Apple Says It Will Add New iCloud Security Measures After Celebrity Hack | Hacker News Reader

Apple Says It Will Add New iCloud Security Measures After Celebrity Hack

bits.blogs.nytimes.com

29 pointsdnetesn56 comments

Hopefully they reconsider their security questions as well. I was helping my mother create a iCloud account and the stock questions are a nightmare for her. Things like "Who was your first teacher?" require her to remember things that happened 60 years ago in a non english speaking country and provide an answer in English (that she will now have to spell consistently next time).

You're not supposed to put in real answer anyway.

I usually use an answer like securityquestionsshoulddieinafire [1], no matter the question. Easier that way, and more satisfying.

[1]: No, not that exact string ;)

it works until they limit your to 10 characters, now you have an exception you will never remember!

I usually switch the answers around. So A gets B's answer.

This sort of comment appears a lot and it makes for an easy trip to victim blaming.

Apple created these questions for you to enter real answers. They fully intend for you to put in real answers. That is what the system's purpose is.

That we look at it and say "well that is grossly insecure, so I'm going to put in the SHA512 hash of the question with a fixed secret salt" might assuage our risk, but it does nothing to relieve Apple of the failure of this security system.

Not only is it insecure, but in some cases intensely user unfriendly. I used to put real answers in these until I realized even if I remembered the answer I could never recall the exact string I used.

A common example: "Name of first car?"

So was that "Neon"? or "Dodge Neon"? or "Blue Neon"? or maybe "neon"? or "1991 Dodge Neon"?

Security questions are basically a secondary password masquerading as something else. But because they are not called a password, the expectations on their character-wise-correctness are not clear to a layman. I find the continued proliferation of security questions baffling, especially when some sites call password + security question "two factor authentication".

I had exactly the same issue. Apple wants like three different security answers from a list of about 8 questions, but the questions they allow you to pick from are super odd and very US specific stuff.

Here are REAL examples of some of the options Apple gives you:

      - Who was your favourite singer or band in high school    
 - What was the first album that you purchased      
 - What was the first film you saw in the theater   
 - What was the first car you owned    
 - Which of the cars that you've owned has been your favourite    
 - Where were you January 1st, 2000.     
 - What is the first thing you learned to cook    
 - Where did you go the first time you flew on a plane    
 - What is the last name of your favourite elementary school teacher

But you don't get all of those. You get a random selection. So two different accounts might have different options.

For me I don't have an answer to over 80% of those questions. Either because I don't know, it doesn't exist, or because it is US centric.

Honestly Apple's security questions took me over 20 minutes, were mandatory to use iTunes, and was a fully unpleasant experience. There's very little chance I'll remember them later either.

It is quite funny how lax their security is elsewhere when they can justify this painful nonsense.

I lost my apple account to an attacker. Apple wouldn't let me have the account back, even though I still controlled the email address for the account. Reason was because I could not answer a custom security question I made up over 10 years ago when I was still a student.

My question: What is Brak's mom's thing?

I hate security questions passionately. You have only a few options:

1) Put in some unforgettable public information so anyone can have your account.

2) Put in some secret, highly forgettable information that you won't remember.

3) Put in some standard response that will inevitably fail to meet the requirements for some questions. My first attempt at this was 'na' for not applicable, but many questions have a minimum # of characters

Security questions are horrible, but I think the best solution is 2b: Put in some secret, highly forgettable information that you save in your password manager as a note together with your password.

Which you sync to the cloud using iCloud, and you've lost access to your computer because the drive failed and now you can't answer the question because you can't access iCloud to get the information back out :P

Then sync it to two devices so you have two factor verification ;)

You should never rely on the 'cloud' as your only backup. You should always have a local backup as well. At least, while we are on the subject of ideal best practices for individuals :)

I feel like security questions are supposed to be part of the third pole of the "what you know, what you have, what you are" triangle. You lost the thing you have, or you forgot the thing you knew. The way to get it back is to prove that you are the things you are.

Because of this, memories (mother's maiden name, high school you went to, etc.) are meaningless for security questions. These are effectively more passwords.

The effective kind of security questions look something more like "how many moles do you have on your entire body" or "what is the position (in dental notation) of the tooth you cracked when you were 23". These are pieces of information you can derive by examining yourself, which you took the time to derive once (when you set up the question) and could, at any point, take the time to derive again--but which anyone else, to impersonate you, would basically have to have you tied up, naked, and incapacitated to figure out.

Fingerprints, DNA samples, etc. also work for a 3FA, but only if taken interactively (that is, with a tester standing there watching you provide them.)

