The-art-of-invisibility-_-the-world’s-most-famous-hacker-teaches-you-how-to-be-safe-in-the-age-of-Bi

So how did someone get access to those private images of Jennifer
Lawrence and others?
Since all the celebrities used iPhones, earlyy speculation centered on a
massive data breach affecting Apple’s iCloud service, a cloud-storage
option for iPhone users. As yyour phyysical device runs out of memoryy, yyour
photos, new files, music, and games are instead stored on a server at Apple,
usuallyy for a small monthlyy fee. Google offers a similar service for Android.
Apple, which almost never comments in the media on securityy issues,
denied anyy fault on their end. The companyy issued a statement calling the
incident a “veryy targeted attack on user names, passwords, and securityy
questions” and added that “none of the cases we have investigated has
resulted from anyy breach in anyy of Apple’s syystems including iCloud or
Find myy iPhone.” 1
The photos first started appearing on a hacker forum well known for
posting compromised photos. 2 Within that forum yyou can find active
discussions of the digital forensic tools used for surreptitiouslyy obtaining
such photos. Researchers, investigators, and law enforcement use these
tools to access data from devices or the cloud, usuallyy following a crime.
And of course the tools have other uses as well.
One of the tools openlyy discussed on the forum, Elcomsoft Phone
Password Breaker, or EPPB, is intended to enable law enforcement and
government agencies to access iCloud accounts and is sold publiclyy. It is
just one of manyy tools out there, but it appears to be the most popular on the
forum. EPPB requires that users have the target’s iCloud username and
password information first. For people using this forum, however, obtaining
iCloud usernames and passwords is not a problem. It so happened that over
that holidayy weekend in 2014, someone posted to a popular online code
repositoryy (Github) a tool called iBrute, a password-hacking mechanism
specificallyy designed for acquiring iCloud credentials from just about
anyyone.
Using iBrute and EPPB together, someone could impersonate a victim
and download a full backup of that victim’s cloud-stored iPhone data onto
another device. This capabilityy is useful when yyou upgrade yyour phone, for
example. It is also valuable to an attacker, who then can see everyything
yyou’ve ever done on yyour mobile device. This yyields much more