Your iCloud Account Can Easily Be Hacked With a Little Info and a Call to Apple

Wired's Mat Honan has posted a lengthy report on how his iCloud account was recently hacked by a simple, and easily duplicated, phone call to Apple.

It turns out that all you need is a billing address and the last four digits of a credit card to get Apple to reset an account password, and these details are easier to obtain than you might think.

Apple tech support confirmed to me twice over the weekend that all you need to access someone's AppleID is the associated e-mail address, a credit card number, the billing address, and the last four digits of a credit card on file. I was very clear about this. During my second tech support call to AppleCare, the representative confirmed this to me. "That's really all you have to have to verify something with us," he said.

Apple spokesperson Natalie Kerris told Wired, "Apple takes customer privacy seriously and requires multiple forms of verification before resetting an Apple ID password. In this particular case, the customer's data was compromised by a person who had acquired personal information about the customer. In addition, we found that our own internal policies were not followed completely. We are reviewing all of our processes for resetting account passwords to ensure our customers' data is protected."

Today, Wired tried to use the hacker's technique themselves. They were successful.

Briefly, here's how the hacker was successful in this case. At Honan's website he found his gmail address. Using gmail's password recovery page he was shown enough of his @me.com address to decipher the full username. Then Honan's billing address was found via a whois of his website's domain. The hacker then contacted Amazon and added a fake credit card to Honan's account. Next the hacker contacted Amazon again and added a new email address to the account using the fake credit card as authorization. Using the new email account he requested a password reset and gained access to see the last four digits of all cards on file. Finally, the hacker called Apple with the email address, billing address, and last four digits of the credit card to have Apple support reset the password.

While this may seem a bit lengthy of a procedure, a delivery person could do the same without going through any of those hoops.

You can find the full story at the link below...

Read More

Comments (8)

James hoyland - August 22, 2012 at 5:25am

ALL THIS HACKING IS A LOAD OF BOLLOX AND THESE HACKERS ARE FAKE AS FUCK AND WEAK AS FUCK THEY THINK THEY KNOW EVERYBODY'S ACCOUNT PASSWORDS WHEN THEY DON'T PLUS THEY ASLO THINK THERE BIG AND HARD AND BETTER THAN EVERYBODY ELSE BUT THEIR NOT THIS FAKE HACKIN HAS GOT TO STOP AND IT STOPS RIGHT NOW BEFORE SOMEONE CALLS THE POLICE AND TRACKS DOWN WHO THE HACKERS ARE ABD THEY WILL ARREST THEM AND PUT THEM IN JAIL TILL THEY LEARN THEIR LESSON.

Reply · Like · Mark as Spam

Russell - August 8, 2012 at 8:05pm

Sounds like it was Apple's fault for using the last 4 digits as verification. Everybody knows the last 4 are visible on nearly every receipt generated, brick & mortar and online.

Reply · Like · Mark as Spam

Samsung=Shiite - August 7, 2012 at 2:46am

This is BS... He wasn't hacked -- more likely phished...

Reply · Like · Mark as Spam

PICO - August 7, 2012 at 2:41am

So in order to hack apple you have to exploit massive security holes in amazon first. Seems people are missing this point. If the account details where not compromised on amazon first then no hack would have occurred

Reply · Like · Mark as Spam

FARP.Thor - August 7, 2012 at 3:01am

But then there wouldn't be news, so let's just forget about this Amazon part of the story.

Reply · Like · Mark as Spam

Frank - August 7, 2012 at 4:44am

As mentioned in the article, the last four digits of your credit card are semi private. They are on many receipts. Ex. If you order a pizza for delivery online and pay with your credit card the delivery guy has your email, last four digits, and billing address. Bam. Access to all your info after calling Apple for a password reset.

Reply · Like · Mark as Spam

Frank - August 7, 2012 at 2:07am

They used it to remotely erase all his ios devices and macbook.

Reply · Like · Mark as Spam

James Hoyland - August 7, 2012 at 4:42pm

LISTEN HERE FRANK THE PRANK WHAT AN UTTER BLACK PACKI IRACKI OF A NIGGER YOU ARE SAYING YOU CAN GIVE THE HACKERS YOUR CONTACTS,APP,CREDIT AND THIS THAT AND OTHER YOU SHOULD BE ASHAMED OF YOURSELF PLUS YOU SHULD BE SHOT IN THE HEAD WITH A SNIPER RIFLE YOU DO NOT GIVE AND HACKERS YOU BANK DEATAILS,CONTACTS,APPS,EMAILS ECT WHAT SO EVER BECAUSE IF YOU GAVE THEM ALL OF YOUR INFO THEY CAN GET INTO YOUR APPLE ICLOUD ACCOUNT AND ERASE EVERYTHING. SOO IF I WERE YOU I WOULD CONTALT ALL THE WORLD WIDE POLICE STATIONS AND TELL THEM TO ARREST ALL THE HACKERS AND PUT THEM IN JAIL FOR 10 YEARS MAXIMUM.

Reply · Like · Mark as Spam