's online life.
  That said, social engineering is a criminal skill, not a technical one. I've had a couple of friends who were quite serious crooks-- no prospects or skills, but got far by simply being able to blag things. In and out of jail their whole lives -- but then they were operating in the real world, where doing jail time comes with the territory. The Internet however is a free fire zone for scumbags, so the normal rules don't apply.
  No "hacker" should call himself such, by simply being able to sweet-talk a minimum wage drone over the phone.
2. Re:Pissants by GryMor · 2012-08-07 03:33 · Score: 4, Informative
  
  Unfortunately, in this case, at least on the Amazon side, it doesn't look like social engineering. It looks like a classic escalation attack in the same theme as the cuckoo egg: use weak credentials to deposit a payload that can then be used as strong credentials.
  While social engineering is pernicious and relies on people violating policy in the name of being helpful or customer service (often without realizing they are doing it!), this is a straight up bug in the CS procedures.
  Unfortunately, a similar bug in Apple's CS procedures allowed for further escalation.
  
  --
  Realities just a bunch of bits.
3. Re:Pissants by Lumpy · 2012-08-07 04:04 · Score: 1
  
  "That said, social engineering is a criminal skill, not a technical one."
  I know a LOT of sales people and Lawyers that will seriously disagree with you.
  Sales = Social engineering.
  Lawyering = Social Engineering.
  
  --
  Do not look at laser with remaining good eye.
4. Re:Pissants by RazorSharp · 2012-08-07 05:29 · Score: 4, Interesting
  
  No "hacker" should call himself such, by simply being able to sweet-talk a minimum wage drone over the phone.
  You're being pedantic and glorifying the term 'hacker' way too much.
  http://en.wikipedia.org/wiki/Kevin_mitnick - this guy is usually referred to as a hacker, even though sweet talking minimum wage drones over the phone was his bread and butter. I get that you want to distinguish between the technologically adept and inept, using the terms 'hacker' and 'script kiddie' to do so, but the article is using the term 'hacker' in a legal sense; as in someone who commits crimes almost exclusively through the use of technology. My dad referred to himself as a hacker but he never committed a crime using his computer/phone. He just meant that he liked to hack out code.
  Joe can be a man's name. Joe can be a cup of coffee. Joe can be a member of the armed services. Basically, you're arguing that your cup of coffee shouldn't be called Joe because that's your name.
  
  --
  "From the depths of my skeptical and rationalist soul, I ask the Lord to protect me from California touchie-feeliedom."
5. Re:Pissants by icebike · 2012-08-07 06:00 · Score: 1
  
  "That said, social engineering is a criminal skill, not a technical one."
  I know a LOT of sales people and Lawyers that will seriously disagree with you.
  Sales = Social engineering.
  Lawyering = Social Engineering.
  You must be a politician, otherwise you would have had politicians at the top of your list.
  
  --
  Sig Battery depleted. Reverting to safe mode.
6. Re:Pissants by Lumpy · 2012-08-07 13:31 · Score: 1
  
  No, politics is just plain old bold faced lying until you believe your own wild stories, if you are lucky you sucker others along with you. It's a completely different thing.
  I think the technical term for it is disillusionment.
  
  --
  Do not look at laser with remaining good eye.
the cloud would have made it more secure by alen · 2012-08-07 03:12 · Score: 1, Interesting

hackers grab his info from whois because he has a personal site from blogging
they use that to hack his amazon account
and then use the info from amazon to hack icloud
if he had just used wordpress or blogger or some other cloud service this hack would have been A LOT harder. it's 2012, no need to reinvent the wheel by setting up your own server for email, web site photo sharing or the 20 other things that da cloud has made easier and more secure. he just wanted to be uber tech cool and show off how he can run his own site and waste time managing it instead of letting someone else do it
1. Re:the cloud would have made it more secure by iluvcapra · 2012-08-07 03:51 · Score: 2
  
  Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
  The whois was just one way of doing this, I'm sure more than a few people's mailing address can be obtained from a google search (I know mine can, I've had to post too many PDF resumes.)
  The problem is Apple and Amazon use knowledge of a mailing address as a credential, in the same way that many silly organizations use knowledge of the last four of your SSN.
  
