Mat Honan: How Apple and Amazon Security Flaws Led to My Epic Hacking

You may have heard about Mat Honan (Wired writer) being hacked last week, with his Twitter account being compromised and the hackers using iCloud to remote wipe his iPhone, iPad and Mac. Today he’s written up a detailed article on Wired that goes through how exactly the hackers got access to it all. The scary thing is that it wasn’t done by brute force, but rather by using social engineering to trick Apple and Amazon support staff.

But what happened to me exposes vital security flaws in several customer service systems, most notably Apple’s and Amazon’s. Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information. In short, the very four digits that Amazon considers unimportant enough to display in the clear on the web are precisely the same ones that Apple considers secure enough to perform identity verification. The disconnect exposes flaws in data management policies endemic to the entire technology industry, and points to a looming nightmare as we enter the era of cloud computing and connected devices.

It’s undoubtedly a scary story about the perils of putting our entire lives in the hands of a cloud service - because more so than ever, physical access isn’t needed to wreak havoc. It’s also a friendly reminder to ensure you’re using strong passwords, isolating critical accounts and creating local backups wherever feasible as a last resort if indeed this or something similar does happen to you.

My experience leads me to believe that cloud-based systems need fundamentally different security measures. Password-based security mechanisms — which can be cracked, reset, and socially engineered — no longer suffice in the era of cloud computing.