# How did a hacker specifically find those celebs. phones to get their nude pictures? **URL:** \ **Category:** Factual Questions\ **Created:** [September 1, 2014, 4:12pm UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163 "2014-09-01T16:12:35Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [September 1, 2014, 10:22pm UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/21 "2014-09-01T22:22:06Z")
> [@jtur88](#): > > i can understand why bored people surfing singles sites do, but not successful celebrities. Let me let you in on a little secret, it’s not just singles looking to hook up who take naked pictures of themselves. Couples do it too. Of all ages. No snark meant but you must live a very sheltered life. There are none of me floating around but it’s very common in the era of digital photography. Celebrities are in most ways regular people who do the things that regular people do. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [September 1, 2014, 10:35pm UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/22 "2014-09-01T22:35:52Z")
Yup. As I noted in another thread, my husband still has some Polaroids of me from when we were in college. (Edit: Removed non-GQ content.) Naked pictures are generally considered sexy, good wank/turn-on material, etc., even for a couple. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [September 1, 2014, 11:18pm UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/23 "2014-09-01T23:18:26Z")
> [@dofe](#): > > If this was a breach of [iCloud](https://www.icloud.com/) as the reports indicate, all the hacker needed to do is find or guess the celebrity’s Apple ID and password. The specific phones are inmaterial here. There’s probably more to it than that - icloud will alert you when a new device is used to access your stuff. ---
**Author:** ![Little\_Nemo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/little_nemo/32/3120_2.png) [@Little\_Nemo](https://boards.straightdope.com/u/Little_Nemo)\ **Post date:** [September 1, 2014, 11:27pm UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/24 "2014-09-01T23:27:58Z")
> [@hajario](#): > > Celebrities are in most ways regular people who do the things that regular people do. Celebrities are just like regular people except better looking. ---
**Author:** ![RickJay](https://avatars.discourse-cdn.com/v4/letter/r/bb73d2/32.png) [@RickJay](https://boards.straightdope.com/u/RickJay)\ **Post date:** [September 2, 2014, 12:07am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/25 "2014-09-02T00:07:31Z")
> [@jtur88](#): > > i can understand why bored people surfing singles sites do, but not successful celebrities. If you’re trying to maintain a long term relationship while doing a job that keeps you away filming three or four months at a time, maybe you do what you gotta do. Mary Winstead has been with the same man almost her entire adult life. I cannot imagine them being apart for huge stretches of time is a lot of fun. Hell, I miss my fiancee if we’re apart for two days. After two months I might start thinking about us making some sexy pictures. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [September 2, 2014, 12:37am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/26 "2014-09-02T00:37:11Z")
The huge iCloud hacking, revealing revealing nudie shots, is pretty scary to me. The presumed method is discussed here. Would any security types here care to comment on the article’s claims? It’s too technical for me, but what should I take away? Also,How bad or novel is this type of crime on cloud servers? ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [September 2, 2014, 1:26am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/27 "2014-09-02T01:26:17Z")
The method described in the article did work. It was blocked by Apple soon after it became public knowledge. In a nutshell: most methods of logging in to an iCloud account have rate limiting to prevent someone from repeatedly guessing passwords. They missed a spot, and someone wrote a brute force tool to take advantage of the lack of rate limiting. It only worked if you already knew the account’s email address, and if the account’s password is weak enough to appear in a password dictionary. No one knows yet if this was used in the celebrity scandal hack. ---
**Author:** ![dofe](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@dofe](https://boards.straightdope.com/u/dofe)\ **Post date:** [September 2, 2014, 1:30am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/28 "2014-09-02T01:30:51Z")
It should also be noted that there’s no evidence this was some single or concerted “huge” hacking event. It looks like there were likely multiple hackers working independently and over different time periods. There are also suggestions [not all hacking](http://gawker.com/everything-we-know-about-the-alleged-celeb-nude-tradin-1629340923) was done through iCloud: > [@](#): > > A Github user reportedly posted a Python script earlier today that allowed for a “brute force” attack against Apple’s iCloud service, essentially allowing hackers to repeatedly guess passwords without being shut out. That bug has reportedly been patched, and Apple is reportedly investigating. > > But it’s likely that some photos were taken through other methods, potentially including Dropbox vulnerabilities or simple social engineering tactics (well known on AnonIB) like researching and correctly answering security questions. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [September 2, 2014, 1:48am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/29 "2014-09-02T01:48:35Z")
Agreed. As for how novel the brute force attack is: it’s extremely common. Virtually anything with a login form gets hit frequently by bots guessing common passwords. It’s standard practice for server admins to limit the rate of attempted logins to frustrate those attempts. And it’s common for the smarter bad guys to seek out alternate, obscure interfaces that might not enforce rate limiting (which is what happened with the brute force attack here). Take away: Do not use weak passwords. Do not reuse passwords. Enable 2-step verification. ---
**Author:** ![cochrane](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cochrane/32/10441_2.png) [@cochrane](https://boards.straightdope.com/u/cochrane)\ **Post date:** [September 2, 2014, 1:56am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/30 "2014-09-02T01:56:18Z")
There’s another thread that asks basically the same question. > **[How did a hacker specifically find those celebs. phones to get their nude...](https://boards.straightdope.com/sdmb/showthread.php?t=732776)** > > Yesterday, some guy over on 4chan posted a tremendous amount of female celebrity nude pictures that he got from, according to most sources, the Icloud. I’m not sure I entirely believe that, but most of the celebs. are acknowledging that the pictures... ---
