Slashdot Mirror
Does Apple Need To Get Serious About Security?
An anonymous reader writes "An article at The Verge makes the case that Apple's development of its cloud services hasn't been accompanied by the necessary effort to ramp up security to match users' increasing levels of risk. As evidence, they use a recent (and very simple) security hole that allowed anyone to reset an Apple ID password with just a user's email address and birth date. Apple's initial response failed to fully stop the exploit, and then it took several days for them to fix the issue. 'A server-side attack on Apple's cloud could get customers' credit card numbers and addresses, device backups with their encryption keys — as well as contacts and Apple IDs — anonymously and in bulk. Those systems may be defended like a castle, but bandits have plenty of places to chip away at private information at the periphery: intercepting wireless location data, cracking the still-private protocols for services like FaceTime or iMessage, or imitating iTunes updates to install to take over a user's phone. There's nothing sexy about securing these systems. None of them contribute directly to Apple's bottom line. And when it came to securing a business netting it an estimated $2 billion each year, Apple locked the screen door and left the front door open, without asking anyone else to check that the house was safe.' The article also points out that many other cloud service providers have detailed privacy and security policies, and actively participate in developing best practices, whereas Apple's procedures are shrouded in the company's typical secrecy. The article comes alongside reports of a way for people to DDoS other users' iMessage box."
Apple needs to get serious at the moment that it's customers care or at the moment someone put's legal liability on them and not a minute earlier. Given that the effect of Paris Hilton's phone getting hacked was to vastly increase the sales of the model, I don't think that's going to happen some time soon.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
So, this starts out with a question: "Does Apple Need To Get Serious About Security?"
Then proceeds to give evidence that they should.
So, I'll answer the question with "Nah! They're doing fine!" just to be Troll.
Next !!
the effect of Paris Hilton's phone getting hacked was to vastly increase the sales of the model
I think that was more down to accidental celebrity endorsement than any security vulnerability.
So, I'll answer the question with "Nah! They're doing fine!" just to be Troll.
Its more likely going to move the discussion onto redefining the word troll.
I worked for them until recently, and I can say people walk around (in my area) talking about the impervious OS X, and I chuckle.
I honestly don't think Apple has taken security as seriously as say, Microsoft.
But this is one persons experience and I was seriously disillusioned after working for them, but that's more likely a result of my initial naïveté.
Without Jobs fascism Apple is another corporation that will quickly slide into suck, here's hoping you got out above 600.
"If any question why we died, Tell them because our fathers lied."
compared to everyone else?
that journalist was one case. the article mentioned a lot of scary things, but no one has done any of it yet. and some of these services have been around for almost 2 years.
the famed incident was more of a social engineering hack than anything else. Which, lets be fair, you can have the best security in the world, but humans are the biggest weaknesses in any real system.
Security is a constantly evolving game - people are constantly developing exploits. Could Apple be better? Everyone can. Are they bad? I don't think they are horrible.
Hell, how many people don't even have PIN screens setup on their phone. Most people just don't care at all.
Of course it was. But the fact that "Paris Hilton uses it" meant immensely more to most people than "she got owned because it was absurdly easy to hack" demonstrates security is not something that matters at all to most of Apple's customers, and thus is not something that Apple feels a need to matter to them.
No! not in the slightest. People who *admire* Paris Hilton...definitely not "most"(sic) or even some, but that select group of people who are swayed by her. I suspect it actually did a lot of harm, as many of that select group, who I would not be astonished would have given iPhones by Apple as (cough) gifts, as those people love exposure, but only the type they manage. I suspect those people have ditched those phones now.
Every single one of these "possible attacks" exists in nothing more than the submitters mind.
"bandits have plenty of places to chip away at private information at the periphery: intercepting wireless location data, cracking the still-private protocols for services like FaceTime or iMessage, or imitating iTunes updates to install to take over a user's phone"
None of these things are possible. FaceTime and iMessage are encrypted end-to-end. iTunes updates are signed. If you want to know how they work, buy a fucking disassembler. Until then, don't spout off bullshit, it just makes you sound like an ignoramus.
"Anybody could access ... with just AppleID and date of birth" is not true. You needed someone's AppleID, date of birth, _and_ the knowledge of a clever hack. As a reaction, Apple first shut down the site, then fixed the problem.
The "social engineering hack" won't work anymore once you switch your AppleID to two factor authentication. The disadvantage is that if you lose two of (password, backup code, trusted device), Apple _cannot_ restore your account. It becomes unusable. The reason social engineering won't work is that even a proven genuine account owner cannot get help.
Paris Hilton was a spokesperson for Danger's HipTop (Sidekick on T-Mobile). That was the phone that got hacked. And her endorsement of the phone was well known prior to the hacking. They had huge Hollywood parties and she appeared in public using the phone regularly.
Apple wasn't involved.
Can we stop with the mentioning of DDOS and security in the same breath as if they were related?
Seriously, don't use iOS for anything requiring real security.
I hate those FTFY posts, but in this case I believe it's called for:
Don't use a phone of any kind for anything requiring real security.
Apple will be irrelevant soon.
I hate being bipolar; it's awesome!
How would you measure? How would you compare?
How many exploits have existed in the wild?
It's something you can look at for desktops and mobile platforms.
The password reset issue was bad, but Apple did the right thing there and clamped shut the vulnerable page until the issue was fixed.
Meanwhile in a world where Apple is supposedly leaving people exposed, we get daily trojans on Android that can exploit SMS directly.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I finally started running virus detection on my Macs. There are just too many exploits around in the real world to take a chance. Apple no longer promotes the lies that they're "Secure by Design" And, as seen a PWN2OWN each year, the Macs are usually hacked first!
Of course they don't need to get serious about security! They're RICH, bitches! They don't care now! They got their money and it'd be a scary scary CHANGE for their customers to switch to something else! Wooooooo! Suck it, world! They're the gods now!
I really mean this - not intended to be flamebait. Without Jobs, Apple's grasp of the perfect user experience will give way to engineers' insistence of packing on new features. The products will become harder and more cumbersome to use, and the premium Apple charges for the perfect user experience will be shunned by the market. And then they will be toast.
I hate being bipolar; it's awesome!
with the expansion of the sales of Apple operating systems I fear that the security of these devices is really at risk of virus attacks. I am surprised that there are thousands of articles on the internet regarding cyberattacks Machintos systems, but there is no news by the Silicon Valley .... http://www.tipografialeone.net/
http://www.tipografialeone.net