Apple has finally explained why its Dev Center has been mysteriously shut down since last Thursday: An intruder broke in to the company's developer site in an attempt to steal registered developers' personal information. While Apple says it's in the process of "completely overhauling" its developer systems, updating its server software, and rebuilding its entire database, a Turkish security researcher named Ibrahim Balichas emerged claiming credit for the successful hack — and claiming he had only the best white-hat intentions.
Balic's tale is reminiscent of other security researchers who claim to have breached a third party's systems or software for the greater good. Whether Apple or affected developers will share his view that he was acting in their best interests (as well as Apple's) remains to be seen; for the time being, it's not crystal clear what went down.
Apple's take on the breach goes like this:
Last Thursday, an intruder attempted to secure personal information of our registered developers from our developer website. Sensitive personal information was encrypted and cannot be accessed, however, we have not been able to rule out the possibility that some developers' names, mailing addresses, and/or email addresses may have been accessed.... In order to prevent a security threat like this from happening again, we're completely overhauling our developer systems, updating our server software, and rebuilding our entire database.
Apple has since told TechCrunch that only developer accounts and not iTunes accounts were compromised and no credit card data was stolen. Developers, however, have reported receiving unsolicited password reset requests.
Since Apple revealed the breach, Balic has come forward to claim credit for discovering the vulnerability in the Dev Center site as well as 12 other bugs. He has also posted a video on YouTube (which at time of writing has been set to private), showing he had in his possession developer credentials extracted from Apple's developer database. However, he claims that his intention all along has been to light a fire under Apple's bottom to fix the bugs before a malicious hacker exploited them.
Balic posted his confession to the Comments section of TechCrunch. Following are some excerpts (with spelling and grammar corrected for clarity):
My name is Ibrahim Balic, I am a security researcher. You can also search my name [on] Facebook's Whitehat List. I do private consulting for particular firms. Recently I have started doing research on Apple....
In total I have found 13 bugs and have reported through http://bugreport.apple.com. I gave details to Apple as much as I [could], and I've also added screenshots. One of those bugs has provided me access to users details. I immediately reported this to Apple. I have taken 73 users details (all Apple workers only) and [provided] them as an example. Four hours [after] my final report, [the] Apple developer portal [was] closed down.
Sign up for Computerworld eNewsletters.