Skip to Content
Uncategorized

Going All In on MobileMe

An attack on the service shows how convoluted some hacks can become.
July 31, 2009

A group of researchers from security firm SensePost just revealed a hack of Apple’s MobileMe service. Rather than demonstrating a weakness in the service, the feat is a model of the sheer doggedness on the part of some hackers.

The three researchers–Haroon Meer, Nick Arvanitis and Marco Slaviero–wanted to find a way to break into the service and attack other users. Here are the steps that they took:

1. Find a person with a MobileMe account who is not careful with their data

The researchers identified a person with a MobileMe account that gave a secondary e-mail for their password reset. By guessing or knowing the person’s me.com e-mail address and finding the person’s data of birth, they could have a password reset e-mail sent to another e-mail address.

2. Intercept the e-mail

The researchers figured out that the e-mail was going to be sent to a Hotmail account. When they checked that account, they found that it has been suspended because of lack of use. They re-registered the account and gained access to the MobileMe password reset message.

3. Reconfigure MobileMe

Using the reset link, they gained access to the victim’s MobileMe account. They then reconfigured it, adding their own iPhone to the account before returning the log-in credentials to the original password. Finally, they change the name of their iPhone to a JavaScript command, so that it executes every time the victim logs into MobileMe.

4. Full access

The researchers then had access to the other person’s account.

Like Sarah Palin, users that use simple password recovery clues or allow too much information to be displayed in their online profiles could be vulnerable to attack. But the MobileMe specific issues–such as the ability to send Javascript code as a Phone name- have now been fixed, according to the researchers.

Keep Reading

Most Popular

Large language models can do jaw-dropping things. But nobody knows exactly why.

And that's a problem. Figuring it out is one of the biggest scientific puzzles of our time and a crucial step towards controlling more powerful future models.

OpenAI teases an amazing new generative video model called Sora

The firm is sharing Sora with a small group of safety testers but the rest of us will have to wait to learn more.

Google’s Gemini is now in everything. Here’s how you can try it out.

Gmail, Docs, and more will now come with Gemini baked in. But Europeans will have to wait before they can download the app.

This baby with a head camera helped teach an AI how kids learn language

A neural network trained on the experiences of a single young child managed to learn one of the core components of language: how to match words to the objects they represent.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.