Pr0x13 claims that he made iDict public in order to draw attention to the problem and force Apple to fix it. Online services like iCloud typically limit the number of failed log-in attempts per account in order to prevent brute-force attacks, but Pr0x13 allegedly found a way to bypass those protections. By default the tool came with a file - also called a dictionary - containing 500 commonly used passwords, but the list could have easily been extended. It worked by trying out a large number of passwords for the targeted Apple IDs. The problem came to light after a proof-of-concept attack tool called iDict was released on GitHub in early January.ĭeveloped by a user who uses the online alias Pr0x13, the tool was described as '100% Working iCloud Apple ID Dictionary attack that bypasses Account Lockout restrictions and Secondary Authentication on any account.' The company later rolled out improved security aimed at stopping hackers from accessing accounts.Apple has fixed an issue that could have allowed attackers to launch brute-force attacks against iCloud users in order to guess their passwords. Stars like Jennifer Lawrence and Kate Upton had their accounts broken into when hackers managed to bypass Apple's security-question system. ICloud was the online service that hackers broke into last year to leak naked photographs of hundreds of celebrities online. When security researchers uncover exploits in software or websites, they often privately report them to companies to avoid widespread use of security holes by hackers.

Meanwhile, questions are being raised why as to the hacking tool was released online at all. One way to make an iCloud account more secure is to use an email address that hasn't been shared online. The tool does require its users to know the email address associated with an iCloud account before it tries to hack into it. If iDict does work as described, there's very little people can do to keep their account secure. But iDict purportedly bypasses those security steps. Apple also lets people verify login attempts using their cellphone through two-factor authentication. First off, it stops people from guessing passwords over and over again by blocking 'brute force' attacks. Apple has multiple ways to stop hackers from breaking into its online iCloud service.

Idict tool