This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at http://www.guardian.co.uk/technology/blog/2012/aug/08/apple-amazon-patch-security
The article has changed 13 times. There is an RSS feed of changes available.
| Version 0 | Version 1 |
|---|---|
| Apple and Amazon patch security flaws exposed by hack heard round the world | Apple and Amazon patch security flaws exposed by hack heard round the world |
| (about 3 hours later) | |
| They are tent poles of the economy, companies so big that for many, it can seem hard not to do business with them. Now Apple and Amazon are moving like a pair of lumbering synchronized swimmers to plug gushing leaks in their online security policies. | |
| In the last 24 hours, Apple stopped processing password resets over the phone, and Amazon stopped accepting changes to account settings – including credit card numbers and emails – over the phone. | In the last 24 hours, Apple stopped processing password resets over the phone, and Amazon stopped accepting changes to account settings – including credit card numbers and emails – over the phone. |
| The reason? On Friday, reciprocating vulnerabilities in the two companies' security practices allowed hackers moving between Amazon and Apple to pull off an attack heard around the world – the technology world, at least. | The reason? On Friday, reciprocating vulnerabilities in the two companies' security practices allowed hackers moving between Amazon and Apple to pull off an attack heard around the world – the technology world, at least. |
| The hack exploded in the news because on Monday the target of the attack, Mat Honan, published a detailed, damning 3,500-word piece about it on the technology site Wired.com, where he works as a senior writer. | The hack exploded in the news because on Monday the target of the attack, Mat Honan, published a detailed, damning 3,500-word piece about it on the technology site Wired.com, where he works as a senior writer. |
| "Those security lapses are my fault, and I deeply, deeply regret them," Honan wrote. "But what happened to me exposes vital security flaws in several customer service systems, most notably Apple's and Amazon's." | "Those security lapses are my fault, and I deeply, deeply regret them," Honan wrote. "But what happened to me exposes vital security flaws in several customer service systems, most notably Apple's and Amazon's." |
| Neither Apple nor Amazon is commenting on the security changes, which were first reported in Wired. | Neither Apple nor Amazon is commenting on the security changes, which were first reported in Wired. |
| The attack erased Honan's digital existence and wiped clean the contents of his iPad, iPod and MacBook hard drive, including all his pictures of his one-year-old daughter. It obliterated eight years of Gmail messages. It culminated in the hijacking of his Twitter account, which was the hackers' goal in the first place – a coveted prize, according to a hacker whom Honan succeeded in contacting, due to its stylish three-letter handle, @mat. (Honan has since regained control of his Twitter account, and reports headway in Apple's attempt to recover his hard drive data, including the pictures.) | The attack erased Honan's digital existence and wiped clean the contents of his iPad, iPod and MacBook hard drive, including all his pictures of his one-year-old daughter. It obliterated eight years of Gmail messages. It culminated in the hijacking of his Twitter account, which was the hackers' goal in the first place – a coveted prize, according to a hacker whom Honan succeeded in contacting, due to its stylish three-letter handle, @mat. (Honan has since regained control of his Twitter account, and reports headway in Apple's attempt to recover his hard drive data, including the pictures.) |
| How did it happen? The short answer is that Honan made it easy for the hackers to guess the .Me email address associated with his AppleID by using the same email prefix for multiple accounts. His use of iCloud – which Apple aggressively promotes – meant hackers could remotely wipe all his Apple devices. | How did it happen? The short answer is that Honan made it easy for the hackers to guess the .Me email address associated with his AppleID by using the same email prefix for multiple accounts. His use of iCloud – which Apple aggressively promotes – meant hackers could remotely wipe all his Apple devices. |
| Honan's telling is a recommended read, not least for his description of the instant-message exchange he had with one of the hackers. In an act of journalistic aplomb, Honan pursues the hacker as a source to explain exactly why the hack was carried out and how it worked. | Honan's telling is a recommended read, not least for his description of the instant-message exchange he had with one of the hackers. In an act of journalistic aplomb, Honan pursues the hacker as a source to explain exactly why the hack was carried out and how it worked. |
| But the attack could not have happened without seemingly lax and interlocking security rules at Apple and Amazon. Once the hackers had Honan's Apple email, they needed only two other pieces of information to gain full access to his Apple kingdom: a billing address and the last four digits of a credit card number. | But the attack could not have happened without seemingly lax and interlocking security rules at Apple and Amazon. Once the hackers had Honan's Apple email, they needed only two other pieces of information to gain full access to his Apple kingdom: a billing address and the last four digits of a credit card number. |
| The billing address was obtained through a quick search for Honan's personal web domain on whois.com. | The billing address was obtained through a quick search for Honan's personal web domain on whois.com. |
| The credit card is where Amazon came in. Before the recent change in policy, all the hackers needed to crack Honan's Amazon identity – and view the last four digits of his credit card number – was a name, an email address and a billing address. They had all three. | The credit card is where Amazon came in. Before the recent change in policy, all the hackers needed to crack Honan's Amazon identity – and view the last four digits of his credit card number – was a name, an email address and a billing address. They had all three. |
| They got the digits. Then they called back Apple. | They got the digits. Then they called back Apple. |
| "At 5:02 p.m., they reset my Twitter password," Honan writes. "At 5:00 they used iCloud's 'Find My' tool to remotely wipe my iPhone. At 5:01 they remotely wiped my iPad. At 5:05 they remotely wiped my MacBook. Around this same time, they deleted my Google account. At 5:10, I placed the call to AppleCare. At 5:12 the attackers posted a message to my account on Twitter taking credit for the hack." | "At 5:02 p.m., they reset my Twitter password," Honan writes. "At 5:00 they used iCloud's 'Find My' tool to remotely wipe my iPhone. At 5:01 they remotely wiped my iPad. At 5:05 they remotely wiped my MacBook. Around this same time, they deleted my Google account. At 5:10, I placed the call to AppleCare. At 5:12 the attackers posted a message to my account on Twitter taking credit for the hack." |
| To learn how to protect against a hack like the one that hit Honan, click here. Two quick steps: make sure you use different passwords for different accounts and if you use Gmail, set up two-step verification for access to your account. | To learn how to protect against a hack like the one that hit Honan, click here. Two quick steps: make sure you use different passwords for different accounts and if you use Gmail, set up two-step verification for access to your account. |
| The new security rules at Amazon and Apple seem to have plugged the leak used by Honan's hackers. An attempt by Wired on Tuesday to replicate the hack failed, after similar attempts Monday had succeeded. | The new security rules at Amazon and Apple seem to have plugged the leak used by Honan's hackers. An attempt by Wired on Tuesday to replicate the hack failed, after similar attempts Monday had succeeded. |
| Do the security patches at Amazon and Apple go far enough? Unfortunately the hackers are likely to know before the rest of us do. | Do the security patches at Amazon and Apple go far enough? Unfortunately the hackers are likely to know before the rest of us do. |