Subscribe & Follow
Safeguarding against an Apple iCloud hack
![Guillaume Lovet](https://biz-file.com/c/1409/225416.jpg)
Some celebrities (e.g. Jennifer Lawrence and Mary Elizabeth Winstead) confirmed the pictures' authenticity while others (Victoria Justice, Ariana Grande, McKayla Maroney) reported they were fake.
At this point, Apple has not confirmed whether iCloud was hacked, merely stating an investigation is ongoing.
Who is behind the hack?
The list of hacked celebrities was released by anonymous 4chan users with ID ffR+At7b and UggsTju5. Their identity is, as yet, unknown. We don't know either if there are more users behind this breach or not.
One of them could be a 26-year-old living in Lawrenceville, Georgia, whose identity was made public. Reached out by the media, he admitted to having tried to sell some of the nude photos for US$100 each on Reddit, under the nickname BluntMastermind, but denies being at the origin of the leak. However, he seems to have the necessary skills (he's a server admin) and posted screenshots with strong resemblance to those on 4chan (he says the pictures are Photoshop work).
Also, the 4chan board on which the information was posted is the /b/ - Random board used for artistic works of fiction and falsehood.
The board's description also states: 'Only a fool would take anything posted here as fact.' This board is said to be used by Anonymous.
Twitter accounts (e.g. @Callux) posting uncensored pictures of the celebrities have been suspended, and some celebrities warned they would prosecute them.
How were those pictures accessed?
At this stage, nobody knows how the pictures were accessed. There are only rumours and assumptions.
Assuming an iCloud breach, the following scenarios can be hypothesised:
It is also possible that there is no such iCloud breach at all, or at least not the only breach involved. It indeed seems more plausible that several different hackers gathered the pictures on various sites: Dropbox, Google Drive, iCloud:
Wasn't there another iCloud attack earlier this year? Yes, indeed. You are referring to a vulnerability exploited in March 2014, when an attacker used Apple's Find My iPhone feature to lock phones and ask for a ransom.
What could Apple do to prevent this attack? Currently, there is no two-factor authentication for iCloud accounts, only for My Apple ID (which is another website).
Again, should two-steps authentication been available for iCloud as well, this might have prevented at least part of the leak: ID/password combinations harvested from previous database breaches would have not been enough to log in iCloud and download the targets' PhotoStream.
Note that Dropbox, on the other hand, does offer two-factor authentication, as an opt-in service.
What could a user do to avoid getting hacked?
Generally speaking:
1. Use different passwords for different accounts or services. If you do already share passwords between accounts, change your Apple password now;
2. Use a strong password; and
3. Remember that the cloud is not inviolably safe and, as such, enable two-factor authentication wherever possible.
Regarding iCloud specifically, one can prevent photos to be uploaded from an Apple device to the cloud by disabling Settings ? iCloud ? Photos ? My Photo Stream.
About Guillaume Lovet
Guillaume Lovet is Senior Manager, FortiGuard Labs Threat Response Team of Fortinet![](/res/img/s.gif)