Apple's developer website was hacked, likely through social engineering or stolen credentials. Robert Siciliano explains how the breach happened, what it means for users, and the difference between white-hat security testing and criminal hacking.
Chapters
Well, hackers taking a bite out of Apple's intel. The company saying its developers website got hacked and that sensitive employee and financial information might have been stolen. So this tech giant can't protect itself from attacks. Is anybody really safe? Security expert Robert Siciliano. Uh, you know, when we hear that Apple was attacked, we all say, what the heck? Then there's— if Apple can't protect itself, none of us can, right?
Yeah, Apple is considered to be relatively, you know, foolproof compared to where Microsoft's at. You know, right now there are thousands of viruses targeting Mac and Apple, whereas there are millions targeting Microsoft's OS. So yeah, it's kind of scary when Apple could be compromised. But in this particular case, more than likely it was what's called social engineering where someone somewhere opened up an email and provided usernames and passwords to the bad guy.
So in other words, an inside job kind of thing?
Well, inside job meaning that might have been an employee error. They might have got tricked thinking that they were communicating with somebody internally, and then they provided their credentials, their login credentials, which gave a criminal backdoor access, and/or there were flaws in their system critical flaws that allow a hacker to remotely access their system.
You know, Robert, I mean, we hear these stories and we read about them all the time. Bank records taken, and then sometimes we see that it's often not even criminal, just people doing this for kicks. Just how difficult is it, or it really seems to be impossible, that ultimately not a major hacking won't occur with all of these companies and that the damage will be much more significant than we've ever seen so far?
Well, there's no such thing as 100% security, so there's always going to be, you know, flaws in the system. And the job of a security professional is to keep up with that, to make sure that those flaws are patched continuously. There was a report today that there might be a Turkish hacker claiming responsibility for this particular hack, who claimed that he discovered flaws in Apple's OS, or in the developer's website, and he reported to Apple. And immediately they shut it down. Now, he would be what's called a white hat hacker, but the fact that he was tinkering where he shouldn't have been, uh, that is essentially illegal. And whether or not Apple responds to that is a different story.
Well, don't— but wouldn't they reward a guy like that? I mean, I know that some of these companies actually invite hackers to attempt to hurt them, and a chance that, you know, they break a code or whatever, then they reward them. Would Apple actually reward this guy? Because you talked about it being illegal.
Well, they call that penetration testing, and when you are hired or there's essentially a contest to try to penetrate and test a network, or test and penetrate a network, that's usually permission-based, whereas when it's not permission-based, that's illegal, and they could be prosecuted. And you would think that they would welcome that type of information, but in some cases, you know, I mean, think of it like this, you know, we all know that it wouldn't take much to break into somebody's home, but you wouldn't want somebody to try to break in without your permission, right?
Right, unless someone just sold me this fancy security system and told me it was impenetrable, and then of course my next-door neighbor's young son broke into it with a crowbar. But listen, I know I'm making it probably too simplistic, but we know the threat is real, and to your point, it never ends. Robert, thanks a lot. Unfortunately, we're gonna need you a lot more on this in the future. We'll see you soon.