**Author:** ![Mahaloth](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mahaloth/32/1079_2.png) [@Mahaloth](https://boards.straightdope.com/u/Mahaloth)\ **Post date:** [September 2, 2014, 2:04am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/31 "2014-09-02T02:04:45Z")
I’m hoping we learn the details of how this was done one day. I just don’t get how they not only hacked in, but located the actual celeb’s phones. ---
**Author:** ![dofe](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@dofe](https://boards.straightdope.com/u/dofe)\ **Post date:** [September 2, 2014, 2:14am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/32 "2014-09-02T02:14:42Z")
I mentioned this in my earlier post, but you don’t need to locate anyone’s phones to download their iCloud files if you can access them. I think the problem is that the word “hacked” somehow suggests a level of technical sophistication that may not necesarily have been involved here. The most basic way to “hack” into someone’s iCloud account is to guess or somehow find out their ID and password. I’m not going to link to the page that lists the instructions on how to do this, but it’s easily searchable by anyone with basic google skills. You basically need to figure out the target’s email address, birthdays, or other relevant personal information to answer security questions, much of which is easily assessible thanks to the targets themselves via public postings on Facebook, etc. The instructions even suggest you do this at night because there’s a lower chance of the target discovering this and resetting the password. Of course, it’s not as simple as I’ve just described, but it’s not rocket science. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [September 2, 2014, 2:49am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/33 "2014-09-02T02:49:12Z")
> [@dofe](#): > > I mentioned this in my earlier post, but you don’t need to locate anyone’s phones to download their iCloud files if you can access them. OP wasn’t asking about physical phones. The question is, how did they find out the celebrities’ account IDs? They didn’t simply guess them. ---
**Author:** ![Reply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/reply/32/15952_2.png) [@Reply](https://boards.straightdope.com/u/Reply)\ **Post date:** [September 2, 2014, 2:50am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/34 "2014-09-02T02:50:00Z")
Why does everyone assume it’s hackers and not the celebs leaking it themselves for marketing? It worked for Paris Hilton, didn’t it? ---
**Author:** ![Sir\_T-Cups](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Sir\_T-Cups](https://boards.straightdope.com/u/Sir_T-Cups)\ **Post date:** [September 2, 2014, 2:55am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/35 "2014-09-02T02:55:16Z")
> [@Reply](#): > > Why does everyone assume it’s hackers and not the celebs leaking it themselves for marketing? It worked for Paris Hilton, didn’t it? I addressed this in one of the other threads with my opinion: Because the celebrities have nothing to do with each other and no connection with themselves to “allow” it to happen all at the same time. It would be a level of collusion that would raise even more questions than the hack is ---
**Author:** ![Left\_Hand\_of\_Dorkness](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/left_hand_of_dorkness/32/7156_2.png) [@Left\_Hand\_of\_Dorkness](https://boards.straightdope.com/u/Left_Hand_of_Dorkness)\ **Post date:** [September 2, 2014, 3:07am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/36 "2014-09-02T03:07:58Z")
> [@Reply](#): > > Why does everyone assume it’s hackers and not the celebs leaking it themselves for marketing? It worked for Paris Hilton, didn’t it? Because when someone tells you they didn’t consent to some sort of sexual event, and is angry about it, the default assumption is not that they’re secretly whores, attention- or otherwise. ---
**Author:** ![Mahaloth](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mahaloth/32/1079_2.png) [@Mahaloth](https://boards.straightdope.com/u/Mahaloth)\ **Post date:** [September 2, 2014, 3:43am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/37 "2014-09-02T03:43:01Z")
> [@tellyworth](#): > > OP wasn’t asking about physical phones. The question is, how did they find out the celebrities’ account IDs? They didn’t simply guess them. Yes, this is what I meant. > [@Reply](#): > > Why does everyone assume it’s hackers and not the celebs leaking it themselves for marketing? It worked for Paris Hilton, didn’t it? I think the responses to the leak this time seem genuine. They were shocked and disappointed. ---
**Author:** ![Simplicio](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@Simplicio](https://boards.straightdope.com/u/Simplicio)\ **Post date:** [September 2, 2014, 3:49am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/38 "2014-09-02T03:49:13Z")
> [@Reply](#): > > Why does everyone assume it’s hackers and not the celebs leaking it themselves for marketing? It worked for Paris Hilton, didn’t it? Jennifer Lawrence sleeps on a pile of acting awards and blockbuster money. Her launching a faux-scandal to keep herself in the public eye doesn’t make much sense, she’s already there. ---
**Author:** ![Colibri](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/colibri/32/1841_2.png) [@Colibri](https://boards.straightdope.com/u/Colibri)\ **Post date:** [September 2, 2014, 4:00am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/39 "2014-09-02T04:00:14Z")
Moderator Note: I have merged two threads on the same topic. Colibri General Questions Moderator ---
**Author:** ![Habeed](https://avatars.discourse-cdn.com/v4/letter/h/a587f6/32.png) [@Habeed](https://boards.straightdope.com/u/Habeed)\ **Post date:** [September 2, 2014, 4:03am UTC](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163/40 "2014-09-02T04:03:53Z")
It’s not looking good for Apple. A good friend of mine examined all of the leaked photos in detail. In a large number of them, the photo was a selfie taken in front of the mirror by an iPhone of some sort. Youch. Apple should have used better encryption. Also, my friend says the photos themselves are mostly nothing special. If these were random women instead of famous ones, no one would blink. The photos aren’t particularly “hot” - other internet models are physically more attractive. They are also usually taken under suboptimal conditions. [Previous page](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163.md?page=1) [Next page](https://boards.straightdope.com/t/how-did-a-hacker-specifically-find-those-celebs-phones-to-get-their-nude-pictures/697163.md?page=3)