Slashdot Mirror
Wired Writer Hack Shows Need For Tighter Cloud Security
Nerval's Lobster writes "Between 4:52 and 5:12 on August 3, attackers used Wired writer Mat Honan's Apple ID to wipe his MacBook, before seizing control of his Gmail and other online identities ('My accounts were daisy-chained together,' he wrote in an Aug. 6 postmortem on Wired), and posting a message on Twitter for all to see: 'Clan Vv3 and Phobia hacked this twitter.' In the wake of Honan's high-profile hack, there are some key takeaways. Even if a typical user can't prevent a social-engineering attack on the company hosting their cloud account, they can armor their online life in ways that make attacks more difficult. First, two-factor authentication can prevent an attacker from seizing control of those vital 'hub' accounts (such as Gmail) where users tend to store much of their most vital information. Google offers two-step verification for signing in, as does Facebook. The truly security-conscious can also uncouple their cloud accounts; for example, making sure that iCloud and iTunes use two different sets of credentials. That might rob daily life in the cloud of some of its convenience, but it could also make you a harder target."
Update: 08/08 01:17 GMT by S : This high-profile security breach has had an impact already: Apple has suspended password resets through customer support, and Amazon no longer lets users call in to change account settings.
Have gnu, will travel.
we need a tighter way to detect reposts
did you forget to take your meds?
When I try to turn on two-factor authentication at Google, it gives me a screen that asks me for a phone number, and doesn't seem to have a way to bypass this. I'd rather not give them my phone number.
Their help pages say that you don't have to use SMS-based authentication. Apparently there is a setting, once two-factor authentication is enabled, to switch from receiving the codes via SMS, and instead either write down a batch of 10 "backup codes" at a time, or else install the Google Authenticator app, initialize it with a key, and then use it to generate tie-synchronized codes thereafter. Either of these solutions is fine with me. But how do I enable them without having to give Google my phone number on the initial screen?
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
No, indeed, Gmail for a lot of people is the weakest link because it basically acts as the master key to one's online life.
That said, social engineering is a criminal skill, not a technical one. I've had a couple of friends who were quite serious crooks-- no prospects or skills, but got far by simply being able to blag things. In and out of jail their whole lives -- but then they were operating in the real world, where doing jail time comes with the territory. The Internet however is a free fire zone for scumbags, so the normal rules don't apply.
No "hacker" should call himself such, by simply being able to sweet-talk a minimum wage drone over the phone.
Nothing ever changes in the eternal wheel of IT.
You as a customer are never worth more than the cost of sales of replacing you.
So it has always been in all previous IT fads, so it shall forever be in all future IT fads.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Unfortunately, in this case, at least on the Amazon side, it doesn't look like social engineering. It looks like a classic escalation attack in the same theme as the cuckoo egg: use weak credentials to deposit a payload that can then be used as strong credentials.
While social engineering is pernicious and relies on people violating policy in the name of being helpful or customer service (often without realizing they are doing it!), this is a straight up bug in the CS procedures.
Unfortunately, a similar bug in Apple's CS procedures allowed for further escalation.
Realities just a bunch of bits.
Hey, I have an idea. Let's stop using non-secret information as authentication credentials. Address, birthday, mother's maiden name, last 4 digits of CC or SSN, CVV, childhood pet's name are NOT AUTHENTICATION. Authentication information should never be printed, emailed, or typed in the clear.
Personally, I've been putting random numbers in all those fields for years, and if the account contains sensitive information, recording that information in an encrypted way in the event that it is ever needed. So far, I've never needed such information (because I also record and encrypt my randomly-generated passwords).
Get KeePass and enable two factor authentication. Then, call your bank and CC company and tell them the security on your credit card is absurd. Because who cares how good your Google password is if the guy standing behind you at 7/11 can get all the info he needs to defraud you by holding out his camera-phone while you buy your Gatorade?
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.
Wow did even realize icloud had the ability to Remote wipe my computer.
Currently Turning OFF this feature !
music lover since 1969
It was Apple that coughed up his credentials to the attackers. If Apple hadn't done that, there wouldn't be a problem.
There are some Apple employees that ought to lose their job over this and Apple ought to pay this guy something significant for screwing him over.
Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
The whois was just one way of doing this, I'm sure more than a few people's mailing address can be obtained from a google search (I know mine can, I've had to post too many PDF resumes.)
The problem is Apple and Amazon use knowledge of a mailing address as a credential, in the same way that many silly organizations use knowledge of the last four of your SSN.
Don't blame me, I voted for Baltar.
if you put something valuable on mainframes at other companies (ie the new marketing buzzword "the cloud") then you are accepting the risk. Not worth it IMHO.
Seriously, why is everyone screaming security when it was not a hack but a social engineering entry? And why cry for an idiot who had NO personal backups of his own data? He's an idiot.
When a password reset is requested, a new password is sent to your email address. So, if a hacker gains access to your primary email account, then he has access to ALL of your accounts. (In fact, since email isn't encrypted, he only has to be able to intercept the password-reset message somewhere in transit.)
Email is the weakest link on the internet.
No "hacker" should call himself such, by simply being able to sweet-talk a minimum wage drone over the phone.
You're being pedantic and glorifying the term 'hacker' way too much.
http://en.wikipedia.org/wiki/Kevin_mitnick - this guy is usually referred to as a hacker, even though sweet talking minimum wage drones over the phone was his bread and butter. I get that you want to distinguish between the technologically adept and inept, using the terms 'hacker' and 'script kiddie' to do so, but the article is using the term 'hacker' in a legal sense; as in someone who commits crimes almost exclusively through the use of technology. My dad referred to himself as a hacker but he never committed a crime using his computer/phone. He just meant that he liked to hack out code.
Joe can be a man's name. Joe can be a cup of coffee. Joe can be a member of the armed services. Basically, you're arguing that your cup of coffee shouldn't be called Joe because that's your name.
"From the depths of my skeptical and rationalist soul, I ask the Lord to protect me from California touchie-feeliedom."
The attacker can just turn it on again.
Why is this modded insightful? You can't "just turn on" remote wipe, er, remotely. You have to enable it on the machine first, and you need an administrator account to enable it on the machine.
It doesn't surprise me in the least that clouds are not secure. I mean they are fluffy white things in the sky made mostly from water vapour. How can something like that be secure! Though they are someone intangible, and pretty hard to reach without some sort of assistance from earth. But hell birds can access them, birds! Do you think anything that birds can access is really secure?
Birds, the sky hackers!
Also Apple tech support sucks (believe me, I used to know some), and don't use the same password for everything...
Well I'm off, gotta go change my Apple passwords, see ya! :)