Combining the two methods--having a battery of little assays, some self-derived, some assisted--works better, though, since any one of these dimensions might drift over time (you might get a new mole!) but together they should form a reasonable "profile" of you.

---

A tangent: it'd be neat if there was a company that let you register a set of these tests to enable the release of something like a one-time private signing key held in escrow. You could just give these other third-parties that want 3FA questions the public-key fingerprint (never actually having had possession of the private key yet), and then if they ever need it, contact the challenge company to get your key unlocked and "re-notarize" your profiles with it.

-"A tangent: it'd be neat if there was a company that let you register a set of these tests to enable the release of something like a one-time private signing key held in escrow. "

I think I smell a start-up.

Seriously. There will be some difficult questions to address, like how to finance an indefinite escrow and still charge a price low enough that you can draw customers and how to store the escrow in such a manner as to make it impractical for TLAs to bulk mine the whole thing but I think you have a good idea.

I see the bigger issue being that the security questions or answers are not usually properly encrypted or securely handled in the same way that we at least expect passwords to be handled. The other issue is that security questions should be customizable and people should, if the question and answer is properly hashed and encrypted, devise questions that are personal and remain relevant, e.g., where is your biggest mole?

Yes, maybe they should be encrypted but that's still a problem because most of the time the answer can be correct in context but wrong technically. For example, "what's the name of your first pet?". If you originally answered "Spot" when you set it up then enter "spot" when you're asked later those two won't match after the hash is compared (if you use hashing) and it won't match if it's unencrypted either. That's an easy case to fix of course but there are other times when they ask for the name of your high school or something. I've been asked that several times and I'm not able to be consistent in my answer each time as sometimes my answer will be "Blah Blah High" or "Blah Blah Township High School" or any variation of that. Both answers are correct but only a person can see that.

So as I see it, encryption or hashing is good for keeping the answers a secret but bad when it comes time to use those answers again.

I used to mix up the answers to the question. So "What is your mother's maiden name?" would be Nathan Fillion. "Who is your favourite actor?" would be my mother's insanely obscure maiden name (I've never heard it outside of the family).

So unless someone knows I do this, it isn't even helpful to know personal information about me because I answer the questions seemingly nonsensically.

Wasn't Brak that character on Space Ghost about 10 years ago? In case that helps...

Yeah, and he had his own TV spinoff! I have the DVD's, but i don't want to watch the entire series on the chance that I still won't be able to figure out the answer.

I just saw this reply. I remember thinking, doesn't she always have a vacuum cleaner? At least that's what I picture, it's been a while. You should mechanical turk watching the series :P

I hate them as well. I use KeePassX to generate a random 20+ character alphanumeric "answer" to them, and input the question and answer in the entry comment field.

I've had the same problem (though not with apple), trying to remember what my favourite movie character was 12 years ago.

Summary for those too lazy to get past the NYT paywall:

>The company said it would add alerts to tell people about activities that could be signs of a break-in.

>Customers will receive push notifications when someone tries to change the password for their iCloud account, upload their backed-up account data to a new device or log into their accounts for the first time from an unknown device, the company said. The notifications will be added in two weeks.

>In the past, Apple customers were receiving emails only when someone changed their account password or logged in from a new device. They received no notification or email when someone loaded an iCloud backup onto another device.

So, there are going to be exceptions to these notifications when law enforcement does all of these things, right?

If so, then it's still security with an exploitable backdoor.

Edit: For the downvoters, and those who might choose to downvote, I guess that you don't understand that LEO backdoors are a real thing that can and are actually exploited? Here's some reading:

http://www.wired.com/2014/09/eppb-icloud/

https://www.schneier.com/blog/archives/2006/03/more_on_greek...

If your secure system has a way for a number of third parties to conveniently and quickly gain clandestine access, that means that someone who's not in the group of third parties that you intended to permit access will inevitably gain access.

Honestly, I hate the fact that I:

1) I have to answer 3 security questions

2) I can't use the same reply to all of them

I can't trust any storage device but my brain, and the fact that I actually answer unrelated information to the question means that it's almost impossible for me to remember what I answered in each one.

I'm not going to give real answers, because real answers are insecure.

You can put answers in your physical wallet or in a safe.

I don't know about you, but I've never had my wallet compromised.

How about rolling out what they already have (2-factor auth) out to the rest of the world? Only about 60 countries have 2-factor auth for Apple IDs.

That's great and all, but it's been made clear the exploit would have bypassed MFA, because MFA isn't used to restore backups. This is a tricky problem, since your phone is probably your MFA device. One easy thing they can do going into the future is once anyone acquires a device with fingerprint ID, allow that as an additional required auth factor when restoring from backup.

