This link has been bookmarked by 137 people . It was first bookmarked on 07 Aug 2012, by someone privately.
-
10 Mar 14
-
28 Feb 14
-
10 Feb 14
-
Password-based security mechanisms — which can be cracked, reset, and socially engineered — no longer suffice in the era of cloud computing.
-
-
30 Jan 14
-
swizzmagikalvia Google Plus RSS Feed for 104220454233112666748 http://grss.magentariver.com/feed?gid=104220454233112666748
-
29 Jan 14
-
27 Jan 14
-
09 May 13
-
24 Mar 13
-
But what happened to me exposes vital security flaws in several customer service systems, most notably Apple’s and Amazon’s. Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.
-
Moreover, if your computers aren’t already cloud-connected devices, they will be soon. Apple is working hard to get all of its customers to use iCloud. Google’s entire operating system is cloud-based. And Windows 8, the most cloud-centric operating system yet, will hit desktops by the tens of millions in the coming year. My experience leads me to believe that cloud-based systems need fundamentally different security measures. Password-based security mechanisms — which can be cracked, reset, and socially engineered — no longer suffice in the era of cloud computing.
-
By now, I knew something was very, very wrong. For the first time it occurred to me that I was being hacked. Unsure of exactly what was happening, I unplugged my router and cable modem, turned off the Mac Mini we use as an entertainment center, grabbed my wife’s phone, and called AppleCare, the company’s tech support service, and spoke with a rep for the next hour and a half.
It wasn’t the first call they had had that day about my account. In fact, I later found out that a call had been placed just a little more than a half an hour before my own. But the Apple rep didn’t bother to tell me about the first call concerning my account, despite the 90 minutes I spent on the phone with tech support. Nor would Apple tech support ever tell me about the first call voluntarily — it only shared this information after I asked about it. And I only knew about the first call because a hacker told me he had made the call himself.
-
t 4:33 p.m., according to Apple’s tech support records, someone called AppleCare claiming to be me. Apple says the caller reported that he couldn’t get into his Me.com e-mail — which, of course was my Me.com e-mail.
In response, Apple issued a temporary password. It did this despite the caller’s inability to answer security questions I had set up. And it did this after the hacker supplied only two pieces of information that anyone with an internet connection and a phone can discover.
At 4:50 p.m., a password reset confirmation arrived in my inbox. I don’t really use my me.com e-mail, and rarely check it. But even if I did, I might not have noticed the message because the hackers immediately sent it to the trash. They then were able to follow the link in that e-mail to permanently reset my AppleID password.
At 4:52 p.m., a Gmail password recovery e-mail arrived in my me.com mailbox. Two minutes later, another e-mail arrived notifying me that my Google account password had changed.
At 5:02 p.m., they reset my Twitter password. At 5:00 they used iCloud’s “Find My” tool to remotely wipe my iPhone. At 5:01 they remotely wiped my iPad. At 5:05 they remotely wiped my MacBook. Around this same time, they deleted my Google account. At 5:10, I placed the call to AppleCare. At 5:12 the attackers posted a message to my account on Twitter taking credit for the hack.
-
By wiping my MacBook and deleting my Google account, they now not only had the ability to control my account, but were able to prevent me from regaining access. And crazily, in ways that I don’t and never will understand, those deletions were just collateral damage. My MacBook data — including those irreplaceable pictures of my family, of my child’s first year and relatives who have now passed from this life — weren’t the target. Nor were the eight years of messages in my Gmail account. The target was always Twitter. My MacBook data was torched simply to prevent me fr
-
k in.
-
om getting bac
-
I spent an hour and a half talking to AppleCare. One of the reasons it took me so long to get anything resolved with Apple during my initial phone call was because I couldn’t answer the security questions it had on file for me. It turned out there’s a good reason for that. Perhaps an hour or so into the call, the Apple representative on the line said “Mr. Herman, I….”
“Wait. What did you call me?”
“Mr. Herman?”
“My name is Honan.”
Apple had been looking at the wrong account all along. Because of that, I couldn’t answer my security questions. And because of that, it asked me an alternate set of questions that it said would let tech support let me into my me.com account: a billing address and the last four digits of my credit card. (Of course, when I gave them those, it was no use, because tech support had misheard my last name.)
-
Apple tech support confirmed to me twice over the weekend that all you need to access someone’s AppleID is the associated e-mail address, a credit card number, the billing address, and the last four digits of a credit card on file. I was v
-
about this. During my second tech support call to AppleCare, the representative confirmed this t
-
o me. “That’s really all you have to have to verify something with us,” he said.
-
We talked to Apple directly about its security policy, and company spokesperson Natalie Kerris told Wired, “Apple takes customer privacy seriously and requires multiple forms of verification before resetting an Apple ID password. In this particular case, the customer’s data was compromised by a person who had acquired personal information about the customer. In addition, we found that our own internal policies were not followed completely. We are reviewing all of our processes for resetting account passwords to ensure our customers’ data is protected.”
-
On Monday, Wired tried to verify the hackers’ access technique by performing it on a different account. We were successful. This means, ultimately, all you need in addition to someone’s e-mail address are those two easily acquired pieces of information: a billing address and the last four digits of a credit card on file. Here’s the story of how the hackers got them.
-
-
08 Feb 13
-
In the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID account was broken into, and my hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBook.
-
My experience leads me to believe that cloud-based systems need fundamentally different security measures. Password-based security mechanisms — which can be cracked, reset, and socially engineered — no longer suffice in the era of cloud computing.
-
This means, ultimately, all you need in addition to someone’s e-mail address are those two easily acquired pieces of information: a billing address and the last four digits of a credit card on file.
