Twitter user @hackappcom posted a proof of concept, called iBrute, to GitHub on Saturday, that took advantage of an alleged hole in Find My iPhone to access AppleID accounts.
This morning, the post was amended with this line:
The end of fun, Apple have just patched
http://9to5mac.com/2014/08/29/part-6-controversies-from-maps-to-beats-to-haunted-empires/ pam pam pam paaaaaammmmmm
And we see disruption on market. Nothing brings bad security culture like celeb photos to mainstream. Last bad outbreak mac os/x, ssl broken for everyone to read your secure connection for 18 months iOS, iMessage spam and now this. As a mac and iOS user I am really sad to see this. And this is a big deal because it shows systematic failure in culture to produce secure products. Unanswered question, where did they get the addresses. This might be can of worms.
I don’t think this is a systematic effort on the part of Apple to avoid making secure products. If you meant systemic, then I think Apple was once pretty lazy in this regard, as they could get away with it. They have a great deal to lose now if there is a serious security breach. Best to prepare for the worst with regards to security on the internet.
I’m curious. This was a proof of concept but was it every actually shown in use. To prove the alleged hole actually existed.
And consider how they were doing it. They were tossing random easy passwords at the system. So isn’t the real issue not iCloud but rather anyone being dumb ass enough to use Password123 as their password.
There isn’t really any proof that anyone actually knew about the SSL issue before it was passed. If someone did and used it we would have seen the social media about it. Folks only went and looked for the issue after finding out that a patch existed, by comparing the old and new.
And the claims of major amounts of iMessage spam haven’t really panned out either.
I wish I could agree with you, but not implementing brute force is a pretty serious flaw.
Also, even moderately strong passwords aren’t very secure anymore.
http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/