  --
  Don't blame me, I voted for Baltar.
2. Re:the cloud would have made it more secure by bingoUV · 2012-08-07 20:10 · Score: 1
  
  Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
  Having a "helpful" customer service which disregards security best practices when it is "convinced" of a genuine need is also a nice thing. Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.
  And yes, we can't have nice things. "Having nice things" is the enemy of security, and even privacy. What is wrong in saying we can't have nice things? (Except that it is obvious.)
  
  --
  Bingo Dictionary - Pragmatist, n. A myopic idealist.
3. Re:the cloud would have made it more secure by iluvcapra · 2012-08-08 04:38 · Score: 1
  
  Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.
  Note that a residential address is not just something you post on Facebook, but something that exists in the yellow pages, on Google, and any number of direct mail, marketing, government, and tax databases -- it is public information which, by design, must be distributed to people holding any level trust, and is specifically not administered by the owner. Proposing that residential mailing addresses should be confidential or proprietary to the owner is completely unworkable, just as expecting social security numbers or the last four digits of your credit card should be confidential is unworkable. This isn't in the interest of having nice things, they're fundamental to state authority, society and commerce.
  The whole point is that being able to publicly distribute your address shouldn't be a "nice thing," it should be standard operating procedure, and not an exception reserved for people who can afford security guards. It was for hundreds of years and I see no compelling reason to change that, certainly not on account of the laziness of Apple or Amazon.
  
  --
  Don't blame me, I voted for Baltar.
4. Re:the cloud would have made it more secure by bingoUV · 2012-08-08 07:20 · Score: 1
  
  It is useless to stick to publically posting residential address point. It becomes dangerous only in conjunction with associating it with facebook profile and publically posting one's vacation plans on facebook.
  No one is advocating keeping one's residential address private. But advertizing it along with other information becomes dangerous as is well studied.
  
  --
  Bingo Dictionary - Pragmatist, n. A myopic idealist.
Nothing ever changes in IT by vlm · 2012-08-07 03:23 · Score: 2

Nothing ever changes in the eternal wheel of IT.
You as a customer are never worth more than the cost of sales of replacing you.
So it has always been in all previous IT fads, so it shall forever be in all future IT fads.

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Non-authoritative authentication by mcelrath · 2012-08-07 03:41 · Score: 5, Insightful

Hey, I have an idea. Let's stop using non-secret information as authentication credentials. Address, birthday, mother's maiden name, last 4 digits of CC or SSN, CVV, childhood pet's name are NOT AUTHENTICATION. Authentication information should never be printed, emailed, or typed in the clear.
Personally, I've been putting random numbers in all those fields for years, and if the account contains sensitive information, recording that information in an encrypted way in the event that it is ever needed. So far, I've never needed such information (because I also record and encrypt my randomly-generated passwords).
Get KeePass and enable two factor authentication. Then, call your bank and CC company and tell them the security on your credit card is absurd. Because who cares how good your Google password is if the guy standing behind you at 7/11 can get all the info he needs to defraud you by holding out his camera-phone while you buy your Gatorade?

--
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
1. Re:Non-authoritative authentication by null+etc. · 2012-08-07 04:29 · Score: 3, Interesting
  
  Nothing annoys me more than "security" questions. First, so many sites share the "secret" answer that it's really not secret, is it? Second, I'd prefer to not make vulnerable even yet more personally identifying information. Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!
2. Re:Non-authoritative authentication by Anonymous Coward · 2012-08-07 04:30 · Score: 1
  
  You forgot "What High School did you attend?"
  (Short list of answers: Washington, Jefferson, Adams, Lincoln, Wasilla...)
3. Re:Non-authoritative authentication by Archangel+Michael · 2012-08-07 05:12 · Score: 1
  
