iCloud Apple ID Brute Forcer

Re:iCloud Apple ID Brute Forcer by Y-bar on Friday January 02, 2015 @05:27AM (#8826314)

"Why? This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it."

I'm not a security expert but that does not sound like responsible disclosure to me. Granted, Apple is not easy to communicate with, but still…

Edit: This does indeed look like a really bad thing. At the very least one would hope that login attempts were rate limited.

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by dogma1138 on Friday January 02, 2015 @06:01AM (#8826366)

Having had to deal with apple and knowing quite a few other people who had a simmilar exprience i have a feeling that this was the only way of doing so. Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue. This for some reason is much more prevelant for their services and mobile platform (especially when it comes to "design" flaws rather than a simple software bug) than the OSX team which while might simply not reply unless it gets enough traction on the the mailing list will atleast not send you threatening letters from their lawyers.

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by Y-bar on Friday January 02, 2015 @06:12AM (#8826385)

> at worst ciminilizing people who do try and report an issue […] will atleast not send you threatening letters from their lawyers

Wow. Citation needed, please.

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by Y-bar on Friday January 02, 2015 @09:49AM (#8826874)

So, I've been googling but can't find any single instance where Apple seems to have threatened a security researcher. I'm new here on HN, but I don't understand why I was down voted. Was it seen as passive-agressive to ask, I could understand that, but any actual source would be appreciated.

We all know that anything that paints Apple in a bad light travels faster than the speed of said light and generally gets picked up by a dozen news outlets, no matter how rumour-esque it is. So it ought to be some traces of Apple taking legal actions against people reporting security issues against them, no?

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by josephlord on Friday January 02, 2015 @11:39AM (#8827377)

In general "citation needed" on its own is frowned on as it is lazy and negative adding little to the discussion. My guess is that this is the reason for downvotes.

Some claims do have to be called out and this might have be one of them. An indication that it doesn't match your experience and that you have done at least a cursory search before requesting the citation would be less likely to be downvoted.

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by matthewmacleod on Friday January 02, 2015 @10:01AM (#8826930)

Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue.

I don't think this is accurate, is it? I'm not aware of any security issue where Apple has tried to criminalise the reporter. I'm not even aware of an issue that hasn't been 'accepted'.

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by ceejayoz on Friday January 02, 2015 @10:11AM (#8826965)

I'm guessing you're mixing up Apple with AT&T. http://arstechnica.com/tech-policy/2013/07/internet-troll-we...

[ Parent | on HN ]

Re:iCloud Apple ID Brute Forcer by dsacco on Friday January 02, 2015 @11:02AM (#8827167)

I've never once had difficulty reporting a security vulnerability to Apple.

For that matter, I've never seen any of my friends in /r/netsec have difficulty either.

Slow to respond? Perhaps, if they receive many reports. Outright ignore or invalidate real flaws? Never seen it.

Do you have a data point to back this up?

[ Parent | on HN ]