Devastating iCloud hack caused by human error

Over the weekend, former Gizmodo journalist Mat Honan had his iCloud account hacked, his Twitter account used for racist messages and all his iDevices wiped.

The hack occurred on Friday in the US by a group called Clan Vv3, and manifested to the public in the form of offensive tweets sent out first through Honan's account, then Gizmodo's.

The group had gained access through his iCloud account. He recounted in a blog post:

At 4:50 PM, someone got into my iCloud account, reset the password and sent the confirmation message about the reset to the trash. My password was a 7 digit alphanumeric that I didn't use elsewhere. When I set it up, years and years ago, that seemed pretty secure at the time. But it's not. Especially given that I've been using it for, well, years and years. My guess is they used brute force to get the password, and then reset it to do the damage to my devices.

The backup email address on my Gmail account is that same .mac email address. At 4:52 PM, they sent a Gmail password recovery email to the .mac account. Two minutes later, an email arrived notifying me that my Google Account password had changed.

At 5:00 PM, they remote wiped my iPhone

At 5:01 PM, they remote wiped my iPad

At 5:05, they remote wiped my MacBook Air.

A few minutes after that, they took over my Twitter. Because, a long time ago, I had linked my Twitter to Gizmodo's, they were then able to gain entry to that, as well.

That was it: everything gone. Honan had no other backups. His Twitter account was banned, his Gmail account has been deleted, and all the photos, documents and emails that he had stored in his devices are likely irretrievable.

But, as it turned out, the hack wasn't a brute force attack, as Honan first suspected.

An update to his blog post said:

I know how it was done now. Confirmed with both the hacker and Apple. It wasn't password related. They got in via Apple tech support and some clever social engineering that let them bypass security questions. Apple has my Macbook and is trying to recover the data.

Which meant that someone over at Clan Vv3 probably impersonated an Apple tech support person to finagle the password.

The hack occurred the same day Steve Wozniak declared that cloud computing was doomed to failure.

"I really worry about everything going to the cloud. I think it's going to be horrendous. I think there are going to be a lot of horrible problems in the next five years," he said, after joining Mike Daisey on stage after Daisey's one-man show, The Agony and the Ecstasy of Steve Jobs, in Washington.

Honan has promised that the full story will be published on Wired tonight. In the meantime, we urge you to both check your password (because it never hurts), and make sure all your information is backed up. In more than one place.