-
-
05 Dec 12
-
13 Oct 12
Dennis CallahanMust-read for anyone on a Mac or anyone on a cloud. Holy hard drive batman! http://t.co/gqqvSFLw
-
27 Sep 12
-
03 Sep 12
-
02 Sep 12
-
30 Aug 12
-
28 Aug 12
-
21 Aug 12
-
19 Aug 12
-
18 Aug 12
-
17 Aug 12
-
14 Aug 12
-
Had I used two-factor authentication for my Google account, it’s possible that none of this would have happened
-
regularly backing up the data on my MacBook
-
In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification.
-
This isn’t just my problem.
-
Password-based security mechanisms — which can be cracked, reset, and socially engineered — no longer suffice in the era of cloud computing.
-
At 4:33 p.m., according to Apple’s tech support records, someone called AppleCare claiming to be me. Apple says the caller reported that he couldn’t get into his Me.com e-mail — which, of course was my Me.com e-mail.
In response, Apple issued a temporary password. It did this despite the caller’s inability to answer security questions I had set up. And it did this after the hacker supplied only two pieces of information that anyone with an internet connection and a phone can discover.
-
-
13 Aug 12
-
Richard FanningMake sure that you protect yourself from hackers. Here is one person's experience that allowed a hacker to access his Amazon and Apple accounts. This can be pretty scary stuff.
-
11 Aug 12
-
10 Aug 12
-
09 Aug 12
-
Kevin ChangHow Apple and Amazon Security Flaws Led to My Epic Hacking | Gadget Lab | Wired.com
-
-
Phil SmithA billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account
Windows 8, the most cloud-centric operating system yet -
08 Aug 12
GoharyHow Apple and Amazon Security Flaws Led to My Epic Hacking | Gadget Lab | http://t.co/ntSCgJfP http://t.co/uX4mcZVQ
-
John Lowelluse two-factor authentication for Gmail #security How Apple and Amazon Security Flaws Led to My Epic Hacking http://t.co/VapevYr5
-
-
How Apple and Amazon Security Flaws Led to My Epic Hacking
-
-
07 Aug 12
Thabo MophiringHow Apple and Amazon Security Flaws Led to @Mat's Epic Hacking. This story is very, very scary. http://t.co/lcQEgOxq
-
briancroxallIn the wake of @mat's experiences http://t.co/0FJKBf8z , here are some ways to tighten security of your digital id: http://t.co/Zjtri3bG
-
Janelle BeitzIf you haven't yet read this horrifying account of a catastrophic hack, do. Now. #impersonation http://t.co/l7NIYFCF
-
Donna PapacostaRT @amysept: Security flaws from #Amazon and (especially) #Apple led to epic hacking http://t.co/Gk8NX5LS << If you haven't read ...
-
Oliver QuinlanAfter reading about Matt Honan's epic identity theft yesterday just spent some time securing all my accounts http://t.co/FsKwTTJK
-
-
First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID account was broken into, and my hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBook.
-
Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification.
-
Moreover, if your computers aren’t already cloud-connected devices, they will be soon. Apple is working hard to get all of its customers to use iCloud. Google’s entire operating system is cloud-based. And Windows 8, the most cloud-centric operating system yet, will hit desktops by the tens of millions in the coming year.
-
Password-based security mechanisms — which can be cracked, reset, and socially engineered — no longer suffice in the era of cloud computing.
-
But the Apple rep didn’t bother to tell me about the first call concerning my account, despite the 90 minutes I spent on the phone with tech support. Nor would Apple tech support ever tell me about the first call voluntarily — it only shared this information after I asked about it. And I only knew about the first call because a hacker told me he had made the call himself.
-
By wiping my MacBook and deleting my Google account, they now not only had the ability to control my account, but were able to prevent me from regaining access. And crazily, in ways that I don’t and never will understand, those deletions were just collateral damage. My MacBook data — including those irreplaceable pictures of my family, of my child’s first year and relatives who have now passed from this life — weren’t the target. Nor were the eight years of messages in my Gmail account. The target was always Twitter. My MacBook data was torched simply to prevent me from getting back in.
-
It turns out, a billing address and the last four digits of a credit card number are the only two pieces of information anyone needs to get into your iCloud account. Once supplied, Apple will issue a temporary password, and that password grants access to iCloud.
-
Apple tech support confirmed to me twice over the weekend that all you need to access someone’s AppleID is the associated e-mail address, a credit card number, the billing address, and the last four digits of a credit card on file. I was very clear about this. During my second tech support call to AppleCare, the representative confirmed this to me. “That’s really all you have to have to verify something with us,” he said.
-
-
-
year’s worth of photos, covering the entire lifespan of my daughter, or documents and e-mails that I had stored in no other location.
-
-
Damien Van Achter"n the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID account was broken into, and my hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBo"
-
Stanley FrielickRT @morville: Change your passwords folks... http://t.co/R2a8aTX8
-
-
Yoon Soo LimGot an Amazon account or an Apple ID? Read this. RT @Mat Or to put it another way, PANIC AND FREAK OUT http://t.co/AbLmvGAW
-
Philipp CordesRT @newsyc100: How Apple and Amazon Security Flaws Led to My Epic Hacking http://t.co/qfLoq2cG (http://t.co/VnQ4fIqo) #trending
-
-
But what happened to me exposes vital security flaws in several customer service systems, most notably Apple’s and Amazon’s. Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.
-
Page Comments
http://ultimatepowerprofits.com/pioneerpowerprofits
http://www.facebook.com/ultimateglobalmarketing?ref=ts
http://www.youtube.com/watch?v=etKFAnohJAw
Would you like to comment?
Join Diigo for a free account, or sign in if you are already a member.