  Authentication is not the same as proof of identity. Authentication is not ID, nor is ID Authentication.
  But how does one PROVE who they are? In order to PROVE you are who you are, you need a chain of trusted Identification.
  1) Peter Knows Mary, Peter can ID Mary. But is Peter is not Trusted (yet)
  2) Paul ALSO knows Mary. Paul can also ID Mary, and Paul is trusted.
  3) Jane, Sue and Michael all know Mary. They all can ID Mary, but offer various levels of trust.
  In each of these scenarios ID can be established provided if we have enough "trust" secured. 1) Not enough, 2) Maybe Enough, 3) Probably Enough.
  THIS is how authentication should work. It is NON trivial for computers and hackers to breach. It is harder than even two factor authentication. Stolen Phone and bam you have two factor authentication done. You cannot steal people (not easily) and you probably cannot steal enough people to make this work.
  I rather doubt that any level of COMPUTER authentication is going to be secure in the long run.
  
  --
  Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
4. Re:Non-authoritative authentication by mcelrath · 2012-08-07 06:28 · Score: 1
  
  For 99% of internet applications, authentication is sufficient. Google, Apple, or any vendor doesn't need to know who I am, and they damn well don't need to link that info to my bank or tax records. It's none of their damn business. I don't want to identify myself.
  All that is required is to identify that the person making the request is the same one that established the account. Pure authentication, no identification. We've all done ourselves a major disservice by muddling the two. Of course, Google and Facebook love it. Their profit model is based on selling identifying data.
  So I very strongly disagree with your claim that authentication should work by using identification. ID isn't necessary. In fact we'd be a lot safer if the two were totally decoupled. Then one compromised account could not lead to escalating compromises (unless you're foolish enough to use the same authentication credentials in multiple places -- or have chosen to let your identification be your authentication).
  
  --
  1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
5. Re:Non-authoritative authentication by mcelrath · 2012-08-07 07:02 · Score: 1
  
  I first drove my car in YKXz93W4MSGVn93z. You know it, it's 120 miles south of KrnummZF82cB5XXn. At least with these kinds of text entry fields, they're not going to require me to use one letter, one number, 2 forms of punctuation (but not an ampersand or dash!) and put a max length limit on the stupid thing.
  
  --
  1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
6. Re:Non-authoritative authentication by godel_56 · 2012-08-07 11:51 · Score: 1
  
  Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!
  "This is your brain on drugs"
7. Re:Non-authoritative authentication by Archangel+Michael · 2012-08-08 04:05 · Score: 1
  
  Trust is not linear. Identity is.
  Trust is a scale -10 ... 0 ... +10
  Identity is a scale 0 ... +10
  When you meet someone new, you start at 0 on both scales, completely neutral. What I propose is building identity through trusts (positive).
  I know Paul, Paul is a liar. You know Paul, you don't know anything except what I've told you. Do you trust me?
  Peter, Jane and Mary all claim to know me, and all say I'm a liar. They also say Paul is a good guy. Do you trust me? Do you trust them?
  Michael, Greg, Steven and Jill all claim to know me, and say I don't lie, I'm just mistaken by Peter, Jane and Mary. Do you trust me? Do you trust them?
  But you realize, what I've done? I've established (within this example) my identity, but not my trust level.
  
  --
  Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
8. Re:Non-authoritative authentication by mcelrath · 2012-08-08 04:43 · Score: 1
  
  I don't see your point. What does that have to do with TFA? And why would I ever want to identify myself on the internet? As far as I'm concerned, there are two entities that need identity: banks and the government. All others don't need it, and induce liability, crime, and fraud by retaining identity information. With fraudulent identity information, one can perpetrate new fraudulent transactions with third parties unrelated to the source of the leaked identity information. With fraudulent authentication information, you can only perpetrate fraud to the extent that the authentication allows (e.g. a slightly better auth-only system would have allowed TFA's access to google, but not Amazon or Apple). What an online business might want is to authenticate that you are the same person that performed some transaction. e.g. so you can change shipping address, customer service request, etc. Still doesn't require identity. If those authentication credentials are lost/stolen, everyone currently falls back on identity (as if they actually had a secure means to identify and trust you). That's why these social engineering attacks fall back on identity -- it's easier to fake. Never in any transaction is any measure of "trust" actually established. In most contexts, both authentication credentials and identifying information can be stolen (though it is not technically necessary for this to be the case with strong encryption and a web of trust -- as you point out). So I contend there is never any trust in the cryptographic sense, and we are all fools for trusting insecure authentication and identification protocols. We shouldn't have to do that. These little "secret bits of information" used for identification are not actually secret.
  
