Apple, Amazon's Weak Security Allows Huge Hack of Gizmodo Reporter
August 7, 2012 12:28 PM
comment(s) - last by
Circumventing the writer's password proved easy thanks to some help from Apple
According to Kaspersky Labs, Apple, Inc. (
ten years behind Microsoft
) in security. Mat Honan, a former
editor and senior
reporter found that out the hard way when a hacker took over the official
Twitter feed and Mr. Honan's other accounts to spew foul racist and offensive messages onto the internet.
The culprit was a combination of Apple and Amazon.com, Inc.'s (
) security procedures. Like many journalists, Mr. Honan was a fan of Apple's popular gadgets. And like many he shopped on Amazon. But that popular commerce portal, Amazon, combined with those Apple gadgets'
ubiquitous online interface -- iCloud
-- proved the key to the unfortunate intrusion. The real Mat Honan writes, "[The hacker] got in via Apple tech support and some clever social engineering that let them bypass security questions. "
Via the iCloud (*.mac) email account, the hackers gained access to his Gmail and Twitter via common password recovery interfaces. They also locked him out of his iCloud account, changing his password.
By hacking Apple's iCloud and Amazon's commerce portal, a malicious user gained access to an award-winning journalist's accounts. [Image Source: 9 to 5 Mac]
At first Mr. Honan suspected his "7 digit alphanumeric" was cracked, given its shorter length. However, he was puzzled because "I didn’t use elsewhere."
In the chaos that ensued Mr. Honan saw his MacBook Air, iPhone, and iPad remote wiped -- a glaring dark-side of these features that were designed to
Apple users. The "Genius Bar" is currently working with him to see what data is recoverable, and in the meant time he's managed to re-secure his accounts.
Aside from the newsworthiness of such a high profile, award-winning tech journalist being victimized by a malicious hacker, the story of Mr. Honan's misfortune also raises more serious questions regarding Apple and Amazon's security.
The hack of prize-winning journalist Mat Honan raises tough questions for Apple and Amazon.
[Image Source: Ibabuzz]
Based on the account by both the hacker who attacked him and Apple, Mr. Honan says virtually any iCloud user is at risk of having their account hijacked via a quick and dirty social engineering scheme.
He writes in a followup:
Via AppleCare, I was able to confirm the hacker’s account of how he got access to my account. I have an email in to Tim Cook and Apple PR, and want to give them a chance to respond (and make changes). I want to give the company a little more time to look at its internal processes, but should be as simple as a policy change. So far, I haven’t received any acknowledgement from Apple corporate. I did, however, get an urgent call from AppleCare ten minutes after emailing Mr. Cook, informing me that my situation had been escalated and there is now only one person at Apple who can make changes to my account. So I gather corporate is aware of what happened and looking into how to most effectively respond to make sure this doesn’t happen again.
At least, I hope that’s what’s happening.
In a post yesterday on
, he provides more information, explaining Amazon.com, Inc. (
) is also to blame, by allowing unwanted account access through a bizarre loophole. Mr. Honan writes in
First you call Amazon and tell them you are the account holder, and want to add a credit card number to the account. All you need is the name on the account, an associated e-mail address, and the billing address. Amazon then allows you to input a new credit card. (Wired used a bogus credit card number from a website that generates fake card numbers that conform with the industry’s published self-check algorithm.) Then you hang up.
Next you call back, and tell Amazon that you’ve lost access to your account. Upon providing a name, billing address, and the new credit card number you gave the company on the prior call, Amazon will allow you to add a new e-mail address to the account. From here, you go to the Amazon website, and send a password reset to the new e-mail account. This allows you to see all the credit cards on file for the account — not the complete numbers, just the last four digits. But, as we know, Apple only needs those last four digits. We asked Amazon to comment on its security policy, but didn’t have anything to share by press time.
The key gaff on Amazon's part appears to be to allow you to add a credit card to your account without verification at your original email. Hopefully Amazon fixes this in a timely manner.
