The online hack that led to the posting of hundreds of explicit photos of some of Hollywood’s most famous female stars could have been down to an attack on their passwords.
Stars including actress Jennifer Lawrence and model Kate Upton saw intimate photos posted on forum site 4chan, with some reports initially concluding that Apple’s iCloud service had been compromised to access the images.
A piece of computer code that repeatedly guesses passwords has been found online. The script was posted to software site GitHub, but a message has since appeared saying that Apple has issued a “patch” or fix for the bug.
“The end of the fun, Apple has just patched,” read an update on the post. The technology giant is yet to make any comment on the incident.
It is believed that 101 celebrities are thought to have been victims of the computer hacker.
The hacker broke into the stars’ iCloud accounts and published the photos on image website 4Chan, in what is thought to be the biggest celebrity hacking scandal ever.
The Hunger Games starJennifer Lawrence was one of the hardest hit, with the hacker claiming to have 60 intimate photos ranging from her wearing a bikini or lingerie to fully nude and sharing some of them in exchange for online currency bitcoins.
British stars including Michelle Keegan, Cara Delevigne, Cat Deeley and Kelly Brook were targeted, along with celebrities Rihanna, Lea Michele, Hilary Duff, Kaley Cuoco, Kim Kardashian, Selena Gomez, Vanessa Hudgens, Kate Bosworth, Victoria Justice, Emily Browning, Candice Swanepoel, and Kate Upton.
Some stars have acknowledged the images are real while others have said the snaps of them are fake.
A spokesperson for Lawrence said: “This is a flagrant violation of privacy. The authorities have been contacted and will prosecute anyone who posts the stolen photos of Jennifer Lawrence.”
Die Hard star Mary Elizabeth Winstead, another victim, tweeted: “To those of you looking at photos I took with my husband years ago in the privacy of our home, hope you feel great about yourselves.
“Knowing those photos were deleted long ago, I can only imagine the creepy effort that went into this. Feeling for everyone who got hacked.”
But former child star Victoria Justice claimed that the photos of her were fake, tweeting: “These so called nudes of me are FAKE people. Let me nip this in the bud right now. *pun intended.*”
According to the GitHub post, the script uses the top 500 most common passwords approved by Apple in order to try and gain access to accounts. If successful, it would give the hacker full access to the iCloud account, and therefore photos.
Owen Williams from technology site The Next Web, who discovered the bug, said: “The Python script found on GitHub appears to have allowed a malicious user to repeatedly guess passwords on Apple’s ’Find my iPhone’ service without alerting the user or locking out the attacker.
“Given enough patience and the apparent hole being open long enough, the attacker could use password dictionaries to guess common passwords rapidly. Many users use simple passwords that are the same across services so it’s entirely possible to guess passwords using a tool like this.
“If the attacker was successful and gets a match by guessing passwords against Find my iPhone, they would be able to, in theory, use this to log into iCloud and sync the iCloud Photo Stream with another Mac or iPhone in a few minutes, again, without the attacked user’s knowledge. We can’t be sure that this is related to the leaked photos, but the timing suggests a possible correlation.”
Experts have pointed to the weakness of many internet users’ passwords, and basic security knowledge as being the cause for the widespread leak.
iCloud is Apple’s own cloud service. It can be used to access files remotely. Other notable services include Dropbox and Google Drive, which enable users to keep more of their files close to hand without taking up huge amounts of memory on their devices.
Stefano Ortolani, security researcher at online experts Kaspersky Lab said: “In order to make your private data more secure, you should cherry-pick the data you store in the cloud and know, and control when the data is set to automatically leave your device.”
© Irish Examiner Ltd. All rights reserved
More in this section