Naked celebrity hack: security experts focus on iCloud backup theory

Security experts are warning that there could be many more compromised celebrity iCloud accounts after examining file data from pictures stolen from stars including Jennifer Lawrence and Kate Upton.

One theory gaining ground is that many of the pictures had been accumulated by one hacker over a period of time – and were then “popped” by another hacker who somehow broke into a machine belonging to the first. Lending weight to that was that one of the earliest photos found in a cache released online dated to December 2011, while the most recent was from 14 August.

Some have also pointed to the presence of a Dropbox tutorial file in one hacked account as suggesting that the third-party cloud storage service was a source of some pictures.

But the posting to Github of an exploit against Apple’s Find My iPhone service three days ago, which could use a “brute-force” attack to work out a password, points to the existence of weak links in Apple’s service that could have been exploited once somebody had the email address of a celebrity or their manager.

The original hack looks to have been done by “chaining” between accounts: on gaining access to one person’s account, the hacker could access their address book and use that to attack others’.

InfoSec Taylor Swift, a Twitter account that began as a parody combination of the country singer and security thinking, began a serious examination of EXIF data connected to some of the photos distributed online. EXIF data can give extra detail about a photograph, such as when it was taken, with what device, and where.

“Swift” put the EXIF data – though not the images – from the alleged Kate Upton pictures onto the code-pasting site Pastebin – and found that they appeared to have come from her boyfriend, not Upton herself.

Apple has still issued no statement on how many accounts on its iCloud service were broken into.

But it has come in for strong criticism over the lack of protection against “brute-force” attacks that would yield a password. “If the celebs’ iCloud account passwords were brute forced, the problem seems to be lack of rate limiting by Apple, not lack of crypto,” commented Christopher Soghoian, principal technology at the American Civil Liberties Union.

“Once Apple’s privacy and PR teams respond to the celeb iCloud fiasco, I hope Apple donates several million dollars to usable security research… Blame the tech companies for delivering products with crappy default security settings, not the non-expert users whose accounts are hacked.”

Some have suggested that the source of some of the photos could even be staff with the ability to access iCloud backups. However Apple says in its support documents that iCloud backups – including photographs – are encrypted: “This means that your data is protected from unauthorised access both while it is being transmitted to your devices and when it is stored in the cloud.”

Dan Kaminsky, chief scientist at whiteops.com, said on Twitter that “my personal thinking is that someone [originally] hacked desktops, and someone else hacked the hacker” – adding “if it isn’t iCloud, which apparently there’s some reason to believe.”

There is widespread confusion though about the implications of the hack. Swift warned that “_This is just the beginning._ Folders of images with thumbnails visible have been shown, many celebs yet to be impacted who will.”

source:  Charles Arthur/The Guardian