Slashdot Mirror
Apple Allegedly Knew of iCloud Brute-Force Vulnerability Since March
blottsie writes Apple knew as early as March 2014 of a security hole that left the personal data of iCloud users vulnerable, according to leaked emails between the company and a noted security researcher. In a March 26 email, security researcher Ibrahim Balic tells an Apple official that he's successfully bypassed a security feature designed to prevent "brute-force" attacks. Balic goes on to explain to Apple that he was able to try over 20,000 passwords combinations on any account.
apple really screwed the pooch with celebgate. protecting against brute force attacks is like security 101
Just like all the retail companies with credit card breaches who hit it from the public so it didn't hinder their optimal selling season, Apple did it to protect the launch of their new baby.
Scumbags
Apple certainly didn't do anything wrong.
They take so long to fix.......so many sleepless nights squishing bugs....................</whine>
Has anyone actually shown that this was exploited by anyone?
I live in the U.S. When I go to Check Order Status in my Apple on-line account (store.apple.com), I find hundreds of orders, none of which are mine, coming from all over Western Europe, dating back to July of this year. I see the items ordered, order numbers, mailing and shipping addresses and e-mail information for them all. I can track shipments, but I can't cancel orders.
I can tell you the iPhone 5s is still being order in significant quantities, but the iPhone 6 and 6 Plus orders are vastly greater and roughly equal in number, particularly for bulk orders.
I called Apple about this problem immediately, when I first found out about it, after having received a suspicious e-mail from Apple inquiring about my on-line store experience written in French. After calling two more times and seemingly wasting all of those hours talking with Apple representatives, nothing has changed. More orders just keep showing up in my on-line account. I changed my password right away and already had 2-factor authentication in place. No change. The last Apple rep said they would call me back the next day but never did. There seem to be many layers of escalation and every time I called, the time difference between the U.S. and Europe was claimed to be an impediment. The Apple reps could never see the order information either--I always had to read them examples of order numbers over the phone. A brain-dead support system.
"Balic goes on to explain to Apple that he was able to try over 20,000 passwords combinations on any account."
20,000 is not a brute force attack. That will only succeed if your password was 3 characters long.
I find it hard to believe anyone was actually vulnerable to this.
Well, sir, there's nothing on Earth
Like a genuine, bona-fide
Electrified, six-inch iPhone 6 Plus.
What'd I say?
iPhone 6 Plus!
What's it called?
iPhone 6 Plus!
That's right! iPhone 6 Plus!
iPhone 6 Plus.
iPhone 6 Plus.
iPhone 6 Plus.
I saw those leaks they had me wowed.
We've made some changes to iCloud.
Is there a chance the phone could bend?
Not on your life, my hipster friend.
What about us brain-dead slobs?
You'll just worship Mr. Jobs.
What's the point of that huge bezel?
Just more space for fans to revel.
16 gigs is too little space.
Pay the upcharge to keep pace.
I swear this phone's your only choice,
Throw up your hands and raise your voice.
iPhone 6 Plus!
What's it called?
iPhone 6 Plus!
Once again.
iPhone 6 Plus!
But iOS is still shitty and broken.
Sorry, Slashdot, the mob has spoken.
iPhone 6 Plus!
iPhone 6 Plus!
iPhone 6 Plus!
iPhone 6 Plus!
iPho, d'oh!
The Fappening had nothing to do with brute force attacks and everything to do with security questions answered with publicly available information.
I wish Apple would hire a security expert, and have him/her work directly for Eddy Que.
See
http://www.wired.com/2014/09/eppb-icloud/
Ibrahim Balic is the researcher who in the past claimed to have been responsible for uncovering a flaw that brought down Apple's Dev Center. As it turned out, he uncovered a lesser problem around the time a more significant flaw was exploited. It seems that he is a bit of an attention seeker, so I would take anything that comes from him with a grain of salt.
I can't find the exact links that cover the older story, but here are some related ones:
http://www.cultofmac.com/24151...
http://9to5mac.com/2013/08/20/...
http://venturebeat.com/2013/07...
I was helping someone with their forgotten iCloud password and we tried a few dozen variations. My incorrect guess was that instead of telling me to go to hell that it was playing some odd game such as letting me try passwords by ignoring me to waste my time.
It simply never occurred to me that this was a gianormous security hole staring me in the face. What exactly is happening at Apple, there is Bentgazi, iOS 8 killing iPhone 4s and iPhone 5, iOS 8.0.1 killing iPhone 6, apparently a last minute screen switch away from sapphire, plus many subtle other things such as it doesn't seem like they are using liquid steel in their cases, and the whole U2 spam crap, which it turns out they wrote a massive cheque to U2 for. Then there is the collective yawn over the iWatch. But worst of all is the total lack of a substantially new product in years. Basically the business model at apple has been to steamroll all their older product lines with something mind-boggling. But they seem to have stalled. iPhone sales are awesome but if you look at the history of all of Apples previous products they basically had their day in the sun and then were eclipsed by the latest and greatest apple product. iMacs, iPods, iPod touches, Nanos, iPhones, iPads, and now the iWatch. I think that the iWatch will end up sitting alongside the Apple TV, not eclipsing anything.
