One hour, one journalist, his whole digital life erased

The story

In August 2012, Wired journalist Mat Honan wrote about how his accounts were taken over in about an hour.

The attackers wanted his Twitter account. They found that his Gmail address was linked to it, and that Google’s recovery page showed part of his backup email address, which was an Apple account.

To get into the Apple account, they needed his billing address and the last four digits of a card on file. They got the address from the public registration records for his website. They got the card digits from Amazon, using its customer service process to add a card to his account, then to get into the account and see the others on file.

With those details, a call to Apple support reset his Apple password. From there they reset his Gmail, took over his Twitter account, and used Apple’s remote wipe feature to erase his iPhone, iPad and MacBook.

Honan wrote that some of it was his fault. His accounts were chained together, he had not turned on two-step verification for Gmail, and he had not backed up his laptop. He lost photos covering his daughter’s first year.

Why it mattered

Honan’s account became one of the best-known examples of accounts falling like dominoes. Each company’s support process looked reasonable on its own, but the details one company treated as harmless were exactly what another used to confirm identity. It showed that recovery email addresses, phone numbers and support processes are part of security too.

The lesson today

Each company’s process looked reasonable on its own. Linked together, they let one weakness lead to the next. Multi-factor authentication on email breaks the chain, and a backup turns a wiped laptop into an inconvenience.