Apple says it was hit by hackers, user data uncompromised

You will be forgiven if a sense of deja-vu engulfs you when you read this story. In almost an exact reliving of hackers attacking Facebook last week, Apple has admitted that it was a victim of hacking that affected Macintosh computers of some employees.

Apple said that a “small number” of employee computers were affected in an attack that exploited a Java vulnerability. Thankfully, the company says that there was “no evidence that any data left Apple” and no user data is said to have been compromised. The malware has apparently been designed to attack the seemingly safe Mac computers.

In a worrisome revelation, Apple said that the malware was also used in attacks against Macs used by “other companies” but refused to elaborate on the scale of the assault. “Apple has identified malware which infected a limited number of Mac systems through a vulnerability in the Java plug-in for browsers,” the company said in a statement  to The Verge. “T_he malware was employed in an attack against Apple and other companies, and was spread through a website for software developers. We identified a small number of systems within Apple that were infected and isolated them from our network._”

More from News & Analysis

What is the US HIRE Bill and why is India’s $250-billion IT sector worried? Is the internet dead? What's this theory that OpenAI's Sam Altman says might be true?

Hacked!

Apple is planning to release a software tool to safeguard users of its computers against malware used to attack it and Facebook. Last week it was revealed that Facebook too had been a target of a series of sophisticated attacks that resulted in malicious software being installed on certain employee laptops. The incident occurred when a handful of employees visited a mobile developer website that had been compromised. Facebook too claimed that user data was uncompromised as the malware installed itself on employee laptops.

Twitter sadly was not so lucky. The micro blogging site admitted earlier this month that 25,000 user accounts on its site may have been hacked and their account information compromised. Twitter wrote in its blog that it detected “unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data.” The company had claimed that it managed to detect and shut down a live attack within moments, but its investigation had indicated that the attackers may have found limited user information.

Twitter wrote that the hackers could have had access to usernames, email addresses, session tokens and encrypted/salted versions of passwords for approximately 250,000 users. As a precautionary measure, Twitter sent out emails to these users letting them know that the site had reset their passwords and revoked security tokens for their accounts. All these users had to create new passwords to access their accounts.

The malware that seems to be affecting some of the world’s largest sites seem to be exploiting a vulnerability in Oracle’s Java plug-in for browsers. Users visiting affected websites with Java enabled on their browsers are vulnerable to this attack. In its statement, Apple addressed this issue and said, “Since OS X Lion, Macs have shipped without Java installed, and as an added security measure OS X automatically disables Java if it has been unused for 35 days. To protect Mac users that have installed Java, today we are releasing an updated Java malware removal tool that will check Mac systems and remove this malware if found.”