By now, you've probably heard about the celebrity photo leak that took place over Labor Day Weekend. The photos – which included nude and semi-nude snapshots of more than a few well-known celebrities – were published on 4Chan, Reddit and a host of other platforms, spurring some to dub the event "Celebgate," noted The Verge. Understandably, this has increased the focus on storing data in cloud applications, calling into question the security of those platforms.
The scandal: What exactly happened?
While details surrounding the event are still emerging, there are a few concrete data points that have been confirmed. The leakage included the photos – which may or may not be real – of more than 100 celebrities and public figures, such as singer Ariana Grande, television star Lea Michele, athlete Hope Solo and actress Jennifer Lawrence – who confirmed her photos were genuine. Currently, experts and investigators are unsure as to where the hack originated, but The Verge reported that at least a portion of the photos were leaked from celebrity iCloud accounts which cybercriminals infiltrated individually.
As the dissemination continued, photos appeared on various websites and underground platforms, although the authenticity of some of the images has yet to be confirmed in many cases. Soon enough, attackers and other holders began asking for funds in exchange for uncensored versions of the photos.
"It appears the intention was to never make these images public, but that somebody – possibly the previously identified distributor – decided that the opportunity to make some money was too good to pass up," noted security consultant Nik Cubrilovic.
The Verge noted that the photos appear to have been collected over several months, if not longer. At this point, the true intention of the hackers is unclear.
iCloud confirms compromisation, patches flaw
Although NPR notes that Apple initially stated that there was no evidence of a breach of iCloud or the popular Find My iPhone application, it later released a statement confirming compromisation.
"After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practices that has become all too common on the Internet," Apple stated.
The company also encouraged "all users to always use a strong password and enable two-step verification." The day before confirming the compromised accounts, Apple patched the vulnerability described, which allowed hackers to utilize a brute force attack style to guess account information. The system contained a flaw that didn't lock users out after entering incorrect information a set number of times, as Apple does within many of its services.
Are cloud applications still secure?
In response to the leakage, Apple announced that it will bolster its security protocols to ensure users' safety, including encouraging more widespread use of two-factor authentication, according to The Guardian.
Since the attack, a number of questions have been raised about the overall security of cloud systems. While users are understandably apprehensive, this was a targeted attack that in no way signals insecurity of cloud technology overall. In this case, attackers specifically infiltrated individual accounts that were not protected with all the security measures that they could have been.
Businesses and users looking to boost their cloud security can consider the use of two-factor authentication, as Apple did after the breach.
"[C]ould you ever imagine using your debit card at an ATM and not entering a PIN?" WhiteHat Security threat management expert Matt Johansen pointed out. "That's two factor, something you have (a card) and something you know (a PIN), and we all get along just fine."
Other measures, including system monitoring, can also be helpful to ensure that a watchful eye is on the lookout for any suspicious activity that could point to a breach.