iCloud Safety: What Parents Can Learn from the Celebrity Photo Hack



The Cause of the Celebrity Photo Breach



It Can Happen to Anyone

Regardless of the way the breach occurred, it is important for parents to know that iCloud or password hackers don't just attack celebrities. Many people of all ages have been victims of similar digital attacks. 

About a year ago, SEOSocial Co-Founder Orun Bhuiyan investigated a similar breach in which his sister, who was 17-years-old at the time, had personal photos hacked from her iCloud. 

Bhuiyan says of the incident:

The photos were posted on a message board with a lengthy domain. This board essentially consisted of teenagers in rural areas guessing login data of attractive girls in their locale. Urban areas didn't have nearly as much activity as their rural counterparts which I found very unusual.

Based on their communication, I figured out that they weren't compromising passwords at all, they were resetting them using security questions. I always found security questions somewhat insecure, and it makes sense that for small towns, this approach is especially effective because everyone knows a great deal about everyone in small towns—and perhaps even more so in high schools within small towns.

The attackers—who weren't adept at computer security at all—followed a methodology that looked something like this:

1. An attacker identifies a girl from their high school. They post this on the message board and tell others that this person is a good candidate. Usually girls who had been with their boyfriend for an extended period of time (and therefore probably sent a certain genre of photo to their boyfriend) were popular targets. 

2. The attacker lists out the iCloud and email accounts of the target and her boyfriend, retrieving security questions from each service. They post the questions on the message board.

3. Message board users collaboratively answer the question: "Oh, yeah, I know that one, his first car was a blue Volkswagen Golf". Eventually, they guess enough passwords to compromise one account

4. At this point they either directly have access to iCloud or have access to an email service like Gmail which they use to reset the iCloud password. They access the iCloud photostream and download any iPhone/iPad photos they like, posting them on the message board.

Luckily, Bhuiyan was able to track down the perpetrators involved and report the activity to police. The case involving Bhuiyan's 17-year-old sister shows how disturbingly easy it is for people who aren't particularly tech-savvy to access this kind of information. 

What Parents Can Do

Securing the iCloud: The iCloud works by storing information somewhere other than the user's phone or computer, and presenting it when desired. This does have advantages, such as requiring a less powerful device on your part, saving your computer memory for other things, and letting you access the desired files from any Internet-connected location.

The big downside, obviously, is the security risk. As these files are kept elsewhere, their security is not entirely within the control of the user. The most secure solution: Ensuring that an iCloud doesn't have anything sensitive to steal.  

  • One possible measure is to add an extra layer of your own encryption to files. Some programs such as Adobe Acrobat and Office have this feature themselves, and there are programs out there like Boxcryptor which can encrypt many kinds of files. Nevertheless it bears mentioning, and should be repeated to your children, that there is no such thing as perfect security, and any measures can eventually be foiled by a determined enough hacker. 

  • Make sure that your kids' phones are set to appropriate options. The most important of these is to ensure that the option to automatically upload pictures to the cloud is turned off. They will still be able to upload things, but as it will not happen automatically, there will be a degree of removal before anything potentially sensitive is put on the iCloud.

Username and Password Security: Another big part of security against an iCloud breach, and indeed a part of all computer security, is to make sure that your kids have usernames they do not share, and passwords which are robust and difficult to guess (and obviously, which are also not shared). Usernames are generally easy to discover, but there is no reason to make things any easier for hackers, so teach your kids not to share their username with others.

Passwords are a different matter because they can be the weak link in the chain or they can be a huge obstacle to unauthorized access. Follow some of these username guidelines and go over them with your children so they understand what sort of thing to think about when coming up with a password:







Talk with your kids about these guidelines and help them to understand them. Secure passwords can be daunting and many people use just one or two across their entire Internet presence. This is a great way to find yourself compromised by hackers, so do your best to avoid such practices and to teach your children to avoid them too.

Additionally, ensure that the security questions and answers chosen for accounts are difficult and known only to yourself or your child. If the selection of security questions are limited only to questions that others could potentially know the answers to, invent an answer to one of the provided questions (just make sure that it is something you will remember later). 

Internet security will likely never be completely perfect, but with proper preparation and obedience to the best security practices, it is possible to make things so difficult that most hackers simply won't bother, and any who do will have a hard time breaching your security.

Try Bark's award-winning  monitoring service free for 7 days

Subscribe to Email Updates

Recent Posts

Posts by Topic

see all