Hasta La Gadget!

If you use the internet – and we know you do – you need to read about the massive “hacker” meltdown experienced by an online journalist this week due to security holes between cloud systems in two major networks. The “hack” as some are calling it – rather a clever realization, when it comes down to it – had one user’s account opened up with a simple phone call to Amazon. Once Amazon allowed the fake user to access one simple element in the victim’s account, the rest came tumbling down like a house of cards.

The key piece to this puzzle was the Amazon call-in policy that allowed anyone to change an email address of a user account just so long as they could identify the user’s name, email, and physical mailing address. This ability is no longer allowed as of this morning, with Amazon commenting to Wired that they changed the policy for “your security”, refusing to comment further.

The exploit – again this isn’t really a hack when it comes down to it, only needed the “hacker” to have the victim’s email – easy to guess – their full name – again, obvious – and their physical mailing address. This last bit was available, in this case, in a “whois” of a site that the victim owned. A “whois” is a listing of the ownership of a website, aka “Domain Registration Information” that many web hosts make available without question.

Once the hacker was able to change the email of his victim’s Amazon account, they were also able to see the last four digits of the victim’s credit card – these last four digits available to any person who is logged in to their own account, of course. Once the hackers had this, they were able to call in to Apple’s iCloud support with said information to “confirm” their way into his iCloud account as well. One company’s freely available account information used to easily bust in to another’s.

Now this “hole” is fixed, but you need to still be on your guard. Keep your eyes open for exploits such as these, have a peek at our post this morning about double-locking your Google account, for example, and simply stay smart.

Massive Amazon security hole “fixed” without comment is written by Chris Burns & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

A high-profile case of cloud hijacking and data vandalism has thrown new attention on iCloud, Amazon, Google and other big online names, as gaps in the ways security is handled potentially allow for hacking. Flaws in how Apple and Amazon handle account recovery have been blamed for the “digital destruction” of journalist Mat Honan’s online life, following hackers’ successful attempts to crack security on his iCloud account, gain access to his Gmail and Twitter, and then remotely lock and delete his MacBook, iPhone and iPad.

[Image credit: Louis Argerich]

At fault – at least in part – was the inexact overlap between recovery policies for Apple and Amazon accounts, Honan writes. Although he himself shoulders the blame for the ensuing permanent loss of data – which comes down to not doing enough backups – a difference in opinion on how important the final four digits of a credit card number can be between Apple and Amazon proved the key with which the hack was achieved.

“Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification” Mat Honan

Apple gave Honan’s hackers a temporary password to iCloud after they supplied his billing address and the last four digits of his credit card; the former was accessed from a WHOIS search, as Honan had used the address to register his personal site, and the latter through a manipulation of the Amazon account recovery system which reveals those digits of each saved card. The iCloud email account in question was identified via Gmail which, as Honan did not have two-factor authentication turned on, showed the partial recovery email address – m****n@me – which proved easy to guess in its entirety.

Those details allowed for unofficial iCloud access, and then everything in Honan’s OS X and iOS connected life was up for grabs. The hackers locked him out of his devices and then wiped his data using the very tools provided in Find My Mac intended to help legitimate owners protect their information.

“If you have an AppleID, every time you call Pizza Hut, you’ve giving the 16-year-old on the other end of the line all he needs to take over your entire digital life” Mat Honan

Although each company with a cloud service worth mentioning has its own data protection policies, few users stick solely to one provider. Apple claims that some aspects of its security polices “were not followed completely” but would not say if it was reconsidering how Find My Mac or other aspects of its iCloud security works; Amazon is yet to comment.

The takeaway for most users is to backup – preferably using local and/or separate cloud storage from other cloud data services relied upon – and to turn on two-step verification on Google accounts. Don’t link important accounts together, and consider having a completely separate account for recovery purposes.

When iCloud becomes the Perfect Storm is written by Chris Davies & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Dropbox has admitted that spam reported by its users over the last few weeks was the direct result of a security breach. Both login names and passwords were stolen from an unstated number of users, including a Dropbox employee. That account contained a list of clients’ email addresses, which is what the company believes led to the spam in the first place. In response, it has contacted those affected to protect their accounts and outlined several new security features. These include a two-factor authentication option coming in several weeks and a new automated feature that will check for suspicious activity. A new landing page will also show you any logins to your account, while Dropbox reheated that always-helpful advise to avoid reusing passwords on multiple websites — noting that a breach on one site can cause an entire cascade of grief.

Filed under: Internet, Software

Dropbox confirms user info was stolen, adds new security measures originally appeared on Engadget on Wed, 01 Aug 2012 04:19:00 EDT. Please see our terms for use of feeds.

Permalink TechCrunch  |  Dropbox  | Email this | Comments

Up until now, Box.net (otherwise simply known as Box) had been quietly snubbing the Windows Phone platform altogether, but today’s the day the cloud service finally ports its storage and sharing goods to Redmond’s mobile OS. As far as the app goes, Box is keeping things relatively simple — much like on iOS and Android — but adding a few tweaks to fit nicely alongside that Metro UI, including tidbits like pinning tiles to the Start screen for viewing updates on files. Of course, you’ll also be able to manage your content straight from the application, as well as locking any docs with a passcode in case “paranoia” is your middle name. Notably, Box knows it’ll have to compete directly with Microsoft’s own SkyDrive, to which Chris Yeh, VP of Platforms, says his company “will be watching carefully to see if SkyDrive gets the better integration” of the two. Regardless, folks can download the Box app now from the WP Marketplace, and best of all, it won’t cost you a single dime.

Filed under: Cellphones, Storage, Software

Box shares the app love with Windows Phone, hopes SkyDrive doesn’t get special treatment originally appeared on Engadget on Tue, 24 Jul 2012 16:22:00 EDT. Please see our terms for use of feeds.

Permalink   |  Box, Windows Marketplace  | Email this | Comments

IDriveSync has added some new features to its cloud storage service to supply and secure file synchronization between PCs, Macs, tablets, and smartphones. The service can also be used as a remote backup solution. One key new feature for the service is Visual Sharing. Visual Sharing is a drag-and-drop online interface for sharing files with contacts.

The interface for Visual Sharing allows the user to set up a contact list and after locating files they want share, the user can then drag-and-drop those files on to the contacts to share the file. Another key new feature is Facebook integration. The Facebook integration allows the user to link a Facebook account to IDriveSync. Once the Facebook account is linked, the user can access their friends list as contacts and share photos or videos with Facebook friends via private messages and wall posts.

Using the Facebook integration photos can be uploaded once to the IDriveSync account and be available to post on Facebook and for other uses. IDriveSync offers 5 GB free storage space with 150 GB costing $4.95 monthly for $49.50 annually. Users needing more space can get 500 GB for $14.95 a month or $149.50 annually. Each account supports an unlimited number of connected devices that share the same sync space. The service added support for Macs back in 2010.

IDriveSync adds Facebook integration and faster syncing is written by Shane McGlaun & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.