Celebrity nudes hacked in iCloud Scandal

Apple says reports of a breach in its iCloud are false. Hackers were able to access celebrity accounts and steal personal information, including nude photos. A source close to the investigation says hackers used a scam called phishing to steal personal information. Apple says hackers targeted specific individuals and a flaw with iCloud or the Find My iPhone app were not responsible. Joining us now via Skype from Boston is Robert Siciliano. I hope I pronounced that right, Robert. He's an identity— Thank you. He's an identity theft expert. With Hotspot Shield. Good morning.

Good morning.

So, uh, is this comforting to people that this is not an iCloud or Find My iPhone problem?

Well, the fact that it is, uh, individuals who are being affected opposed to all those connected to iCloud, that's a good thing, meaning that those individuals were insecure, whereas iCloud basically is secure.

So the way the hackers got this was through phishing. Can you talk about what that is and how we could protect ourselves from that?

That is probably how they did it, which means that the bad guys found the email addresses of the celebs in this case, and they were able to send out emails to them saying, "Hey, it's iCloud here, it's Apple, and we need you to update your account. We have this special offer for you. Just log in via this, you know, link and you can plug in your username and password." and you get these, you know, free things or whatever. And so that phishing email is designed to look legitimate, but in fact it's not. It's designed to get your credentials, and that's what more than likely is what happened here.

Robert Siciliano, you know, talk about— that sounds like a very official email from Apple. What about these other emails that you get from— whether it's chain letters or funny videos— when should people be hesitant to click on those? When they're from their friends?

Yeah, they should always be hesitant. I click nothing. So I am very aware that all of these emails that come through could very well be from bad guys. So even if it's my Bank of America statement or my American Express statement coming in saying, you know, go check your statement, I don't click that link. I go outside into the address bar and I manually type in the address, or I go to my favorites menu, or I use my password manager. So I just don't click links in emails anymore because it's just too dangerous today.

Robert, I heard yesterday someone talking about, um, on your phone, if you take a picture, you know, uh, even if it's completely legitimate picture, just because you delete it off your phone, it could still exist in this photo stream. So you, when you think you're deleting it off your phone, you have to go back to your home computer and delete it off in a separate location as well, correct?

That's if you have photo stream set up, if you have iCloud set up. So if you are backing up all of your different photos and sharing them amongst your devices, then yes, in fact, you might delete it off your phone, but it might still exist elsewhere. So it's very important before you go clicking things on and turning things off and setting up backups and streaming and so forth, that you know what you're getting yourself into. So all these devices, they can be complicated if you don't know what you're doing. And yes, in fact, it could exist elsewhere.

Robert, help me understand this. One of the tips we've heard is to enable two-factor authentication, but, uh, there was an article that we read that said Apple's two-factor authentication doesn't protect iCloud backups or photo streams. So what, what works here?

Okay, so two-factor authentication basically is, uh, your username and your password, and then the, um, company will send you out a one-time password via your mobile phone in the form of a text message. When you enter that one-time password, that essentially, uh, gives you access to your account. So even if the bad guy had your username and your password, if they don't have your mobile for that one-time password then your account is still secure. In this case, the iCloud apparently is not protected by two-factor authentication, whereas your Apple account is. That being said, two-factor won't protect you with iCloud, but it will protect you with Facebook and Gmail and Twitter and your bank and a number of other accounts. So it's still important to activate two-factor wherever it's available.

Hmm.

And also, I know we've talked to you in the past, you say have multiple passwords and then put them in a little link so people can keep them all straight, right?

I'm glad you're paying attention. Yes. Yeah, that is very important. So the fact that people are using the same password for multiple accounts is a big problem. So let's just say your Facebook account gets hacked or you get phished via Facebook and a phishing campaign. Now the bad guy has your username and they have your Facebook password. If they try that for Twitter, they try that for iCloud, they try that for your bank, and it all works 'cause you have the same password, that's a big problem. So use different passwords for every single account. I have 650 passwords for 650 accounts.

Wow. So wait, how do you keep them all straight? I mean, come on, really?

Yes, well, that is via a password manager. So a password manager is the best way to protect your passwords. And then of course you wanna protect your wireless connection. You use Hotspot Shield VPN to protect your wireless connection. Use McAfee to lock down your antivirus. And make sure that you update your critical security patches on your operating system. Doing all these different things will lock down your accounts and make sure that your devices are protected.

All right, thank you, Robert Siciliano.

Good advice.

Thank you so much. Paul? So do I need to get my nude pictures off the cloud, or am I fine?

He never addressed that. You know what?

You don't want— when you have something good, you want to save it.

I'll put them on Facebook and go from there.