Identity Hijacking

A particularly drastic case of internet crime was reported by the journalist Matt Honan. Due to security flaws at Apple and Amazon, hackers got access to Honans email account. He summarizes what happened then with these words: "In the space of one hour, my entire digital life was destroyed".

This is what happened within that above mentioned hour:

• the AppleID was taken over, giving the hackers access to the me.com mailbox and iCloud
• the Google account password was changed
• the Twitter password was reset and taken over
• with the iCloud function "Find my" the iPhone, the iPad and the MacBook were remotely wiped

As it seems, the actual target of the attack was the twitter account of the popular journalist, which was used by the hackers to broadcast racist and homophobic messages. All the other damage was only done to prevent Honan to regain access to his accounts. That "collateral" damage is huge though: years of email messages in Gmail, irreplaceable family pictures etc.

It is ironic that Honan hasn't really made a mistake. All his passwords were robust - long enough and alphanumeric. The accounts were compromised due to the fact that some of them were linked, and because of security flaws that are out of the control of the user.

I always thought that internet crime was mostly about money. This case shows, that the pure identity of a person can be an attractive attack target too. 

Rolf Brugger