Apple Developer Center Was Hacked; Site Remains Down While Company Overhauls Security
Apple's developer site was accessed by “an intruder” last Thursday, the company has disclosed, and Apple has not ruled out the possibility that developers' names, mailing addresses, and/or email addresses were compromised.
Context & Ripple Effects
The breach explains what had been a mystery since Apple's Dev Center went dark on July 18, cutting off SDK and iOS 7 beta downloads at the worst possible moment of the summer build cycle. What began as an unexplained extended outage is now a confirmed intrusion: Apple says 'an intruder' accessed the site last Thursday and has not ruled out that developers' names, mailing addresses, or email addresses were exposed.
The story traveled fast — The Next Web, 9to5Mac, Macworld, TechCrunch, CNET and others picked up the disclosure within days, and The Next Web separately reports a researcher claiming he flagged the vulnerability to Apple without maliciously taking data. It also lands on top of a recent record: in August 2012 a hacker talked his way into a reporter's iCloud account through Apple Support, so this is the second year running that Apple's own front doors, not its devices, have been the weak point.
First-order effects
- Developers are locked out mid-cycle: no SDK or iOS 7 beta downloads while the overhaul runs, stalling work timed to the fall iOS 7 release.
- Members whose certificates or apps might lapse during the downtime face uncertainty until Apple clarifies terms — 9to5Mac reports the company signaling that memberships and apps will not expire because of the unexpected maintenance.
Second-order effects
- App-review and submission pipelines that depend on the portal slow across the entire iOS ecosystem simultaneously, putting update schedules for every publisher behind Apple's own remediation clock.
- A researcher publicly claiming he disclosed the hole before the intrusion shifts the narrative from zero-day surprise toward questions about how Apple triages outside vulnerability reports — pressure other large vendors already feel.
Third-order effects
- If the pattern holds — the 2012 iCloud support incident, the 2012 developer photo loophole, now this — Apple's perimeter systems will draw the kind of sustained security scrutiny its products escaped for years, with disclosure speed becoming the reputational battleground.
- Extended platform outages affecting hundreds of thousands of paid developers argue for contractual remedies like automatic membership extensions becoming standard practice whenever a platform holder takes critical infrastructure down.
The trend: Platform holders are discovering that their developer-facing infrastructure has become a primary attack surface, forcing them into public breach disclosures and visible overhauls that once would have stayed private.
Related: Apple · Dev Center outage blocks SDK and iOS 7 beta downloads · All Developer Center services back online · Apple Support Allowed Hacker Access to Reporter's iCloud Account
Related Coverage
- Researcher claims he told Apple of Developer Center vulnerability but didn't maliciously steal data The Next Web · Jon Russell
- Apple says developer memberships and apps will not expire due to unexpected maintenance duration … 9to5Mac · Mike Beasley
- Apple: Extended Developer Website outage due to security breach, some user info may have been exposed The Next Web · Matthew Panzarino
- Macworld None
- TechCrunch None
- CNET None
- The Loop None
- SiliconANGLE None
- Guardian None
- Help Net Security None
- AppleInsider None
- The Verge None
- Digital Trends None
- Ubergizmo None
- The Mac Observer None
- Ars Technica None
- MacRumors None
- Inquirer None
- iLounge None
- I4U News None
- www.idigitaltimes.co.uk None
- Securosis Highlights None
- TechSpot None
- IntoMobile None
- Network World None
- Electronista None
- nextbigwhat.com None
- GigaOM None
- NEWS.com.au None
- Digits None
- AppleInsider None
- Daring Fireball None
- Engadget None
- iMore None
- The Atlantic Wire None
- SecurityWeek None
- Macworld Macworld · Lex Friedman
- TechCrunch TechCrunch · Greg Kumparak
- CNET CNET · Josh Lowensohn
- The Loop The Loop · Jim Dalrymple
- SiliconANGLE SiliconANGLE · Mike Wheatley
- Guardian Guardian · Charles Arthur
- Help Net Security Help Net Security
- AppleInsider AppleInsider
- The Verge The Verge · T.C. Sottek
- Digital Trends Digital Trends · Trevor Mogg
- Ubergizmo Ubergizmo · Adnan Farooqui
- The Mac Observer The Mac Observer · Jeff Gamet
- Ars Technica Ars Technica · Andrew Cunningham
- MacRumors MacRumors · Jordan Golson
- Inquirer Inquirer · Dave Neal
- iLounge iLounge · Phil Dzikiy
- I4U News I4U News · Sumayah Aamir
- www.idigitaltimes.co.uk www.idigitaltimes.co.uk · iDigitalTimes UK
- Securosis Highlights Securosis Highlights · Rich
- TechSpot TechSpot · Tim Schiesser
- IntoMobile IntoMobile · Kelly Hodgkins
- Network World Network World · Yoni Heisler
- Electronista Electronista
- nextbigwhat.com nextbigwhat.com · Aral Lobo
- GigaOM GigaOM · Om Malik
- NEWS.com.au NEWS.com.au
- Digits Digits · Ian Sherr
- Daring Fireball Daring Fireball · John Gruber
- Engadget Engadget · Sean Buckley
- iMore iMore · Nick Arnott
- The Atlantic Wire The Atlantic Wire · Abby Ohlheiser
- SecurityWeek SecurityWeek · Mike Lennon
- 9to5Mac None
- MacRumors None
- Graham Cluley None
- CNET None
- BGR None
- The Hacker News None
- iDownloadBlog.com None
- iClarified None
- MacDailyNews None
- memeburn None
- iDownloadBlog.com None
- App Advice None
- iMore None
- www.idigitaltimes.co.uk None
- TUAW None
- 9to5Mac 9to5Mac · Scott Buscemi
- Graham Cluley Graham Cluley
- BGR BGR · Zach Epstein
- The Hacker News The Hacker News · Mohit Kumar
- iDownloadBlog.com iDownloadBlog.com · Christian Zibreg
- iClarified iClarified
- MacDailyNews MacDailyNews
- memeburn memeburn
- App Advice App Advice · Aldrin Calimlim
- TUAW TUAW · Michael Grothaus
- VentureBeat None
- Examiner None
- ReadWrite None
- Gotta Be Mobile None
- BetaNews None
- Softpedia News None
- TechEye None
- NBC Bay Area None
- VentureBeat VentureBeat · John Koetsier
- Examiner Examiner · Michael Santo
- ReadWrite ReadWrite
- Gotta Be Mobile Gotta Be Mobile · Josh Smith
- BetaNews BetaNews · Mark Wilson
- Softpedia News Softpedia News · Filip Truta
- TechEye TechEye · Nick Farrell
- Tech News Tech News · Nbc Bay Area
- Reuters None
- Gizmodo None
- iClarified None
- Reuters Reuters
- Gizmodo Gizmodo · Jamie Condliffe