  --
  1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
9. Re:Non-authoritative authentication by null+etc. · 2012-08-09 06:49 · Score: 1
  
  Yes, it's a drug called "old age". I highly advise that you stay away from it.
Find My Mac / Fuckup My Mac by djdavetrouble · 2012-08-07 03:42 · Score: 3, Funny

Wow did even realize icloud had the ability to Remote wipe my computer.
Currently Turning OFF this feature !

--
music lover since 1969
1. Re:Find My Mac / Fuckup My Mac by Anonymous Coward · 2012-08-07 04:04 · Score: 4, Insightful
  
  The attacker can just turn it on again.
Apple by busyqth · 2012-08-07 03:50 · Score: 5, Interesting

It was Apple that coughed up his credentials to the attackers. If Apple hadn't done that, there wouldn't be a problem.
There are some Apple employees that ought to lose their job over this and Apple ought to pay this guy something significant for screwing him over.
1. Re:Apple by Dragonslicer · 2012-08-07 04:27 · Score: 3, Interesting
  
  There are some Apple employees that ought to lose their job over this...
  It shouldn't be the support person that answered the phone, though. Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.
2. Re:Apple by rmstar · 2012-08-07 04:43 · Score: 2
  
  Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.
  It happens to make sense. It is so much more likely that such a call comes from a genuine customer in distress than from a hacker that, from a risk management point of view, that procedure is much better than telling a genuine customer "you should have been more careful, now you are hosed". Welcome to the real world.
  Perhaps they should require a different subset of digits from the credit card number. The last four is a rather weak choice.
3. Re:Apple by sFurbo · 2012-08-07 04:55 · Score: 2
  
  The first eight are not random*, so if the last four is out, only number 9-12 are left.
  
  *In fact, for any one type of card from any one Danish bank, the first 8 are identical.
4. Re:Apple by Anonymous Coward · 2012-08-07 05:27 · Score: 4, Insightful
  
  What procedure would you suggest to tell the genuine customer that they just gave away your account and all your information you thought was properly backed up is now deleted?
5. Re:Apple by icebike · 2012-08-07 05:28 · Score: 3, Insightful
  
  Wait, why would any credit card digits and an address be sufficient?
  You hand that over every time you buy something.
  Why would apple bypass their own security questions and open the account to someone who can't remember any of those?
  Seriously who forgets their Mother's maiden name or their first pets name?
  
  --
  Sig Battery depleted. Reverting to safe mode.
6. Re:Apple by icebike · 2012-08-07 05:30 · Score: 1
  
  Customer in distress?
  Forgot their mother's name?
  Come on! If you are that distressed, why do you need access to your apple account? Call 911, not Apple.
  
  --
  Sig Battery depleted. Reverting to safe mode.
7. Re:Apple by Dragonslicer · 2012-08-07 05:52 · Score: 1
  
  I didn't say it was a good policy. In fact, I'm completely in favor of firing the people that came up with it. If the support person confirmed all of the information that Apple's policy requires, then the fault should go to the people that set the policy, not the support person that followed it.
8. Re:Apple by tompaulco · 2012-08-07 06:33 · Score: 1
  
  Perhaps they should require a different subset of digits from the credit card number. The last four is a rather weak choice.
  Better than the first four.
  
  --
  If you are not allowed to question your government then the government has answered your question.
9. Re:Apple by dbitter1 · 2012-08-07 06:35 · Score: 1
  
  Seriously who forgets their Mother's maiden name or their first pets name?
  Any idiot that actually replaces a high-security password with a low security, common knowledge item like MMN I hope to $diety never works as any type of admin in IT. I would assume anyone that thinks about it names their pets with a high-security name (like MD0km2!#nm1, or correct-horse-battery-staple if you prefer that style).
  
