Apple iCloud security exploit is a concern, experts say

[jakeXT]

Source: BBC

Apple's iCloud facility, which stores iPhone and iPad users' photos and personal data, has a "fundamental security flaw", an expert has warned.

The online service is under scrutiny after intimate images of celebrities were stolen and leaked.

It has emerged that a security measure called two-step verification, which is recommended by Apple, can be bypassed using easily available software that allows access to iCloud back-ups.

Apple declined to comment.

Read more: http://www.bbc.com/news/technology-29045789

[dembotoz]

1. omg even APPLE??? Some du heads explode

[AtheistCrusader]

3. This is clearly Google, and/or Microsoft's fault.

[Hosnon]

10. One in particular... nt.

[PoliticAverse]

2. DU post with more on what the software can do...

http://www.democraticunderground.com/1017212811

[Sunlei]

4. my apple iphone has a weird default setting.It sends everything to the cloud, impossible to shut off

It's hard to get the settings off cellular and eats up my AT & T plan because Apple sends everything to the cloud. And then you get charged at cellular rates for the data. I shut off the 'cloud', shut off cellular and my useage still goes up! something when the phone sleeps it switches from wifi to cellular. I have to boot the phone off.

Something on the apps on the apple iphone keeps the apps turned on and sending data to their cloud. No wonder the cloud got "hacked". There are so many iphone apps, all connected to apples cloud!! and probably a bunch of apps easy to hack!!

I'm sorry I even got the apple iphone, it was a waste of a lot of money. I would never use it for any banking or payment transactions. I even disconnected it from my emails.

I would like a refund from Apple!! it's the least they can do.

[RoccoR5955]

5. It's quite easy to turn off.

Go to settings > Photos and Camera, and turn off My Photo Stream and Photo Sharing, if you want none of it in the cloud!
Then go to Videos and turn off "Show All Videos."
None of your pics or videos are in the cloud.

[jakeXT]

7. I wonder if they will praise their new iOS unlimited picture backup feature

Apple won't acknowledge how vulnerable iCloud is, of course—not with new iPhones to unveil in exactly a week. And really, do you think the company that told us to hold our defective iPhones differently will admit your naked sexts are easy to steal? This is the house of arrogance that Steve Jobs built, and it's on the verge of releasing a new version of iOS that backs up not just your last 1,000 iPhone photos, but all of them, along with your digitized health data. This is the last company on Earth you should want feeling too proud to admit it fucked up

http://valleywag.gawker.com/icloud-isnt-safe-because-everyones-a-target-and-apple-1629660564

[RoccoR5955]

9. It's only as easy as your password for iCloud!

I hear this all the time. People blame poor security on their choosing poor passwords, then when you enforce a password policy that includes numbers, caps, and special characters, the same people complain that their passwords are too difficult to remember.

[RoccoR5955]

6. Actually I believe it was an easy job

I don't think that it was Apple's fault that these people had simple passwords.
From what I have read, they were in the list of the 500 most frequently used passwords.
The only fault of Apple, was not limiting the number of retries that one gets to log on to iCloud.

[kentauros]

8. Reminds me of Spaceballs :)

And yet, people continue to do such things anyway...

[IDemo]

11. It's remarkable that a potentially much greater vulneralbility hasn't been given visibility

Just another reason I will never, ever own an iDevice (or Android device, to calm the outrage of a few here).

http://www.democraticunderground.com/10025273004

[jakeXT]

12. Nice Dad and it sounds like EPRB

Last edited Thu Sep 4, 2014, 12:20 PM - Edit history (1)

Zdziarski said the service that raises the most concern is known as com.apple.mobile.file_relay. It dishes out a staggering amount of data—including account data for e-mail, Twitter, iCloud, and other services, a full copy of the address book including deleted entries, the user cache folder, logs of geographic positions, and a complete dump of the user photo album—all without requiring a backup password to be entered.


...

He said he makes personal use of those features to keep tabs on his iPhone-using children.

"The forensic tools I've written for myself privately I use for parental monitoring where when I set the phone up I'll pair it with my desktop and then at any point in the future I can just easily scan the network, find my kids' devices and dump all their application data, see who they're talking to, and what their doing online," he explained. My kids have got to be the most miserable kids in the world with a forensics expert for a dad."

http://arstechnica.com/security/2014/07/undocumented-ios-functions-allow-monitoring-of-personal-data-expert-says/