Wednesday, August 08, 2012 quickly changes policy that led to digital destruction of customer's life

What a difference a day - and a lot of publicity makes. has quietly closed the security hole that allowed a Wired writer's digital life to be destroyed.

Factory Direct Pricing. Free Shipping and NO GST!
While that statement might seem slightly hyperbolic, you might agree when hearing the details.  Matt Honan saw his Gmail account deleted, his Twitter account hijacked, and one-and-a-half years worth of pictures of his infant daughter deleted.  In addition, everything else on hie MacBook Pro, iPad and iPhone were wiped.

At least part of the hack that led to the above was a result of a rather "open" loophole in's security. Prior to Tuesday, allowed people to call customer support and change the email address associated with an account or add a credit card number as long as the caller could provide three relatively easy-to-find pieces of information: name, email address and billing address.

The prior policy was exploited by hackers who gained control of Matt Honan's account. Once the main hacker (who called himself "Phobia" in his communications with Honan) had control of Honan's account, he was able to view the last four digits of a credit card linked to the account ( does not expose all the digits of a credit card when a customer views their account profile).

iolo System Mechanic® - Fix, Speed Up Your PC ...Automatically
What good was that? The hacker used those four digits to fool Apple customer service into giving him access to Honan's Apple ID, and thus iCloud. In turn, he wiped Honan's iPhone, iPad and MacBook Pro, deleted his Gmail account, and gained access to as his Twitter account.

It was the Twitter account that was the actual target, and just for lulz.

On Tuesday, that policy was changed. Phone calls to customer service confirmed the change, although there was no "public announcement." However, CS personnel who discussed the policy change with us said that it had been done to increase account security, and that the change had been made only that morning.

It's cold comfort to Honan, but it's something that other customers can be happy about.

No comments: