Tech experts are now saying weak passwords gave hackers the chance to access private pictures thanks to a software glitch
Technology giants Apple are conducting an investigation into the
celebrity photo hacking scandal after dozens of A-listers' personal
photos were posted online against their will.
It's thought hackers obtained images via celebrities' iCloud accounts after having their passwords stolen by hacking software.
Jennifer Lawrence and other celebrities whose private pictures were leaked online may have had their Apple's iCloud passwords stolen by hacking software.
Pictures of Jen and 100 other celebrities were posted on anonymous message board 4Chan yesterday, infuriating the stars and their management.
Within hours Twitter was awash with hundreds of thousands of tweets about the photographs which are also alleged to include Brits Michelle Keegan, Cara Delevingne, Cat Deeley and Kelly Brook.
Now, a piece of computer code that repeatedly guesses passwords has been found online.
It's thought hackers obtained images via celebrities' iCloud accounts after having their passwords stolen by hacking software.
Jennifer Lawrence and other celebrities whose private pictures were leaked online may have had their Apple's iCloud passwords stolen by hacking software.
Pictures of Jen and 100 other celebrities were posted on anonymous message board 4Chan yesterday, infuriating the stars and their management.
Within hours Twitter was awash with hundreds of thousands of tweets about the photographs which are also alleged to include Brits Michelle Keegan, Cara Delevingne, Cat Deeley and Kelly Brook.
Now, a piece of computer code that repeatedly guesses passwords has been found online.
The script was posted to software site GitHub, but a message has since appeared saying that Apple has issued a "patch" or fix for the bug.
According to the post, the script uses the top 500 most common passwords approved by Apple in order to try and gain access to user accounts.
If successful, it would give the hacker full access to the iCloud account, and therefore photos.
Owen Williams from technology site The Next Web, who discovered the bug, said: "The Python script found on GitHub appears to have allowed a malicious user to repeatedly guess passwords on Apple's 'Find my iPhone' service without alerting the user or locking out the attacker.
"Given enough patience and the apparent hole being open long enough, the attacker could use password dictionaries to guess common passwords rapidly.
"Many users use simple passwords that are the same across services so it's entirely possible to guess passwords using a tool like this."
"If the attacker was successful and gets a match by guessing
passwords against Find my iPhone, they would be able to, in theory, use
this to log into iCloud and sync the iCloud Photo Stream with another
Mac or iPhone in a few minutes, again, without the attacked user's
knowledge.
"We can't be sure that this is related to the leaked photos, but the timing suggests a possible correlation."The technology giant is yet to make any comment on the incident.
Experts have pointed to the weakness of many internet users' passwords and basic security knowledge as being the cause for the widespread leak.
iCloud is Apple's own cloud service, a wireless storage facility that can be used to access files remotely.Other
notable services include Dropbox and Google Drive, which enable users
to keep more of their files close to hand without taking up huge amounts
of memory on their devices.
Rob Cotton, CEO at web security experts NCC Group said: "Cyber security is not just a technology problem, humans are very much key to its success. In our day-to-day work we see too many cases of employees divulging sensitive information without first verifying the legitimacy of the request.
"People often point the finger at technology when they've been the victim of a cyber attack, but poor password choices or naivety in the face of a seemingly innocent email is regularly to blame."
Mr Cotton said that human error often played a part.
Stefano Ortolani, security researcher at online experts Kaspersky Lab said: "In order to make your private data more secure, you should cherry-pick the data you store in the cloud and know, and control when the data is set to automatically leave your device.
"For instance, in iCloud there is a feature called "My Photo Stream" which uploads new photos to the cloud as soon as the device is connected to Wi-Fi; this is to keep photos synchronised across all your devices. Disabling this option might be a good starting point to be a bit more in control."
While the security of the cloud will now come under increased scrutiny, Mr Ortolani points out that some element of risk has always existed.
He said: "The security of a cloud service depends on its provider.
"However, it's important to consider that as soon as you hand over any data including photos to a third-party service, you need to be aware that you automatically lose some control of it. This is also the case for when you upload something online."
Rob Cotton, CEO at web security experts NCC Group said: "Cyber security is not just a technology problem, humans are very much key to its success. In our day-to-day work we see too many cases of employees divulging sensitive information without first verifying the legitimacy of the request.
"People often point the finger at technology when they've been the victim of a cyber attack, but poor password choices or naivety in the face of a seemingly innocent email is regularly to blame."
Mr Cotton said that human error often played a part.
Stefano Ortolani, security researcher at online experts Kaspersky Lab said: "In order to make your private data more secure, you should cherry-pick the data you store in the cloud and know, and control when the data is set to automatically leave your device.
"For instance, in iCloud there is a feature called "My Photo Stream" which uploads new photos to the cloud as soon as the device is connected to Wi-Fi; this is to keep photos synchronised across all your devices. Disabling this option might be a good starting point to be a bit more in control."
While the security of the cloud will now come under increased scrutiny, Mr Ortolani points out that some element of risk has always existed.
He said: "The security of a cloud service depends on its provider.
"However, it's important to consider that as soon as you hand over any data including photos to a third-party service, you need to be aware that you automatically lose some control of it. This is also the case for when you upload something online."
0 comments:
Post a Comment