herald

Thursday 16 August 2018

'weak passwords' of stars led to barrage of leaked naked pictures

The online hack that led to the posting of hundreds of explicit photos of some of Hollywood's most famous female stars could have been down to an attack on their passwords.

Stars including actress Jennifer Lawrence and model Kate Upton saw intimate photos posted on forum site 4chan on Sunday evening, with some reports initially concluding that Apple's iCloud service had been compromised to access the images.

A piece of computer code that repeatedly guesses passwords has been found online. The script was posted to software site GitHub, but a message has since appeared saying that Apple has issued a "patch" or fix for the bug.

malicious

"The end of the fun, Apple has just patched," read an update on the post. The technology giant is yet to make any comment on the incident.

According to the post, the script uses the top 500 most common passwords approved by Apple in order to try and gain access to accounts. If successful, it would give the hacker full access to the iCloud account, and therefore photos.

Owen Williams from technology site The Next Web, who discovered the bug, said: "The Python script found on GitHub appears to have allowed a malicious user to repeatedly guess passwords on Apple's 'Find my iPhone' service without alerting the user or locking out the attacker.

"Given enough patience and the apparent hole being open long enough, the attacker could use password dictionaries to guess common passwords rapidly. Many users use simple passwords that are the same across services, so it's entirely possible to guess passwords using a tool like this.

"If the attacker was successful and gets a match by guessing passwords against Find my iPhone, they would be able to, in theory, use this to log into iCloud and sync the iCloud Photo Stream with another Mac or iPhone in a few minutes, again without the attacked user's knowledge. We can't be sure that this is related to the leaked photos, but the timing suggests a possible correlation."

Experts have pointed to the weakness of many users' passwords and basic security know-ledge as being the cause of the widespread leak.

iCloud is Apple's own cloud service, a wireless storage facility that can be used to access files remotely.

Other notable services include Dropbox and Google Drive.

Other stars said to have been affected by the nude picture leak include Avril Lavigne, Cara Delevingne and Rihanna, with actress Mary Elizabeth Winstead, whose movies include A Good Day to Die Hard, already acknowledging pictures in which she is featured are genuine.

downton

Former Downton Abbey actress Jessica Brown Findlay is another whose name has been linked with the list of around 100 stars said to be victims of the hacking.

The 24-year-old star, who also appeared in the BBC's adaptation of Jamaica Inn, is said to feature in a video in which she is naked and appears alongside an unnamed man.

Brown Findlay is best-known for her portrayal of Lady Sybil in Downton.

hnews@herald.ie

Promoted articles

Entertainment News