Hackers claim Apple security breach

Fort Worth Times ^ | July 4, 2011 | By Joseph Menn in San Francisco and Maija Palmer in London

[Swordmaker]

Please respect FT.com's ts&cs and copyright policy which allow you to: share links; copy content for personal use; & redistribute limited extracts. Email ftsales.support@ft.com to buy additional rights or use this link to reference the article -

A hacking group has claimed it breached corporate security at Apple and has published what it said were two dozen administrator names and apparently encrypted passwords for a server at the US technology group.

The data was not linked to the more than 200m customer credit cards stored on the iTunes online store. The server collected survey information and therefore might have only limited use for criminals. (At least this story got it right. The breach was actually an easy thing to do in SQL and the user names and passwords applied only to the SQL database of answers to a survey involving non-secure data. See the first comment for a clarification story.—Swordmaker)

Nonetheless, the breach showed that a recent wave of cyberattacks designed in part to embarrass big companies would continue, even without Lulz Security , the pioneering group that drew wide attention for a similar, 50-day spree.

A potential Apple breach was publicised through a Twitter message from AnonymousIRC, one of many accounts associated with the cyberactivist collective Anonymous.

“Apple could be targeted, too. But don’t worry, we are busy elsewhere”, the Anonymous account wrote on Twitter.

[Swordmaker]

comments

Hackers target Apple -- not!

By Philip Elmer-DeWitt July 4, 2011: 8:29 AM ET

The vulnerability of 225 million iTunes credit card accounts has been grossly exaggerated

Source: Engadget

The headlines over the July 4th weekend were pretty scary.

• Wall Street Journal: "Computer-Hacking Group Targets Apple In Latest Attack"
• Financial Times: "Hackers Claim Attack on Apple Server"
• Gizmodo: "Apple Is Latest Company To Feel the Might of AntiSec's Hacking Power"

Coming less than a month after Steve Jobs unveiled Apple's (AAPL) iCloud project, the reports had a predictably unsettling effect.

"WOW," wrote The Ravenette on the Huffington Post's comment stream. "I guess we cant trust the Apple Cloud to securely contain all of our most important data. ... Hey if you all give me your credit card numbers and pin numbers I will keep them safe by painting them on a wall in Time Square."

In fact, the security of Apple's iTunes database is the envy of many an organization (e.g. Sony, the CIA, the U.S. Senate and the Arizona Department of Public Safety) that has felt the sting of Anonymous, Lulz Security and AntiSec (the splinter group that claimed responsibility for Sunday's prank). In eight years of operation, there has yet to be a credible claim of data hacking into iTunes or the Apple Store.

What happened over the weekend was certainly not that, as the Twitter message that announced it made clear:

Source: 9to5Mac

"Not being so serious, but well," the message posted by @AnonymousIRC read. "Apple could be target, too. But don't worry, we are busy elsewhere."

The Tweet pointed readers to a page on PasteBin where the fruits of such exploits are often posted. It contains what appears to be a list 27 user names and encrypted passwords from an SQL database for an online survey -- since taken offline -- at the Apple Business Intelligence website.

Unless adequately protected, SQL databases are famously vulnerable to SQL injection attacks -- one of the top 10 known vulnerabilities of Web applications, according to the Open Web Application Security Project. Presumably, Apple knows better than to leave the databases holding those 225 million iTunes one-click credit card open to SQL injections.

Below: The file that got posted on PasteBin.

SITE: http://abs.apple.com:8080/ssurvey/survey?id=

db: mysql table: users

[27 entries]
+---------------+
| User |
+---------------+
| admin |
| backup |
| bnewcomb |
| bulkmail |
| leung |
| masuo |
| myapp |
| process_super |
| rlinton |
| sharp |
| survey |
| web_csat |
| spbidb05 |
| status_check |
| survey_slave |
| NULL |
| root |
| NULL |
| admin |
| backup |
| backup_user |
| bnewcomb |
| bulkmail |
| masuo |
| myapp |
| root |
| survey |
+---------------+

+-------------------------------------------+
| Password |
+-------------------------------------------+
| *7AB8AAB1CB14C7997CE400CEA87B443A15FE72E6 |
| NULL |
| NULL |
| NULL |
| *5DDF97914AE903CD933CFA428E6582A214E66339 |
| *5DDF97914AE903CD933CFA428E6582A214E66339 |
| *2447D497B9A6A15F2776055CB2D1E9F86758182F |
| *2447D497B9A6A15F2776055CB2D1E9F86758182F |
| *2447D497B9A6A15F2776055CB2D1E9F86758182F |
| *2447D497B9A6A15F2776055CB2D1E9F86758182F |
| *758A94318E1CCA45D996610F8A97E6BAA48C02FE |
| *758A94318E1CCA45D996610F8A97E6BAA48C02FE |
| 2bbe9f0c59e89c66 |
| *97757F6F08362A7CBA6F30E72EB90A73C79168EE |
| *5B3643923A375B56250D11532289B2675C69AE62 |
| *45930B494440B7335C3F98DB0FD14441166B57BB |
| *FF642075DCA52A257F8DB745546F1E643D0B07DA |
| *FF642075DCA52A257F8DB745546F1E643D0B07DA |
| *35D14C41D95FA9DC79DF22641B7F9F98ECFDA55B |
| *BAFD507E802E9B17D99E22A1360CECD386149822 |
| *7AB8AAB1CB14C7997CE400CEA87B443A15FE72E6 |
| *7AB8AAB1CB14C7997CE400CEA87B443A15FE72E6 |
| *5B202DF112417035DF7A62DDC250A9ADB0F22BDD |
| *8C69224DCDC9A8FB2122952DF5B57A4AB7FE456A |
| *AEEE48760B9DCE2800776CE1FF6915FE91D8C894 |
| *406E480B04BF741F3FB65E0C8976FC856BDBF418 |
| *3D845C052A1D31F3D8D3E864735E84DF3E07C9D0 |
+-------------------------------------------+

[Swordmaker]

Hackers claim to have compromised Apple Server... but it is not what the news media is making it out to be... Security of the iTunes database has not been breached! —PING!

Apple iTunes Credit Card security is still safe Ping!



Don't attack people!

Don't respond to the Anti-Apple Thread Trolls!
PLEASE IGNORE THEM!!!

If you want on or off the Mac Ping List, Freepmail me.

[Swordmaker]

Source of "Hackers target Apple -- Not!"—CNN Money

[PastorBooks]

If those are encrypted passwords, there’s another security failure. Three passwords are repeated, two of them repeated twice and one of them is repeated four times. That would mean that the users kept the default password that was assigned to them.

Default passwords are just too easy to guess what they are.

[PastorBooks]

No, make that 4 passwords were repeated twice, and one four times.

[Leroy S. Mort]

The vulnerability of 225 million iTunes credit card accounts has been grossly exaggerated.

That being said, I had someone in Asia hijack my iTunes account a while back and buy bunch of virtual poker chips. I no longer tie a credit card to that account. The max I ever keep there at one time is a $25 gift card credit.

[antiRepublicrat]

There’s another way the press usually gets it wrong. Passwords aren’t encrypted, they’re hashed.

[dayglored]

> Passwords aren’t encrypted, they’re hashed.

Generally true. But strictly speaking, it depends on whether the cleartext password can be obtained from the other. If so, it was encrypted. If not, it was hashed. Hashing is forward-only, and often adds or discards selected information, while true encryption maintains all original information intact and therefore can be reversed (decrypted).

There's generally no good reason to encrypt passwords; hashing is sufficient since the auth test is usually just a match of the hashed forms.

But hey, Unix crypt(3) is really just a hash, using the supplied password as a 56-bit key to the DES Data Encryption Standard working on a block of all-zeroes. So the naming confusion has a long-standing basis... :)

[dayglored]

> The vulnerability of 225 million iTunes credit card accounts has been grossly exaggerated

Sure, but the purpose has been served:

Get "Apple" and "Security Breach" into the same headline! Page hits! Page hits!

Tech news writer are whores. Even the ones I like, that I agree with, are whores.

ANYTHING to get that headline with "Apple" in it. ANYTHING.

[Deaf Smith]

What does this rag have to do with Fort Worth?

[Swordmaker]

It isn’t. The site I found it linked it as that but it’s the Financial Times.