How easy is it to lock someone's account and access to all of their data in the cloud, by simply throwing 5 bad logon attempts at their account name? How would you feel if someone were to do that every hour, using a botnet, forcing you to go to an apple store, show your ID and have your finger print scanned just to unlock your account?
Yes, this may be slightly exaggerating the situation, but simply locking someone's account because someone else made 5 attempts to log on to it isn't going to work in practice. You'd be having to deal with oodles of users that got locked out of their stuff and tarpitting only slows the brute force attempts down.
I was promised a flying car. Where is my flying car?
2e4 attempts is pretty good when you are dealing with humans who use real and common words for passwords. Then consider we have hundreds of thousands or millions of accounts (1e6). Then consider my botnet with tens of thousands of computers (2e4). Then we have ~4e14 attempts. That is brute force.
I run denyhosts and have it set to deny IP addresses after _4_ attempts. That stops brute force attacks. 2e4 does not.
NO! The Apple PR team said that this was not caused by a security vulnerability and that it was a targeted attack and that every day users of iCloud have nothing at risk.
Oh, wait. I guess what they said was accurate but basically a bunch of nonsense PR speak.
Given that in most systems allowed characters are number and letters with case sensitivity you only get this far:
alphanumeric:
36^2 = 1296
36^3 = 46656
so you only get 2
case sensitive alphanumeric:
62^2 = 3844
62^2 = 238328 also only 2
Not that it matters because like others say you would use this to do a brute force with a dictionary attack, this is still generally termed as brute force though.
While they have their flagship products (Galaxy S? for Samsung), those vendors also sell multiple different models targeting multiple market segments, so one thing they've got going is that they've got phones at a lot of different price/feature points.
If you're talking about Samsung: NFC, Infrared, water resistance/proof, tap, screen mirroring standards, wireless charging (yes, Apple has NFC too but it's also a year later).
I believe somebody (Song?) was looking into cool tech like 3d/spatial scanning etc.
For features that aren't new but make the phone attractive: user removable battery, SD card slot (so you don't need to buy a new phone to upgrade).
The thing is, Apple was once known for bringing new features that really stood out. The one thing in recent phones I'd say makes the iPhone attractive is the fingerprint-authentication, (though I get similar functionality with a tethered smartwatch). For stuff like NFC, payments, and larger screen sizes they're actually playing catch-up.
The new iOS is actually slower in many cases and certainly no better on batteries, while Android L is set to boost battery life and performance (caveat: may not work on 32-bit phones from my current readings).
a year later?
NFC is in my Galaxy Nexus bought in 2012
Not even directly said in the article, only in the screenshots of the emails: "Same issue consists with other companies too", "found the same issue with Google "
Of course news about a fake are Fake News.
"Banking is protected by law, any lost money will be reimbursed."
The controlling federal laws are the Fair Credit Billing Act (FCBA) and the Electronic Fund Transfer Act (EFTA)( (15 U.S.C. 1693 et seq.). If you report an ATM or debit card missing before someone uses it, the EFTA says you are not responsible for any unauthorized transactions.
However, unlike credit cards, if someone makes unauthorized use of your debit or ATM card and if you do not learn of the transactions and report them after 2 business days but less than 60 calendar days after your statement is sent to you, you are liable for $500. After 60 days, “All the money taken from your ATM/debit card account, and possibly more; for example, money in accounts linked to your debit account.”
http://www.consumer.ftc.gov/ar...
"Cars and houses have insurance."
Yes, but there are deductibles to pay, hundreds if not thousands of dollars before the insurance company begins to reimburse the insured.
Civilians do not understand what /. readers know: internet security is illusory. That's why we have encryption. It's not that they don't have "a bloody clue." They are not computer literate, don't know what an IP address is and couldn't tell you why a denial of service attack is bad.
Civilians have been told the internet is a safe place to buy things, send images by email and store payment data and the like. They believe it. Those people did what are in retrospect foolish things, merely because believed what they were told.
The only way to never see yourself naked on the internet is to never take nude photos. Period. After that, it's just a matter of percentage of chance. Not fair or right, but true.
Pay no attention to the man behind the curtain with all your metadata.
yeah it's good job for hacker, can unlock account icloud to many actrees BOX Office and we can see the picture. if some people can cracking icloud how about another feature from apple?