  --
  For us carnivores, "Sucking the marrow out of life" isn't a transcendentalist philosophy but a practical instruction.
10. Re:Apple by dgatwood · 2012-08-07 07:30 · Score: 1
  I just choose random words and phrases that have nothing to do with the original question. For example:
  
  Best friend's first name: Ontario, Canada.
  Place where your mother was born: Sam Donaldson.
  And so on.
  --
  Check out my sci-fi/humor trilogy at PatriotsBooks.
11. Re:Apple by gstrickler · 2012-08-07 08:32 · Score: 1
  
  Only the fist 6 and last 1 are "not random". The first 6 are the ISO number (formerly the BIN - Bank Identification Number) and are assigned to the card issuer, and the last is a check digit calculated from the full card number excluding the last digit. However, the last 4 are commonly printed on receipts, so they're not exactly "secret". But on a 16 digit number, that leaves digits 7-12 as relatively unknown (unless you have the full card number).
  
  --
  make imaginary.friends COUNT=100 VISIBLE=false
12. Re:Apple by sFurbo · 2012-08-07 18:31 · Score: 1
  
  Not for Danish cards. Here, the first 4 are country and card type, the next 4 are the bank registration number. I would think this was the case for all non-American cards, but I could very well be wrong.
no one will care for your data like you do by Dan667 · 2012-08-07 03:52 · Score: 2

if you put something valuable on mainframes at other companies (ie the new marketing buzzword "the cloud") then you are accepting the risk. Not worth it IMHO.
Yet another post on this idiot? by retech · 2012-08-07 03:53 · Score: 3, Informative

Seriously, why is everyone screaming security when it was not a hack but a social engineering entry? And why cry for an idiot who had NO personal backups of his own data? He's an idiot.
1. Re:Yet another post on this idiot? by Krneki · 2012-08-07 04:10 · Score: 1
  
  Yap and idiot. Having insecure passwords over multiple different services is moronic at best. The fact that he has no backup when using cloud services is priceless and I bet he didn't even encrypt the data before putting it on an unknown server. P.S: WTF is daisy-chained, saved passwords or same password across different accounts? Use your passwords wisely and never let the OS save them if they are for important services, yes it takes more typing to access the mail, but this is what you do to be secure.
  
  --
  Love many, trust a few, do harm to none.
2. Re:Yet another post on this idiot? by dell623 · 2012-08-07 04:33 · Score: 4, Interesting
  
  Because he's not the only idiot. You would be surprised how many tech savvy people have no backups and are equally vulnerable. Also it's something worth highlighting as it has shown critical flaws in bot Amazon and Apple's authentication systems. And it persuaded me to go ahead and set up 2-step authentication on Google, and I am damn glad I did.
3. Re:Yet another post on this idiot? by Anonymous Coward · 2012-08-07 05:07 · Score: 1
  
  I find that people complaining about the backup habits of other users are typically the ones with no solid backup plans themselves. Of course, I can't say if this is true in your case. You're correct in your assertion that he should've had backups, however.
  Social engineering has everything to do with security, by the way. If you're vulnerable to social engineering (either via lack of proper security policies or a failure in training of personnel that have access to sensitive data), your security is compromised. The need for security does not end at securing software services.
Email is the weakest link by Anonymous Coward · 2012-08-07 03:55 · Score: 3, Informative

When a password reset is requested, a new password is sent to your email address. So, if a hacker gains access to your primary email account, then he has access to ALL of your accounts. (In fact, since email isn't encrypted, he only has to be able to intercept the password-reset message somewhere in transit.)
Email is the weakest link on the internet.
1. Re:Email is the weakest link by gander666 · 2012-08-07 05:17 · Score: 2
  
  Email is the weakest link on the internet.
  This. I am amazed by the professionals in information handling who genuinely answer that Email is fine for exchanging sensitive information. I heard a hospital IT manager honestly answer that he thought that email of patient record via PDF was fine. Sigh.
  
