4.2 KiB
| title | aliases | tags | ||
|---|---|---|---|---|
| ass03-security-flaws-essay |
|
Jet Hughes 9474308
References
What are the articles?
2012 Honan Wired
- guy got hacked
- amazon - apple - gmail - twitter
- could have been prevented with 2fa on google
- ultimate goal twitter
- should have used backups for devices
- was his fault
- but also security flaws in apple and amazon
- final four digits shared by amazon are required by apple
- disconnect exposes flaws in tech industry
- foreshadows issues in era of cloud and connected devices
- password based systems are no longer suffice
5pm
-
phone powered down
-
This was irritating, but I wasn’t concerned
-
assumed it was a software glitch
-
phone automatically backs up
-
I was irritated, but not alarmed.
-
the screen went gray, and asked for a four-digit PIN
-
I knew something was very, very wrong.
-
unplugged my router and cable modem, turned off the Mac Mini
-
called AppleCare
-
a call had been placed just a little more than a half an hour before my own.
-
Apple rep didn't bother to tell me about the first call concerning my account
-
only shared this information after I asked about it
-
someone called AppleCare claiming to be me.
- reported that he couldn't get into his Me.com e-mail
- issued a temporary password
- despite the caller’s inability to answer security questions I had set up
- it did this after the hacker supplied only two pieces of information that anyone with an internet connection and a phone can discover.
-
a password reset confirmation arrived in my inbox
- I don’t really use my me.com e-mail, and rarely check i
- hackers immediately sent it to the trash.
- reset my AppleID password
-
Gmail password recovery e-mail
- Google account password had changed
-
reset my Twitter password.
-
used iCloud’s “Find My” tool to remotely wipe my iPhone, iPad, Macbook
-
deleted my Google account
-
the attackers posted a message to my account on Twitter taking credit for the hack.
-
not only had the ability to control my account, but were able to prevent me from regaining access
-
those deletions were just collateral damage
-
I spent an hour and a half talking to AppleCare
- Apple had been looking at the wrong account
- alternate set of questions
- a billing address and the last four digits of my credit card.
-
all you need to access someone’s AppleID is the associated e-mail address, a credit card number, the billing address, and the last four digits of a credit card on file.
-
company spokesperson Natalie Kerris told Wired, "Apple takes customer privacy seriously and requires multiple forms of verification before resetting an Apple ID password. In this particular case, the customer's data was compromised by a person who had acquired personal information about the customer. In addition, we found that our own internal policies were not followed completely. We are reviewing all of our processes for resetting account passwords to ensure our customers' data is protected."
-
Wired tried to verify the hackers' access technique by performing it on a different account. We were successful
-
I logged into Tumblr and posted an account of how I thought the takedown occurred
-
one of my hackers @ messaged me - Phobia
-
I agreed not to press charges, and in return he laid out exactly how the hack worked.
-
“didnt guess ur password or use bruteforce. i have my own guide on how to secure emails.”
- why - the hack was simply a grab for my three-character Twitter handle
- take it, and fuck shit up, and watch it burn.
-
My Twitter account linked to my personal website, where they found my Gmail address
-
I didn’t have Google's two-factor authentication turned on, when Phobia entered my Gmail address, he could view the alternate e-mail I had set up for account recovery - ****@me.com - rev
-
Google partially obscures that information, starring out many characters, but there were enough characters available