An interesting aspect of information security is how it periodically collides with other industries and subcultures. This was the case this week as dozens of celebrities fell victim to hackers who leaked hundreds of private photographs and videos stolen from web based storage services.

A number of personal and private nude images from high profile celebrities started appearing on online image boards and forums – most notably on anon-ib, 4chan and reddit – last week. At first, the pictures didn’t get much attention since they were being ransomed (that is, censored previews being shared in the hope somebody would purchase them). It was only after a number of intermediaries purchased the images and posted complete nudes in public forums that the story exploded.

At least a dozen celebrities were affected by the photo dumps, with over 400 individual images and videos. A list of celebrity names published anonymously, akin to a sales brochure, suggests that over 100 individuals have had their personal data compromised.

After the story broke, I spent some time immersed in the crazy, obsessive subculture of celebrity nudes and revenge porn trying to work out what they were doing, how they were doing it and what could be learned from it.

The celebrities hacking incident seems to only be scratching the surface. There are entire communities and trading networks where the data that is stolen remains private, or rarely shared. The networks are broken down horizontally with specific people carrying out specific roles, loosely organised across a large number of sites (both clearnet and darknet) with most organisation and communication taking place in private (email, IM).

The communities’ goal is to steal private media from a target’s phone by accessing cloud-based backup services that are integrated into iPhone, Android and Windows phone devices. To access the cloud-based backup requires the user’s ID, password, or an authentication token.

The roles in the networks break down as:

Users who scour Facebook and other social media looking for targets and collecting as much information as possible. Data collection includes utilising public record services and purchasing credit reports; obtaining data on a target includes setting up fake profiles, friending or following friends of the target, being persistent with extracting information that might help answer secret questions, approaching male friends of the target, etc.

Users who use the target data to retrieve passwords or authentication keys. There are numerous methods here, and most have tutorials available online. The most common are Remote Access Tools (RATs), phishing, password recovery and password reset. RATs are simply remote access tools that the user is either tricked into installing via private messages or in an email (link or an attachment) or that someone close to the target will install on their phone or computer with physical access. Phishing is sending the target an email with a password reminder or reset that tricks the user into entering their password into a site or form the attacker controls. Password reminder is gaining access to the user’s email account (again using secret questions or another technique) and then having a reminder link sent to access the cloud storage. Password reset is answering the date of birth and security question challenges (often easy to break using publicly available data – birthdays and favourite sports teams are often not secrets).

Users who take a username, password or authentication key and then “rip” the cloud-based backup services using software and toolchains.

Collectors who aggregate the data stolen by other users and organise it into folders. The two most popular services to use are Dropbox and Google Drive. The collectors will create preview images for each set and email them around to their contacts. Email addresses for collectors or those willing to trade or sell are available by referral, usually via somebody offering a hacking service.

Facebook Twitter Pinterest ‘It would be a good idea for Apple to kill the interface on signup that shows new users if their email account is available to use as an iCloud account or not’. Photograph: Alamy

The frequent source of new leads for targets seems to be newcomers who know somebody they want to hack and have stumbled onto one of the networks offering their services. The new contributor will offer up a Facebook profile link, plus as much information as is required by the hacker to break the account, plus possible assistance in getting a RAT installed if required. In exchange, the hacker will supply the person providing the lead with a copy of the extracted data, which they will also keep for themselves. This was one of the most unsettling aspects of these networks to me: knowing there are people out there who are turning over data on friends in their social networks in exchange for getting a dump of their private data.

Apple accounts seem particularly vulnerable because of the recovery process, password requirements and ability to detect if an email address has an associated iCloud account. The recovery process is broken up into steps and will fail at each point.

While Apple do not reveal if an email address is a valid iCloud address as part of the recover process, they do reveal if it is valid or not if you attempt to sign up a new account using the same email – so verification (or brute force attempts) are simple. The second step is verifying the date of birth and it will pass or fail based on that data alone so can be guessed, while the last step are the two security questions.

It would be a good idea for Apple to kill the interface on signup that shows new users if their email account is available to use as an iCloud account or not. It would also be a good idea to make the recovery process one big step where all data is validated at once and the user is not given a specific error message. It would also be wise to attach rate limits and strict lockout on this process on a per-account basis.

To reiterate what the main bugs are, we have in order of popularity / effectiveness:

Password reset (secret questions / answers)



Phishing email



Password recovery (email account hacked)



Social engineering / RAT install / authentication keys

Once they have access to the account, hackers have access to everything – they can locate the phone, retrieve SMS and MMS messages, recover deleted files and photos, remote wipe the device, and more. The hackers here happen to focus on private pictures, but they had complete control of these accounts for a period.

There is an incredible amount of hacking going on. On any day, there are dozens of forum and image board users offering their services. While many of those are scammers, they will still steal the data, and sell it or trade it. It was also incredibly easy for some of those involved in distribution of the latest leaks to be publicly identified, and for servers with dumps to be found.

The darknet forums provide a lot of tips in terms of hacking steps to follow, and also provide databases of passwords, users and dox – but in terms of distributing content, they are usually a step behind the publicly available image boards. They are definitely more resilient in terms of keeping content up once it is published, and might become more popular with users if more data is leaked. Overchan and Torchan have in the past day or longer been full of new users requesting darknet links to the leaked content, and they receive them.

Here, it’s important to note that McKayla Maroney was underage when her pictures were taken, which means that to have her screenshot is an admission of possession of child pornography. Reddit mods on the fappening sub are desperately asking users to remove any images of her and other underage celebrities (I personally don’t distinguish between somebody who stole the data directly and somebody else who “only” bought that data with the intention of selling it for a profit to the public).



For this reason among others, it seems that this hacking scandal have gone wrong for a lot of other members of the involved network over the past few days. It appears the intention was to never make these images public, but that somebody decided that the opportunity to make some money was too good to pass up, and decided to try to sell some of the images.

My theory is that other members of the ring, seeing the leaks and requests for money, also decided to attempt to cash in thinking the value of the images would soon approach zero, which lead to a race to the bottom between those who had access to them.



So where does that leave the rest of us Internet users?

In terms of staying secure, the most obvious solutions are to pick a better password, set your security answers to long random strings and enable two-factor authentication. Further, it is a good idea to ring-fence your email – use one email address that remains private for sensitive accounts such as your online banking and cloud storage, and then a separate account for communications whose address is made public.

There is no privacy mode in phones and they lump together all your data and metadata in one large bucket – the only solution if you wish to retain a more private or more anonymous profile is to run a separate phone with the account on there belonging to an alias. There is a reason why drug dealers carry multiple phones: it tends to work in terms of segregating your real identity.

At the end of the day, there is no software that users will ever be able to install or upgrade that will make them completely secure. The responsibility is on both vendors and users. But users need to be aware of good password practices, as well as the basics of anonymity and security.

Find a longer version of Nik’s piece here