Last week, we discussed a couple of breaches that hit Apple’s developer site and Viber’s support site. As it turns out, that wasn’t the last chapter in either story. This week brings additional information, showing that there was more going on than was initially apparent in both cases.
On Monday last week, Apple announced that their developer site had been hacked several days earlier, and took down the site down until it could be securely restored. As of this morning, the Apple developer site is largely back up and running, which is the good news. The disconcerting news is that the story of the hacker who took credit for the hack brings up more questions than answers.
Clearly the Apple developer site had an issue that needed securing. The researcher seems to have found quite a few bugs in the site, and assumed that the bugs were the cause of the Apple Developer site needing to be secured. But are the two directly connected? Email addresses provided to The Guardian as proof appeared to be defunct or invalid. We may never know for certain.
A couple of days later, Viber had their turn under the microscope as hackers defaced their support site. It turned out that Viber employees had been phished, which is what allowed the hackers in. But that wasn’t all they were able to access, and Viber had a rough weekend as a result. Twice, its App page was defaced with messages similar to the previous attack. They had apparently tried to revoke the hackers’ access to their iTunes Connect account and it hadn’t worked, which is what allowed both App store attacks. If this is true, it’s something else Apple will need to secure in short order.
In both cases, the attacks were more annoying than damaging. Minimal customer information was accessed, and both companies have worked quickly to fix the problems.
