How Apple let a hacker remotely wipe an iPhone, iPad, MacBook

Gizmondo ^ | August 5, 2012 | Emil Protalinski

[for-q-clinton]

On Friday, I wrote about how Gizmodo's Twitter account was hacked. It turns out that this was Apple's fault.

Let's take a step back. Over the weekend, it quickly became clear that the bigger story was how the whole thing started. First, former Gizmodo employee Mat Honan's iCloud account was hacked. The hacker then remotely wiped his iPhone, iPad, and MacBook Air, got into his Gmail account, his Twitter account, and finally Gizmodo's Twitter account.

When this came to light, I updated my article with a link to Honan's blog: Emptyage. Once Honan regained access to his iCloud account, he was able to retrace the hacker's steps through password reset emails. With this new Apple tidbit, however, it's worth looking at what Honan found: . . . The fact a hacker was able to access Honan's iCloud account with the help of AppleCare support is very worrying. Remember: the hacker then proceeded to destroy Honan's whole digital life. That's something iCloud users need to be very wary of, and something Apple should address, but knowing Cupertino, it probably won't even comment.

As a journalist, I need to point out Honan currently works for Wired. It's not clear if he was targeted for this reason, but it is clear that his work was affected by this attack. On the flipside, his connections allowed him to get the issue resolved relatively quickly. How long would it have taken for the average Apple user?

[xrmusn]

Last week I was talking to a young lad and asked “let me see your paper for a minute” and he said “Wake up Old Man! Newspapers are no longer hip, here, try my I-Pad”.

Poor fly never knew what hit him.

Guess my aim is good as ever.

[CORedneck]

Pretty scary. Read about it and some social engineering came into the picture.

[TheBattman]

s. He then called Apple armed with this data... and Apple obligingly ignored their own protocols about security questions, and also gave the hacker access.

And the Apple Community forums are filled with gripes and complaints about how Apple wouldn't get them into their accounts without security questions... basically deriding Apple for following protocol and insisting on answers.

I am in no-way condoning the negligent Apple employee (who may very well be a "former" Apple employee now). But they are darned if they do, darned if they don't. Personally - if it comes down to me not being able to access an account or Apple (or Amazon or....) making it so easy to get in that it could be hacked with ease.... I choose make it difficult and give me an alternative way to get back in (send in my computer/iPhone, or go in-person to AppleStore with ID...)

[af_vet_rr]

Pretty scary. Read about it and some social engineering came into the picture.

You remember that Kevin Mitnick kid who was supposed to be the world's greatest hacker? A lot of what he was doing was social engineering or derived from social engineering. If he hadn't been a smooth talker nobody would know who he is, because he would never have gotten as far as he did.

[Not gonna take it anymore]

I see the donate button right now has Reagan on it.

He wouldn’t make it here these days, he would be zotted.

After all he actually believed that half a loaf was better than none. So certainly not pure enough nor conservative enough.

[antiRepublicrat]

iCloud should have been named iNightmare from my perspective.

But it just works so well. I got an email on the Mac from a new business contact. I hovered over the signature block, and Mail offered to make a contact out of it. I did so, and dude was in my contacts (it parsed everything perfectly). Both the computer and my iPhone are hooked to iCloud, so later when I went to call him, the full contact was already there. I could also have the most seamless bookmark syncing out there, but I still use Firefox.

The cloud has also saved me money. I use iTunes match to get songs on my iPhone synced with my computer. So now my 16 GB iPhone has access to my 40+ GB of music (the service even upgraded most of my music to 256 kb). Why buy a 64 GB phone? I burn a new CD or download a new song, and there it is, available on the iPhone.

OTOH, none of this is worth anything to anybody, or more personal than the basic contact list. The most valuable thing is one credit card number, for an account with very limited credit. Now when you start storing very sensitive personal data, or mission-critical enterprise data, then I definitely have problems with the clouds as they are today.

[DoughtyOne]

That sounds good, and I’m sure some folks are making great use out of it.

One of the things that had me second guessing it, was the fee. You were talking 40 gigs of songs. What’s the rate on storing that on the iCloud?

Doesn’t Apple only give you five gigs or so gratis?

I just wasn’t looking for another monthly charge in addition to everything else I’m dinged per month.

Between our cable service and our telephone services, we’re paying out the kazoo each month. All I need is another $20 added on to that.

[Rurudyne]

I simply deactivated use of the ICloud on all my devices as soon as I discovered how it was part and parcel of certain updates.