Apple, Amazon Security Fails: Time For Change

Call it the "security fail" experience for Amazon and Apple.

On Aug. 3, an "epic hack" compromised technology journalist Mat Honan's Twitter account. Along the way, the attacker--known as "Phobia"--also managed to remotely erase Honan's Apple laptop, iPhone, and iPad. Furthermore, Phobia did it by socially engineering--as in, tricking--customer service representatives at Amazon and Apple, allowing him to gain sufficient information to first access Honan's iCloud and Gmail accounts.

Obviously, a self-described 19-year-old's ability to execute a multi-layered social engineer attack also calls into question who else--intelligence agencies, criminals, or legions of bored teenagers--may have already been putting these techniques to work, only without victims ever wising up.

Who's to blame? Start with the identity verification system employed by the technology giants. "Amazon's system is partially at fault, but the weakest link by far is Apple," says Marco Arment, the co-founder of Tumblr, on his blog. "It's appalling that they will give control of your iCloud account to anyone who knows your name and address, which are very easy for anyone to find, and the last four digits of your credit card, which are usually considered safe to display on websites and receipts."

[ Learn how to protect yourself. Read 8 Ways To Avoid Getting Your Life Hacked. ]

When it comes to screening consumers, businesses are lazy. "What it comes down to is authentication--how do you verify that someone is who they say they are? Right now, the industry norm is that you provide some bits of personal information," says the threat intelligence manager for Trustwave SpiderLabs, who goes by "Space Rogue," speaking by phone. Cue the now-obvious problem: "None of that stuff is secret information," he says. "All of that is fairly easily gotten to through Google or other methods."

The failure of the security teams at Amazon and Apple to proactively spot--or else bother to address--Phobia-style attacks is glaring. (Both companies are reportedly reevaluating their checks and balances.) At the Black Hat Europe conference in Amsterdam earlier this year, penetration testers detailed gigs in which they'd been hired by a business to identify its information security vulnerabilities. Oftentimes, they found the expected flaws in Web applications. But too often, they literally also encountered unlocked backdoors to the office itself, and printouts of usernames, passwords, or other sensitive information carefully indexed inside unlocked filing cabinets.

Professional penetration testers would have made short work of Amazon and Apple, given the ease with which consumers can be impersonated. "People do this all the time, this isn't an isolated case that happened to Honan," says Space Rogue, who helped found noted consultancy @Stake, and who's previously worked for security research think tank L0pht Heavy Industries.

If businesses are lazy, so are consumers, and Honan admitted culpability in the attack against his online identity. "Those security lapses are my fault, and I deeply, deeply regret them," he wrote in a recap of the attacks. Still, after making that statement early on in his article, Honan then spent 3,300 words analyzing everything that others, including Amazon and Apple, did wrong.

To reiterate: Don't be a Honan. He failed to back up his devices to a hard drive, despite the amazing "fire and forget" Time Machine backup software included with his Apple OS X laptop. He used identical email address prefixes--first initial, last name--across numerous services, which made his account addresses easy for an attacker to guess. And he tied numerous accounts together, thus creating a single point of failure.

11 Security Sights Seen Only At Black Hat

Honan is hardly the first tech-savvy person to make these types of mistakes. Accused LulzSec and Anonymous participant Donncha O'Cearrbhail claimed to have compromised the AppleID of Ireland's top cybercrime investigator. Because the cop was also forwarding his work emails to a Gmail account that he'd set his iPhone to check, O'Cearrbhail was able to eavesdrop on a conference call between the FBI and overseas law enforcement agencies.

Unfortunately, when it comes to securing people's increasingly connected online lifestyles, there aren't any easy answers. "People want to leverage technology to make their lives easier, so they link all of these accounts together, and by doing so, they put themselves at risk," says Space Rogue. "Is it the fault of the technology companies for allowing people to do this, or people's fault? This is something that society is going to have to deal with as we move forward."

Thankfully, Honan's cautionary tale--and excellent analysis of how his life was hacked, made possible by Phobia telling all, in return for a guarantee that Honan wouldn't prosecute him--has now put this question front and center.

But should you suffer a similar fate, don't expect the white-gloves treatment afforded Honan, which has included Apple working to restore the files that were remotely deleted from his hard drive. "The victim here is a popular technology journalist, so he got a level of tech support that's not available to most of us," said Bruce Schneier, chief security technology officer of BT, in a blog post. "I believe this will increasingly become a problem, and that cloud providers will need better and more automated solutions."

What might these improved security solutions look like? As noted, Apple and Amazon can start by at least offering two-factor authentication. Given that both companies earn big bucks from running smartphone app stores and have those distribution channels, creating a two-factor smartphone app would be a natural next step. Or they could just use Google's smartphone app.

Meanwhile, for people who want to call customer service to reset a password, but who--like Phobia when he contacted Apple--lacked the answers to security questions already on file, make them jump through hoops. For example, after allowing a user to request a password reset by phone, why not "make the person call back the next day," says Tumblr co-founder Marco Arment. "If you forget your password and the answers to your security questions, it's not unreasonable to expect a bit of inconvenience." Especially if you don't want to see your digital life compromised by a social-engineering-savvy attacker.