Re/code:
Apple just issued a statement on the disclosure of celebrity photos said to have come from its iCloud storage service.
“We wanted to provide an update to our investigation into the theft of photos of certain celebrities. When we learned of the theft, we were outraged and immediately mobilized Apple’s engineers to discover the source.”
Apple very specifically pointed out in their statement to media outlets that “None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud or Find my iPhone.”
Amazing how many sites wrote about iCloud being ‘hacked’ in the rush to jump on the story.
Goodness, even this one! Loop headline: “Apple says it was hacked”. Apple statement: “None of the cases involved breaches of Apple systems”.
Individual accounts were hacked, as a result of what seems to be clever guessing or social engineering. Apple, from all appearances, was not hacked.
More amazing still is how many will keep writing that.
Yup. It’s sexier and more dramatic that way.
Find my iPhone didn’t need to be hacked or “breached”(and indeed it wasn’t). It had a bug that allowed unlimited authentication attempts without lockout. i.e., the “very targeted attack” in the press release. Apple patched the bug at 3:20 am Sunday.
I give you…Arrington:
http://uncrunched.com/2014/09/02/apple-is-screwed-frappening/
To be fair to the Loop, I assume they based their headline on re/code’s headline – which has since been changed. Check out the headline vs. the URL slug.
Ha, that’s pretty funny.. in fact, when I followed the re/code link earlier, it wasn’t either of those headlines. There seems to be a battle of editors going on over there.
And shameful for Re/code to change the content so significantly without making note of the changes.
Darn, I was hoping to find photos of Bojack Horseman
Well, that would also be considered a breach, wouldn’t it? Apple would be able to see if an account was targeted through Find My iPhone and if this attack was successful — same IP with thousands of attempts. That would be a breach of Find My iPhone. Yet Apple says: “None of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud or Find my iPhone”.
Is it me or has Re/Code quickly taken the lead as gossipy, click bait tech journalism from what started as pretty quality stuff from quality writers?
Oh, it’s not just you. It definitely feels like they’ve fallen down that rabbit hole in recent months.
What’s the definition of a breach? Is a successful login after multiple failed attempts a breach of Apple’s systems? I sometimes enter the wrong password — am I “breaching” their systems once I enter the correct one?
This press release is worded to deftly skirt the issue. It doesn’t specifically state that the authentication bug/feature in Find my iPhone that they patched over the weekend wasn’t the vector of attack. Most people seem to be buying it. Knowing that a small group of people spent their holiday weekend toiling over each and every word in this press release, I’m skeptical.
Headline is false. Apple did not say they were hacked.
Headline was from Re/code. They’ve since changed it but left the URL intact so you can see for yourself.
When I link to a story, I try not to change the headline of the original.
They miss it because internet services are the red-headed stepchild at Apple. They’re necessary to sell devices, but selling devices is the goal. So when there’s a ramp-up to the next launch(es), the entire company focuses on that, and resources get pulled. I’d bet money there was a Radar on this issue, but it got low-priority, and/or no resources to fix it, because the teams are overwhelmed with the next big thing.
You’d think somebody would get fired for letting a vulnerability like this slip through — or not doing anything about it once they knew about it — but Apple PR has done such a great job of deflecting blame, firing somebody would be tantamount to admitting guilt. So it’s business as usual at Infinite Loop, at least until the next PR scandal hits. In the mean time, let’s have another Beer Bash and pat ourselves on the back for our “Diversity” initiatives. More RSUs for everybody!
why is it fair to loop to blame their sloppy headline on another site’s sloppy headline? if the loop’s writers werent sloppy, theyd see thru re/code’s slop and create their own, correct, headline. they didnt. because theyre sloppy too.
how could you possibly know whether someone was or was not fired at apple? do you work in apple HR?
Because the “ethical” thing to do when creating a linked-list type post is to mirror the originating site’s headline in order to not misrepresent the original content.
If the originating site doesn’t have the integrity to stand by their original headline that’s not really something the linker can control.
“I sometimes enter the wrong password — am I “breaching” their systems once I enter the correct one?”
Well, you would need at least a couple of thousand attempts to brute force. A couple of attempts wouldn’t be a breach, logically. A couple of thousand tries in succession, that is a high probability, don’t you think? So that would be a breach.
Yes, the wording Apple used is highly ambiguous, I agree. But if someone gained access via social engineering and guessed security questions, that could have been ways the accounts were compromised. I do think in due time, Apple needs to explain it more.