Immersion – Uncommon Depth

by Luke Sackandy, Immersion

After Mat Honan was the victim of a crippling hack, it wasn’t the fact that he had been hacked that upset him rather the way in which it came together that left him devastated.  On Friday, August 3rd his entire digital life went up in flames in the matter of a few minutes.  That was certainly unfortunate for him. The fortunate part for us is that Mat is a very credible journalist and his situation attracted a lot of interest.  Most notably, Apple and Amazon took notice and have since closed the gaps that allowed access by the hacker, who identified himself as Phobia.

You can read in detail about this epic hack, but the amazing part is how easy it was for the hacker. 

This was not a complex hack.  Most of us could perform it.  Once Phobia was able to get those basic pieces of information, the hack took less than 10 minutes.  In 10 minutes, Mat lost everything on his MacBook including pictures of the 1st year of his daughter’s life and pictures of people who were no longer with him.  He lost all the information on his iPhone and all the information that he collected in his Gmail account over the years.

Mat initiated conversation with Phobia who agreed to share the details with the hack in exchange for not pressing charges.  Oh and by the way, Phobia is a 19-year-old kid.  Mat wanted to know why Phobia did what he did.  After all, Mat admitted that after gaining that level of access to his online life, he could have ruined him financially as well.  Phobia responded to Mat that all he really wanted was access to the Twitter account.  He wanted to be able to access the Twitter account so that he could embarrass Mat and exploit the security loopholes in the hopes that companies will fix them.

Phobia probably succeeded from that standpoint as both Apple and Amazon have taken notice and are re-evaluating their security procedures. Wired magazine tried to duplicate the hack on the Tuesday after this went public.  When they called Apple to gain access to the account, they were told that the ability to gain access over the phone is no longer available.  When they called Amazon, they were told that you could no longer add information to accounts over the phone.

More importantly, Phobia probably also exploited two, much larger issues.  The first being that, as an online society, we are becoming increasingly more relaxed when it comes to our security.  How many of us use the same prefixes for our various email addresses or feel confident storing our credit cards or other personal information online?  A lot of us; and the problem is only growing.  A hacker no longer necessarily needs to understand the “technical” side of hacking.  A hacker needs to be able to connect the dots.  If I had realized that the same information that Amazon makes visible is the same information Apple uses as security verification, I could have performed the hack myself and I have zero hacking skills. 

The 2^nd issue and perhaps more importantly is the fact that companies are making it too easy and convenient for us to be able to log in or change information to our account that the security aspect is becoming an afterthought.  The inconvenience in going through a strict and thorough process in order to gain access to an account should be a fair trade for security.  I understand that there are some responsibilities on the user’s behalf to make sure that we stay safe online.  Mat himself admitted that he should not have tied all his accounts together the way he did.  However, at what point is there an onus placed on these organizations with whom consumers trust with their most important information to work together to create some type of best-practice?  If it’s not their responsibility, then whose responsibility is it?  Consumers can take as many precautions as they want but until there is consistency with what is considered confidential information, hackers like Phobia will continue to prey on unsuspecting victims. 

This could have been much more devastating than it was.  Mat admitted that with this level of access, his financial information could have also been compromised.  With all the contacts he had accumulated as a tech journalist over the years in his Gmail account, they could have been victimized as well.  Who knows how deep this could have gone before there was any real, hardcore, old-fashioned hacking was involved? 

Thank goodness for Mat Honan, the damage stopped with his digital life.  Anyone else may not have been so lucky.

How confident are you in the security of your online life?  Do you feel vulnerable?  Let us know in the comments.