FBI and Apple investigate celebrity nude photo hacking
Jennifer Lawrence among stars whose explicit pictures were posted online
A spokesman for actor Jennifer Lawrence said they would seek to prosecute anyone who posts the stolen photos of her. Photograph: Monica Almeida/ The New York Times
Apple and the FBI are investigating an online hack that led to the posting of hundreds of explicit photos of some of Hollywood’s most famous female stars.
The leak saw British names including model Cara Delevigne and former Downton Abbey actress Jessica Brown Findlay linked to the list of around 100 famous people whose intimate pictures had reportedly been posted online.
Initial reports concluded that Apple’s iCloud service had been compromised to access the images.
The technology giant confirmed it is looking into it, spokeswoman Natalie Kerris said.
“We take user privacy very seriously and are actively investigating this report,” she said.
It has been suggested that the leak could have been down to an attack on the passwords of the individuals affected.
FBI spokeswoman Laura Eimiller said it was “aware of the allegations concerning computer intrusions and the unlawful release of material involving high profile individuals, and is addressing the matter”, adding that it would be inappropriate to make further comment at this time.
A spokeswoman for Hunger Games star Jennifer Lawrence, who is one of the biggest stars to be caught up in the scandal, said the actress had asked US authorities to prosecute whoever is posting the photos.
Liz Mahoney described the publication of the images as “a flagrant violation of privacy”.
Other stars said to have been affected by the nude picture leak include Avril Lavigne, Cat Deeley and Rihanna, with actress Mary Elizabeth Winstead, whose movies include A Good Day To Die Hard, already acknowledging pictures in which she is featured are genuine.
She wrote online: “To those of you looking at photos I took with my husband years ago in the privacy of our home, hope you feel great about yourselves.”
However representatives for the former Coronation Street star Michelle Keegan, who was reportedly on a list of stars whose pictures had been obtained, say she does not appear to have affected.
A spokeswoman for the actress said: “There’s no evidence that her phone or computer has been hacked, and nothing has appeared online to suggest otherwise either.”
Brown Findlay, best known for her portrayal of Lady Sybil in Downton is said to feature in a video in which she is naked and appears alongside an unnamed man.
A piece of computer code that repeatedly guesses passwords has been found online. The script was posted to software site GitHub, but a message has since appeared saying that Apple has issued a “patch” or fix for the bug.
“The end of the fun, Apple has just patched,” read an update on the post.
According to the post, the script uses the top 500 most common passwords approved by Apple in order to try and gain access to user accounts. If successful, it would give the hacker full access to the iCloud account, and therefore photos.
Owen Williams from technology site The Next Web, who discovered the bug, said: “The Python script found on GitHub appears to have allowed a malicious user to repeatedly guess passwords on Apple’s ‘Find my iPhone’ service without alerting the user or locking out the attacker.
“Given enough patience and the apparent hole being open long enough, the attacker could use password dictionaries to guess common passwords rapidly.
“Many users use simple passwords that are the same across services so it’s entirely possible to guess passwords using a tool like this.
“If the attacker was successful and gets a match by guessing passwords against Find my iPhone, they would be able to, in theory, use this to log into iCloud and sync the iCloud Photo Stream with another Mac or iPhone in a few minutes, again, without the attacked user’s knowledge.
“We can’t be sure that this is related to the leaked photos, but the timing suggests a possible correlation.”
Experts have pointed to the weakness of many internet users’ passwords, and basic security knowledge as being the cause for the widespread leak.
iCloud is Apple’s own cloud service, a wireless storage facility that can be used to access files remotely. Other notable services include Dropbox and Google Drive, which enable users to keep more of their files close to hand without taking up huge amounts of memory on their devices.
Stefano Ortolani, security researcher at online experts Kaspersky Lab said: “In order to make your private data more secure, you should cherry-pick the data you store in the cloud and know, and control when the data is set to automatically leave your device.”