  --
  Suppose you were an idiot and suppose you were a member of Congress ... but I repeat myself. - Mark T
2. Re:Email is the weakest link by Vairon · 2012-08-07 05:46 · Score: 1
  
  It is no longer entirely true that e-mail is not encrypted. Many SMTP servers support encryption using SSL or TLS when communicating with another SMTP server. For example here is an example of an SMTP server receiving an e-mail from one of Google's gmail SMTP servers.
  Aug 7 13:33:28 x postfix/smtpd[22642]: setting up TLS connection from mail-gh0-f182.google.com[209.85.160.182]
  Aug 7 13:33:28 x postfix/smtpd[22642]: Anonymous TLS connection established from mail-gh0-f182.google.com[209.85.160.182]: TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)
  I believe this behavior is defined by RFC 3207
  If you manage a Postfix SMTP server and have not enabled TLS support I would suggest you read
  http://www.postfix.org/TLS_README.html
Amazon screwed up and enabled Apple screwup. by Anonymous Coward · 2012-08-07 04:14 · Score: 1

So, the Apple intrusion would not have happened if Amazon had not facilitated the recovery of this guy's credit card details.
If Amazon had not allowed the addition of a credit card number OVER THE PHONE and had not reset the password OVER THE PHONE all would have been ok.
Both Apple and Amazon should have required email confirmation before resetting passwords.
Re:Defending in Depth? Or Eggs in All Baskets? by KhabaLox · 2012-08-07 05:00 · Score: 1

I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone? What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?

--
Ceci n'est pas un sig.
Gee, not only is there no privacy on the web by mikein08 · 2012-08-07 05:17 · Score: 1

there's no security either!! But we've all known this for a very long time, now haven't we??? And you're going to entrust your persoal data to "the cloud"???
Why insightful? by Anonymous Coward · 2012-08-07 05:41 · Score: 2, Insightful

The attacker can just turn it on again.
Why is this modded insightful? You can't "just turn on" remote wipe, er, remotely. You have to enable it on the machine first, and you need an administrator account to enable it on the machine.
Re:Defending in Depth? Or Eggs in All Baskets? by michaelwigle · 2012-08-07 06:08 · Score: 1

I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone?
Yes..

What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?
... and yes (if by mobile app you mean log on to the web site). You could, of course, also have a mobile version of Firefox with Lastpass so there is no danger of keylogging your Lastpass sign-in.
2-step authentication from google is sub-par. by Eldragon · 2012-08-07 06:26 · Score: 1

2-step authentication from Google still requires a cell phone. For anyone who does not own a cell phone (such as myself), it is major hurdle to upgrading the security on my account.
It is a shame google does not sell SecurID or similar key fobs for those who want security, but don't have a cell phone.
1. Re:2-step authentication from google is sub-par. by RebelWebmaster · 2012-08-07 07:10 · Score: 1
  
  Last time I checked, you can use a landline too.
Clouds! by DarthVain · 2012-08-07 06:38 · Score: 2

It doesn't surprise me in the least that clouds are not secure. I mean they are fluffy white things in the sky made mostly from water vapour. How can something like that be secure! Though they are someone intangible, and pretty hard to reach without some sort of assistance from earth. But hell birds can access them, birds! Do you think anything that birds can access is really secure?
Birds, the sky hackers!
Also Apple tech support sucks (believe me, I used to know some), and don't use the same password for everything...
Well I'm off, gotta go change my Apple passwords, see ya! :)
Here we go again by Ol+Olsoc · 2012-08-07 14:33 · Score: 1

The people reporting data loss or other problems on the cloud
The people with the excuses on why the cloud isn't at fault, how it's always the fault of the users.
Cloudbois?

--
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
he's not a writer for Wired by milkmage · 2012-08-08 13:15 · Score: 1

He writes for Gizmodo.
I asked him why. Was I targeted specifically? Was this just to get to Gizmodo’s Twitter account? No, Phobia said they hadn’t even been aware that my account was linked to Gizmodo’s, that the Gizmodo linkage was just gravy. He said the hack was simply a grab for my three-character Twitter handle. That’s all they wanted. They just wanted to take it, and fuck shit up, and watch it burn. It wasn’t personal.