The 'Cloud' is DEFINITELY a Huge and Tempting Target for Hackers

2014-10-22 • SEND FEEDBACK |
Related: security

MPG advice is to avoid the Cloud as much as possible, and to never store sensitive information in the cloud. The Cloud is a Bad Idea in general, for a litany of reasons.

See also Apple iCloud: Promiscous Saving for Security Lapses.

About a week ago, MPG wrote The 'Cloud' Remains a Huge and Tempting Target for Hackers, one in a string of security-related posts over the years.

The Wall Street Journal reports today in Apple’s iCloud Service Is Under Attack in Mainland China of a widespread and highly sophisticated “man in the middle” attack:

Taiwan-based Chinese Internet activist Zhou Shuguang tested the service and found that communication channels between iCloud users and the iCloud server had been hijacked by an attacker in what is known as a “man-in-the-middle” tactic, Mr. Zhou said. Separately, Erik Hjelmvik, an analyst with Netresec AB, a network-security-software vendor in Sweden, said Tuesday he reviewed data posted online by Chinese Internet users and arrived at a similar conclusion.

“It’s evident that it’s quite massive,” Mr. Hjelmvik said. He said the perpetrators were able to attack users in different parts of China who used different Internet service providers. “The attack was quite sophisticated in that they apparently have quite a huge system set up in order to be able to intercept on such a large scale.”

The attack meant unauthorized parties would be able to decrypt the communication between iCloud users and the server, analysts said. This puts the iCloud users’ usernames, passwords, files, pictures and contacts at risk of being seen unencrypted.

Just today, I see a Chinese-origin IP attacking this site’s SSL link. The world is full of scum, and there are no security guarantees.

When a site uses TLS/SSL, a man-in-the-middle attack isn’t perfect—the user does get a warning that the security certificate is invalid. But many if not most users just will be confused, get annoyed and click right on through. NEVER, EVER do that—take the warning seriously, because it might really be a MITM attack and you’ve just logged logged your username and password in the hacker’s database. It is a fair question to ask why a browser should ever even allow a user to click through a failed certificate, but so it is.