Apple cloud burst: how hacker wiped Mat's 'life'

casey weekly berwick.com ^ | 08/06/2012 | ASHER MOSES

[aimhigh]

What would you do if your entire digital life started evaporating before your eyes and there was virtually nothing you could do about it?

This is the nightmare scenario that greeted US technology journalist Mat Honan, who had all of the contents of his iPhone, iPad and Macbook Air wiped, and lost control of his Gmail and Twitter accounts, all in the span of just over 15 minutes.

[cicero2k]

The only thing I have on the cloud is a copy of my music so I can play on any device (phone, pad, PC, laptop) anywhere. Or play on someone else’s device in a social setting.

For away from the internet devices, I just download key playlists.

[the invisib1e hand]

you deserve an award for documenting that miserable experience which, by the way, I maintain is the template for much interaction with information technology, regardless of machine, provider, race, creed or color.

I don't think the socio-psychological damage is calculable.

[USNBandit]

There is one thing you may want to change about the way you are minimizing exposure. Assuming you can keep track and pay off your balance every month, a credit card is actually safer than a debit card. In essence a credit transaction is an agreement between the credit card company and the retailer. The retailer is supposed to positively id you as the proper user of the card (which they almost never do.) A debit card is more of an agreement between you and the bank, where the security feature is your pin number.

In the event of a fraudulent use of a credit card, you can dispute the charges and you can also request a limit to the amount of credit extended. With a debit card, if you get nailed by a skimmer, you are responsible.

Large scale skimmer rackets are getting more common and they are targeting debit cards by getting a bunch of card and pin sets, making new cards and hitting a bunch of accounts in near simultaneous fashion.

[Charles Martel]

“Clouds” are nothing but a new name to Internet storage. That’s all. Consumers rejected Internet storage years ago, yet, they’ll buy it if it seems like something they call it a “cloud”.

Yep, chalk one up for the marketing guys - and persistence.

As for me, I don't trust the cloud, no matter how benign Apple makes its backup logo appear. I always expect to see it change a bit with the weather forecast, I guess.

:-)

[Charles Martel]

“Clouds” are nothing but a new name to Internet storage. That’s all. Consumers rejected Internet storage years ago, yet, they’ll buy it if it seems like something they call it a “cloud”.

Yep, chalk one up for the marketing guys - and persistence.

As for me, I don't trust the cloud, no matter how benign Apple makes its backup logo appear. I always expect to see it change a bit with the weather forecast, I guess.

:-)

[risen_feenix]

The cloud allows you to access and edit documents that are stored online, so it’s a functional, everyday step above plain old storage. Some people may have less technical solutions that they claim is “the cloud”, but the real cloud is a extension of the “network drive” folks use at their workplace to store common files. This time, instead of shared users, the “cloud” is more focused on single users and multiple devices/points of access (although you do have multi-user, multi-access point uses of the cloud as well).

There is also this extension that Apple has added where you no longer personally control your devices, but are just sort of “leasing” them from Apple (even though you purchased the physical devices), which allowed this guy to have all his devices and content wiped away.

The cloud is a hackers wet dream. Combine Facebook and the cloud, and it’s hacker heaven.

[Travis McGee]

See 8. Agree?

[grundle]

And the scariest part is that he had a strong, seven-digit alphanumeric password.

There's no such thing as a "secure" seven-character password. Even when you mix different kinds of characters, seven characters is still way too short.

[roadcat]

The important thing is that I’m always running on a restored backup. If you’ve never done a full restore from a bare disk, you’re not really doing a backup. There’s no way, short of that, to know whether your backup process actually works.

All your advice is spot on! Me and the wife don't trust the cloud. Simple stuff yes, but the majority of our data stays at home. Multiple backups on different drives, one of which is rotated to a fireproof safe.

Stupid is as stupid does, I've seen so-called professionals screw up backups. 20 years ago I was one of two system engineers in charge of running an IBM mainframe site for a hospital complex. The contractors who did the initial build of the facilities were very protective of the documentation until the handover into my hands a month after going live (I spent 6 months trying to pry info out of them, they rebuffed me citing confidential proprietary b.s.).

The system had been up several weeks when there was a failure, and data needed to be retrieved. No data on the tapes, the system had written nothing on a daily basis! When me and my colleague got handover a week later, we had to rewrite and document much of the system. We also implemented regular power outage tests and data restores on a monthly basis.

[CodeToad]

Some of it. Internet storage works when used properly, but that includes never using only one storage company and using strong encryption, always having local off-site backup in case the Internet connectivity is not available, and having local on-site storage with fire proof vault or containers. “Disaster Recovery” is only part of a “Business Continuity Plan”.

If the worst possible disaster hit a business, the local office affected should be back in business within hours. The global business would have never faltered. That’s is a Business Continuity Plan.

The systems I work were created over a 40 year period and over $1 billion in costs. Imagine if a simple fire destroyed everything or the Cloud allowed unauthorized access and the world could see the secrets.

[CodeToad]

P.S. Cloud for document storage and manipulation, no way in Hell. You the user have no way of verifying that a document actually is encrypted and secure from prying eyes or hackers. You also have no clue about their backup plan. Imagine one day Apple releasing the following press release: “We’re sorry, but this one computer system in BFE burned up. Nothing was being backed up as we thought. Everything is lost. Sorry.” Their computer geeks are no better than anyone else’s geeks, including you, the user. I use Internet storage, but everything sent to those places is encrypted by me then uploaded.

[Bubba_Leroy]

The only thing I have on the cloud is a copy of my music so I can play on any device (phone, pad, PC, laptop) anywhere.

I use an internet backup service to store an encrypted backup of my network. This is the last line of defense in my redundant backup system (onsite backups, backups to removable hard drives that I rotate off site, and finally internet backup). For a long time I resisted adding internet backups to the mix, but ultimately decided that with proper encryption the data was as secure as the data in my office.

Unlike many small businesses, I encrypt all of my office hard drives. If you don't and someone breaks into your office and steals a computer, all of your data can be at risk.

I also use Dropbox and Amazon cloud storage, but only for music, ebooks and other files that I have no concern about anyone else accessing.