July 22, 2013 at 12:00Security Specialist Tells Apple Developer Center Hack
Since Thursday, the Apple Developer Center has been closed for some work. The developers were wondering what happened, whether it was a new iOS beta or planned work. And the more time has passed since the close, the more speculation arose about this. Typically, such work is completed in a few hours.
This morning, developers registered with the Developer Center received an email that reads:
Almost simultaneously with this news, there was news from TNW: " The security specialist reported the vulnerability found, but did not steal data ." It turns out that security specialist Ibrahim Baliç was looking for vulnerabilities in Apple sites. He found 13 vulnerabilities and reported them to Apple through bugreport.apple.com . In the description of one of the vulnerabilities that allowed access to the personal information of developers, Ibrahim cited personal data of 73 Apple employees. As he writes: "solely to show the hacking process and help Apple fix the vulnerability."
Some time later, a video appeared from which it is clear that he got access to more than 100,000 records and you can even see how the process of obtaining developer data went and what data he gained access to. And all this "just to check how deep I can penetrate"
PS If you have an account in the Apple Developer Center - do not forget to change the password as soon as possible .
PPS There was not enough karma to transfer to the Apple hub. :(
This morning, developers registered with the Developer Center received an email that reads:
On Thursday, the cracker tried to access the personal information of registered developers. Important personal information was encrypted and could not be accessed, however, we do not exclude the possibility that an attacker could gain access to the names of some developers, their addresses and emails. We stopped the site immediately and have been working around the clock since Thursday.
To eliminate this kind of threat in the future, we update software on servers, completely rebuild the database and reinstall everything on the computers of developers. We apologize for any inconvenience caused due to the unavailability of the site and we hope that it will resume work in the near future.
Almost simultaneously with this news, there was news from TNW: " The security specialist reported the vulnerability found, but did not steal data ." It turns out that security specialist Ibrahim Baliç was looking for vulnerabilities in Apple sites. He found 13 vulnerabilities and reported them to Apple through bugreport.apple.com . In the description of one of the vulnerabilities that allowed access to the personal information of developers, Ibrahim cited personal data of 73 Apple employees. As he writes: "solely to show the hacking process and help Apple fix the vulnerability."
Some time later, a video appeared from which it is clear that he got access to more than 100,000 records and you can even see how the process of obtaining developer data went and what data he gained access to. And all this "just to check how deep I can penetrate"
PS If you have an account in the Apple Developer Center - do not forget to change the password as soon as possible .