As for Apple, in many ways its flaw is worse, as virtually any compromised commerce portal provides a partial (last 4-digit) credit card number. That Apple would allow this as identity verification is troubling, to say the least.
Apple has struggled over the last year with security. In one extreme instance it was shown to be
saving some user passwords in plaintext
, an issue that took it months to remedy. The company, whose value is largely built on an impression of
superiority over conventional personal computers
, has largely
refused to publicly acknowledge
these issues for fear of damaging its prized image.
Ultimately Mr. Honan would discover that the hacker involved -- who called themself "Phobia" -- didn't target him because he was a high profile writer. He targeted him because he has a coveted 3-character Twitter handle (@mat). The rest was, as hackers say "gravy" -- and thanks to Amazon and Apple there was plenty of gravy to go around.
This article is over a month old, voting and posting comments is disabled
Stop using easy to obtain data
8/7/2012 1:12:16 PM
Stop using easy to obtain data
Easy way to get around this is don’t use Q/A’s that are easy to find out. Like what high school did you go to, first car, etc…
Use fake answers that you will remember but are not true. Like what was your first car, put down Toyota Mustang. I have never owned a Mustang or Toyota. If someone tried to get in and knew my first car they would get locked out.
This is also the same way sarah palin got her yahoo account hacked, she used basic Q/As to her account. I think one was her High School, easy to find.
RE: Stop using easy to obtain data
8/7/2012 2:36:16 PM
Apparently, you either did not read the article, or have a learning disability, as what you said has nothing to do with how this hack worked.
"Nowadays, security guys break the Mac every single day. Every single day, they come out with a total exploit, your machine can be taken over totally. I dare anybody to do that once a month on the Windows machine." -- Bill Gates
Apple to Update iTunes with iCloud Integration, Music Sharing
June 28, 2012, 5:07 PM
Apple Takes 3 Months But Finally Stops Printing Passwords in Plaintext
May 9, 2012, 5:20 PM
Kaspersky Labs: Apple's Security 10 Years Behind Microsoft
April 26, 2012, 7:39 AM
Apple Orders Technicians to Feign Ignorance About Mac Malware
May 20, 2011, 12:54 PM
Netbook Windows XP Licenses Dip to $15 Per Machine
April 20, 2009, 2:23 PM
Mini-Me: Xperia Z3's Petite Companion, Xperia Z3 Mini Leaks
July 31, 2014, 9:40 AM
Samsung Reports Lower Smartphone Sales, Operating Profit Falls 25% YoY
July 31, 2014, 8:55 AM
Xbox One's Release Date in China Set for September 23
July 30, 2014, 1:15 PM
Chinese OEM KingSing Launches $99 Windows 8.1 Tablet with 3G Connectivity
July 30, 2014, 11:04 AM
Samsung Sees Decline in Share, Shipments in a Growing Smartphone Market
July 30, 2014, 9:43 AM
UK Drivers Must Now Give Their Cell Phones to Police After a Crash
July 29, 2014, 4:37 PM
Most Popular Articles
Facebook Will Force Android, iOS Users to Use Messenger App This Week
July 29, 2014, 11:26 AM
Sony's Xperia Z3 Gets Detailed in Leaked Photos
July 25, 2014, 2:30 PM
Ford's Extensive Use of Aluminum in '15 F-150 Results in $395 Increase for Base Models
July 28, 2014, 3:02 PM
Pentagon's Priciest Project, F-35, Misses International Debut
July 25, 2014, 10:18 AM
T-Mobile CEO John Legere is on the Warpath Again; Introduces $100, 10GB Family Plan
July 28, 2014, 10:12 AM
Latest Blog Posts
Space Terrorism is a Looming Threat For the United States
Apr 23, 2014, 7:47 PM
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
Tesla vs. BMW: Who Has the Safer EV?
Feb 1, 2014, 2:56 PM
Justice Leaks Details of Next HTC One Two Flagship Phone
Dec 5, 2013, 4:04 PM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information