That almost sounds like an admission of guilt.

I get that their overall security process is rather patchy and has huge holes, but it is still up to the user to choose between a secure and hugely annoying password, or an easy and convenient one.

The item they are fixing is not the password, which already has complexity requirements, and through most systems is rate limited. They are fixing the security questions system.

And I think they're understating the changes they're going to make. Simply sending a "BTW someone just took over your account" message is obviously not enough -- take it over at 2am and enjoy a night of malfeasance. Instead I imagine they are going to put in some thoughtful patterns like-

-emailing the password change notice to the email address on record on the successful completion of the security questions.

-having a window before any new password/grants come into effect from such a system.

Or the like. As is their proposed improvements don't do much more than what currently exists, where you (apparently) do at least get an email after someone reset your password by exploiting this system weakness.

It's amazing how apple will basically sweep this under the rug thanks to its perceived brand trust that it's earned over the years. Pretty impressive to see from a marketing perspective.

Could the iWatch act as a kind of password / second-factor authentication? I could see Apple taking this tack, but they would have to be very careful if they discussed this in the keynote, since at least a few celebrities tweeted pretty nasty things about Apple / iCloud.

My solution: charge for password recovery and refund the money.

Honestly that's actually genius. Just pre-charge 1c to a Credit Card (which you won't need to refund as it is a pre-charge, not a charge) which will allow you to verify the name, address, and so on.

The only limitation of this concept is: People who don't own cards and under-age people who couldn't own them. It is possible to JUST use iTunes etc with just gift cards.

Has anyone suggested private photo mode, like private browsing mode where the photos aren't automatically synced or backed up to the cloud?

Photos upload is not enabled by default.

Uhh yes it is. I have iCloud right in front of me. Both the desktop and iPhone ones have "Photo backup" and "Camera roll" respectively turned on initially.

You have to go to iCloud -> Storage and Backup -> Manage Storage -> Camera Roll to turn it off.

Unless you mean that iCloud backup itself is not turned on by default, which is accurate. But the way you worded it it reads like if you have iCloud backup, it won't backup photos until you expressly tell it to which is inaccurate.

I meant the latter. Turning on backup and having it only do a partial backup by default would be a surprising behavior for users.

I haven't been following on this matter, it was or it wasn't Apple's fault?

From the article:

"Apple earlier this week said that after a 40-hour investigation, the company concluded that there was no breach of its data servers. The company has said it discovered a number of celebrity accounts were compromised by targeted attacks, using methods like phishing or correctly answering security questions to obtain their passwords."

So the stolen data was from Apple's servers, but was obtained by compromising individual logins.

Lesson #1: enable 2FA. now.

Looks like in the end the weak link is always human.

It's a classic "password" is not a good password situation. Peoples passwords are way too common, its not surprising celebrities got hacked they're going to be just as likely as using a weak password as any young adult.

2FA does not protect iCloud data at all, it would have done nothing here.

My understanding is it just doesn't protect iCloud backups, which is what were compromised here - also why things deleted from the phone were still in the cloud.

That's mine too, an iCloud backup is pretty much keys to the kingdom. Could also just have been that they had access for a very long time and downloaded data multiple times in that period without being detected.

Lesson #1: only use software that encrypts the data on the client side before storing it on the server.

Also sending plain text auth tokens is not secure.

No. It was a labor intensive social engineering attack that couldn't be perpetrated on a wide scale, not a technical breach.

However it's still a weakness and Apple can take steps to improve things.

Hate to be that guy, but social engineering would mean they manipulated the person through social engagement to expose their credentials or information...which may have been possible, but more than likely they guessed or researched answers to the questions...?

I read something about a phishing attack - would that count as social engineering?

Yes, it gets the actual owner of the account to pass over personal information.

Ok. One of the stories I read mentioned that may have been how they got the information required to hack the account. Not too sure if it was just speculation or verified in anyway.

With such a large group compromised at the same time I would guess it was not phishing.

The group wasn't large, and there is no evidence they were compromised at the same time.

Apple hasn't been forthcoming with details. They have thus far denied any responsibility. However, there is substantial evidence that it was indeed at least partly their fault.

There was a flaw that allowed brute force password attempts exposed here: https://github.com/hackappcom/ibrute

Apple also follows poor security practices like asking insecurity questions to allow users to gain access to an account.

Apple has claimed that it was most likely a 'phishing' attack. However, given the large number of victims, and the lack of any evidence presented to support such a theory, I am rather hesitant to believe them. Until further information is made available, I am forced to consider Apple to be at fault.

Reply on news.ycombinator.com