Something smells PHISHY: It's the celeb nudie iCloud PERV trap...

Consumers are being warned to be on their guard against phishers' fake Apple emails and texts designed to exploit the publicity about this week's nude celeb picture flap. In addition to scam emails designed to trick gullible recipients into logging into phishing sites, Symantec warns of a likely upsurge in fraudulent text …

[Steven Raith]

It's like some kind of...

...circlejerk of manipulation and exploitation of poor security practises.

I've got some pictures of that circlejerk, too - just send your date of birth, postcode, bank account number, sort code and name to [e-mail] along with a pic of your wobbly bits and I'll send the whole collection to you as a zip.

Yes, it extracts to an exe - that's fine, it's just the photo viewer app!

[Anonymous Coward]

Re: It's like some kind of...

[e-mail]

it bounced you scammer

[Steven Raith]

Re: It's like some kind of...

That's what I get for using Virgin Media as an email host, eh?

*rimshot*

[Anonymous Coward]

*yawn* nothing to see here - same old same old.

[MrDamage]

nothing to see here

Are you referring to the pics of your own wobbly bits that Steve was requesting?

[chuckufarley]

It's kinda like that...

...episode of "The Simpsons" where Lisa does the science project to find out if Bart is smarter than a hamster.

[mythicalduck]

"fappening"?

Ugh, more made up crap to fill the dictionary

[Anonymous Coward]

Re: "fappening"?

How do you think new words get there? They don't exist in some Platonic realm so that when somebody finds a way of sending sound and vision signals by radio a light goes on and a god announces "you, my boy, have discovered television, and it shall be called this forever."

This one is at least witty.

[Khaptain]

Re: "fappening"?

Ono, ono, onomatopiea

Can't get the bloody tune out of my head now....

[tony2heads]

@Khaptanin

onan onan onanism-opeia

[Anonymous Coward]

Re: "fappening"?

"They don't exist in some Platonic realm..."

Yeah, but it would be cool if they did

[Pen-y-gors]

and in other news...

Vatican reveals Pope is a Catholic.

[Sir Runcible Spoon]

Re: and in other news...

Really? I thought he shat in the woods. My bad.

[Dan Paul]

Are "Apps" the real culprit?

When you look at the permissions that certain apps ask for on Android phones, full access to the picture gallery is fairly common.

Whose to say a rogue Apple app is not stealing celebutards nekkid pics?

How can you be really sure?

[Anonymous Coward]

Re: Are "Apps" the real culprit?

Well, all the slebs have iPhones, don't they, and we know that iPhone apps would never be able to do anything like that. It's only Android that has these gaping security holes. Surely?

[edit - Paris because...well it should be obvious. She is an expert on gaping security holes.]

[veti]

Re: Are "Apps" the real culprit?

The iOS app store is quite stringently policed. I've never seen an iOS app ask for access to my picture gallery, location, ID or any other personal info unless there was an obvious reason for it.

And Apple has already come up with a (pretty plausible, IMO) story of how the stuff was leaked.

[Don Dumb]

Re: Are "Apps" the real culprit?

@veti - The iOS app store is quite stringently policed. I've never seen an iOS app ask for access to my picture gallery, location, ID or any other personal info unless there was an obvious reason for it.

And to be fair iOS does make it easy to decline each individual app's request for particular services, only allowing the services you want the app to have access to.

For instance, I have allowed Facebook access to my photos (I don't keep many photos on my phone) as that allows me to upload a photo I've just taken to Facebook. However, Facebook hasn't been allowed access to location services. And I can check which apps have access to what services pretty easily at Settings/Privacy.

I don't know that well how Android handles this, does one have to allow all accesses the app requests or can you choose which services you grant the app access to (without breaking the app)?

[Anonymous Coward]

Re: Are "Apps" the real culprit?

Well given that Apple said their investigation determined it was from the security questions, presumably they had logs indicating that at least some of the celebs in question had their passwords reset via the security question. Said celeb probably couldn't login, and used the security questions again themselves to reset their password, but only after the "hacker" had swiped their photos.

Apparently some of the naked celeb pics came from Google Drive and Dropbox as well, even if the bulk were from iCloud. Because the same type of attack can work anywhere that uses 'security questions', which aren't very secure at all if you're a public figure and answer them honestly.

If an iPhone app wants access to the pictures, it will have to ask the user for confirmation, and it will only have access to the photos stored on the device. It seems some number of the photos in question had been deleted from the phone long ago. Either they were still on iCloud, or they were swiped some time ago.

[Elmer Phud]

iLaugh

as if it's not expected

[Cipher]

What if the two things are connected...

...the snag and release of the pics was phase one., the *real* op is the phishing...

[i like crisps]

Gossip Culture...

We're all suckers for it.

[Sir Runcible Spoon]

Re: Gossip Culture...

I read a news story yesterday about one of the 'celebrities' that was part of this 'fappening', some kind of gymnast who was underage when her boyfriend took the picture of her - so there were warnings that they were kiddie porn.

The bit I couldn't work out was that she also claims they were fake, which leaves several questions, mostly relating to

'if they are fake how do they know they were taken when underage' and

'if they're not then isn't the gymnast and her boyfriend in trouble?'

I saw the list of who was supposed to be part of this image dump, the only one I recognised was Kirsten Dunst and that put me off right there and then.

[tony2heads]

@Sir Runcible Spoon

To be honest when I saw the list I had no idea who 99% of them are; not that I have any idea now of what these 'celebrities' are celebrated for.

But then I am probably not the target for the phishing; running a exe file indeed ! Without uploading and chmod +x