Nude pictures of celebrities may have been hacked using phishing scam

12

View
comments

Nude pictures of celebrities leaked online may have been stolen using a rudimentary hacking technique known as phishing rather than a sophisticated sting, experts believe.

Phishing scams involve tricking users into handing over passwords or personal information, often using an email which looks like it’s from a legitimate company asking for details.

Banks have cautioned against such scams for years, telling customers that they will never ask for account details or passwords in email messages.

But investigators probing the celebrity leaks are now thought to be looking at the possibility that at least some of the hacked star’s details may have been obtained by phishing.

Scroll down for video

Experts believe hackers may have got access to celebrity iCloud accounts using phishing, a scam which tricks users into handing over details by sending a message appearing to be from a legitimate company

Experts believe hackers used a computer to guess the answers to stars’ secret questions (below) using widely-known personal details, then used phishing attacks to get their usernames (above)

HOW PHISHING COULD WORK

In order to bypass security on an account you usually need two things, a username and an answer to a secret question.

In the case of the celebrity leaks, experts believe hackers used a programme which cracked the stars’ secret questions by making repeated guesses using personal information available online.

However, knowing the username – usually an email address associated with the account – is more difficult.

For that, hackers may have used a phishing attack to gain access to one email account, before getting the email addresses of other stars from a contact book.

Apple
confirmed yesterday that the leaks were the result of a ‘targeted
attack on user names, passwords and security questions’, otherwise known
as a brute-force attack.

In a brute-force attack a computer programme is used to repeatedly guess at a password until it finds the right combination.

In
this case, the celebrity status of the victims makes them much more
vulnerable, as so much information about them, such as the names of pets
or ex-partners, is already public knowledge.

However,
any hacker would also have to have access to the target’s user name, usually an email associated with the account, which
is where phishing comes in.

Experts
believe hackers must have compromised at least one of the stars’ accounts, and then used this account to access other email addresses,
which could have been stored in a contact book.

Then, using this information, the hackers could have gained access to other iCloud accounts, which might explain the large number of victims.

According
to TMZ, FBI investigators are looking into whether Kate Upton, Mary
Elizabeth Winstead, Jennifer Lawrence, or Lea Michele were the target of
the phishing attack.

Today actress Denise Richards revealed that she was messaged more than ten
times by suspected hackers asking for her iCloud password and threatening to
shut down her accounts if she did not respond.

Denise
Richards tweeted today that she had received over ten emails asking for
her password and threatening to shut down her accounts if she did not
respond

Kim Kardashian described this week’s celebrity iCloud hack as a ‘wake up call’

‘Whether
or not iCloud was the point of compromise in this incident, scammers
have been interested in stealing these credentials for some time,’
explained Satnam Narang from security firm Symantec.

‘These
emails contain links to phishing websites that will capture your Apple
ID credentials and send them back to the attackers.

Apple said
it was ‘outraged’ by the attacks, and advised worried customers to
update their accounts with a ‘strong’ password and enable two-step
verification.

‘Our customers’ privacy and security are of utmost importance to us,’ it said in a statement.

‘We wanted to provide an update to our investigation into the theft of photos of certain celebrities.

“In the case of celebrities, these secret questions are very easy to find
online – either in Wikipedia or by searching through some interviews”

‘When we learned of the theft, we were outraged and immediately mobilized Apple’s engineers to discover the source.’

‘After
more than 40 hours of investigation, we have discovered that certain
celebrity accounts were compromised by a very targeted attack on user
names, passwords and security questions, a practice that has become all
too common on the Internet.’

The news comes as Kim Kardashian described this week’s celebrity iCloud hack as a ‘wake up call’.