Meet the police forensic tool that made the iCloud celebrity nudes leak possible

Meet the police forensic tool pervs used to steal celebrity iCloud nude photos


Celebgate hack
The iCloud accounts of numerous Hollywood celebrities have been hacked, with naked images being sold for Bitcoins. (Picture: Killian Bell)
Illustration: Killian Bell/Cult of Mac

Blame for the flood of celebrity nude photos that hit the Internet has been rotating from the pervy hackers that ripped the pics, to Apple, to the creator of iBrute, but while the FBI and Apple continue to investigate the source of the leak, there’s one tool that has gone unmentioned: the police forensic tool that made it all possible.

One of the key elements behind the iCloud nudes leak is a piece of software created by Elcomsoft that allows attackers to impersonate a target’s iPhone and download its entire iCloud backup, and you don’t even have to be a cop to get it.

After digging into the source of the leak, Wired reports that Elcomsoft Phone Password Breaker (EPPB) has become the tool of choice among AnonIB rippers – the 4chan offshoot that may have sourced the leaked nudes – who have honed the process of stealing iPhone pics down to a science. The Russian-based forensic firm Elcomsoft sells the software without proof of government credentials for $1399, but bootleg copies can be easily torrented for free.

Once an attacker has a user’s AppleID and password, EPPB can access all of the backup’s data “without the consent or knowledge of the device owner,” boasts the company’s website. Security experts pointed to Alexey Troshichev’s iBrute software tool as the culprit of the leaks, by giving attackers access to victim’s accounts. But by using Elcomsoft’s tool, attackers can download the entire iPhone backup as a single folder, giving them much more data (texts, videos, contacts, app data, etc.) than just Jennifer Lawrence’s naughty bits.

Female celebrities have been in the spotlight during the attack, and Apple has already denied that a “breach in any of Apple’s systems including iCloud or Find my iPhone” in the “very targeted attack,” but as Sam Biddle at Valleywag explains, every iCloud user is vulnerable to attack, whether you’re Kate Upton or a regular nobody:

“The idea that only celebrities are being targeted is horseshit. There are people out there ripping the iCloud accounts of ordinary people, right now… It’s absolutely not a “targeted attack”—it’s a casual free-for-all, taking advantage of Apple’s pathetic security system. And this is just one website on a very big internet.”

Biddle points to a group of AnonIB “iCloud rippers” who share stolen photos from girls who aren’t even famous. Anyone is open to being targeting as long as you’ve got their Apple ID and password, and plenty of veteran rippers are on-hand to help wanna-be hackers with any problems they run into along the way.

With the announcement of the iPhone 6 just seven days away, Apple certainly wants to squash the iCloud leak controversy as quickly as possible. For now the company isn’t admitting that iCloud is vulnerable to someone easily guessing your password via password recovery, but in the meantime we recommend turning on two-factor authentication for Apple ID.


Daily round-ups or a weekly refresher, straight from Cult of Mac to your inbox.

  • The Weekender

    The week's best Apple news, reviews and how-tos from Cult of Mac, every Saturday morning. Our readers say: "Thank you guys for always posting cool stuff" -- Vaughn Nevins. "Very informative" -- Kenly Xavier.