iPhoneDevSDK Details What Led to Apple, Facebook Hacking

In January, a number of Apple employees had their Macs compromised following visits to the popular iPhoneDevSDK forum. Employees from Facebook and likely dozens of other companies were compromised as well. In a blog post today, site owner Ian Sefferman shared some limited details* about what happened and what the site is doing about it.

Most notably, the attack was reportedly ended by the hacker on January 30, 2013, meaning the site believes that there is no ongoing threat.

Iphonedevsdk

What we've learned is that it appears a single administrator account was compromised. The hackers used this account to modify our theme and inject JavaScript into our site. That JavaScript appears to have used a sophisticated, previously unknown exploit to hack into certain user's computers.

We're still trying to determine the exploit's exact timeline and details, but it appears as though it was ended (by the hacker) on January 30, 2013.

As with Facebook, it's important to stress that we have no reason to believe user data was compromised.

Eric Romang has done some additional detective work on the the attack, laying much of the blame on Java itself. Last month, Apple twice blocked Java 7 from working on users' Macs, perhaps after the company discovered that its own machines had been compromised.

* URL to blog post: http://iphonedevsdk.com/forum/site-news-announcements/111889-iphonedevsdk-compromised-what-happened-and-how-we-are-dealing-with-it.html -- We've avoiding linking it due to the recent hack at that site.

Top Rated Comments

newagemac Avatar
146 months ago
Is it Java or Javascript? Those are two entirely different things. Java is a plugin with security holes and can be disabled. Javascript is not Java in any way, shape, or form and is not a plugin. It is now as basic to the web as HTML and CSS. You shouldn't disable Javascript unless you want to break pretty much any modern website.

One of the dumbest things ever done on the web was giving it the name of "Javascript". Why the heck there hasn't been a movement to change the name puzzles me.
Score: 12 Votes (Like | Disagree)
iGrip Avatar
146 months ago
Insecure?

So lots and lots of big giant companies were hacked. It was the fault of some third party.


But all we hear about is that Apple was hacked! Apple has lousy security! Anybody who owns any Apple anything is in SERIOUS DANGER! Run for the hills, but only after destroying all Apple products!

Typical. Apple is just the whipping boy of the mainstream media.

They go into a frenzy and let everybody else have a pass. But not Apple. They act like it is all Apple's fault. They pick on Apple. It is not FAIR! Apple is a scapegoat. Everybody who owns any Apple anything is seen as a lesser person because of this stuff. A complete and total idiot.

I for one am sick of it.

/s

----------

Well, I use Safari with Java disabled, AdBlock, and Click to Flash. I had been thinking of adding one of the NoScript extensions, but haven't gotten around to it yet. Unfortunately, I got suckered in by a Phishing attempt a few days ago (it's no longer safe to check your email before you're fully awake...) and am wondering what to do about it.

Change all of the affected passwords. Close any credit card accounts that were compromised. If you gave your SS number, there is nothing that can be done about that.
Score: 4 Votes (Like | Disagree)
Sean4000 Avatar
146 months ago
and THIS is why "noscript" is mandatory on all of my company's computers.
Score: 4 Votes (Like | Disagree)
jlgolson Avatar
146 months ago
Is it Java or Javascript? Those are two entirely different things.
Apparently they used a JavaScript exploit to inject Java code. It's all a little unclear at the moment. Hopefully Facebook or (less likely) Apple will post a play-by-play going into exactly what happened at some point.
Score: 3 Votes (Like | Disagree)
SeattleMoose Avatar
146 months ago
After all this java stuff, I went into Safari and disabled Java (not JavaScript) and guess what? Safari is INDEED snappier!!! (no joke...it really is).

And I agree with a previous poster, Apple is the media's favorite whipping boy right now. Wallstreet's lapdog, the media, is being used to manipulate AAPL stock prices via fear and gloom. When they have driven it down low enough...the sharks will buy-up AAPL yet again...run a bunch of positive articles (PUMP)...followed by yet another DUMP when it gets to their target "high" value. Then they'll place puts on AAPL, run more gloom and doom stories, and make money on the way down too. And then you have Einhorn, the hedge fund "humanitarian" who simply wants to raid the APPL cash pile for his elite clients. It has already been proven that AAPL stock volatility was tied directly to hedge fund manipulation. Expect more...unfortunately. Wallstreet is just a steaming pile.
Score: 2 Votes (Like | Disagree)
PinoyAko Avatar
146 months ago
The Java update yesterday was magical and revolutionary. :apple:
Score: 2 Votes (Like | Disagree)

Popular Stories

Delta Feature

Delta Game Emulator Now Available From App Store on iPhone

Wednesday April 17, 2024 9:58 am PDT by
Game emulator apps have come and gone since Apple announced App Store support for them on April 5, but now popular game emulator Delta from developer Riley Testut is available for download. Testut is known as the developer behind GBA4iOS, an open-source emulator that was available for a brief time more than a decade ago. GBA4iOS led to Delta, an emulator that has been available outside of...
iOS NES Emulator Bimmy Feature

NES Emulator for iPhone and iPad Now Available on App Store [Removed]

Tuesday April 16, 2024 11:33 am PDT by
The first approved Nintendo Entertainment System (NES) emulator for the iPhone and iPad was made available on the App Store today following Apple's rule change. The emulator is called Bimmy, and it was developed by Tom Salvo. On the App Store, Bimmy is described as a tool for testing and playing public domain/"homebrew" games created for the NES, but the app allows you to load ROMs for any...
iPhone 15 Pro Action Button Translate

All iPhone 16 Models to Feature Action Button, But Usefulness Debated

Tuesday April 16, 2024 6:54 am PDT by
Last September, Apple's iPhone 15 Pro models debuted with a new customizable Action button, offering faster access to a handful of functions, as well as the ability to assign Shortcuts. Apple is poised to include the feature on all upcoming iPhone 16 models, so we asked iPhone 15 Pro users what their experience has been with the additional button so far. The Action button replaces the switch ...
maxresdefault

Hands-On With the New App Store Delta Game Emulator

Wednesday April 17, 2024 12:19 pm PDT by
A decade ago, developer Riley Testut released the GBA4iOS emulator for iOS, and since it was against the rules at the time, Apple put a stop to downloads. Emulators have been a violation of the App Store rules for years, but that changed on April 5 when Apple suddenly reversed course and said that it was allowing retro game emulators on the App Store. Subscribe to the MacRumors YouTube channel ...
iOS 18 Siri Integrated Feature

iOS 18 Will Add These New Features to Your iPhone

Friday April 12, 2024 11:11 am PDT by
iOS 18 is expected to be the "biggest" update in the iPhone's history. Below, we recap rumored features and changes for the iPhone. iOS 18 is rumored to include new generative AI features for Siri and many apps, and Apple plans to add RCS support to the Messages app for an improved texting experience between iPhones and Android devices. The update is also expected to introduce a more...