How easy is it to crack into an Apple iCloud account? We tried to find out

Accessing someone’s Apple account requires only three things: their email address, their date of birth, and the answers to two out of three security questions. This is assuming they don’t have two-step verification enabled.

If you have all these, you’re able to reset their Apple ID password to one that only you know and then access their iTunes and iCloud accounts. You don’t require access to their email. Once you have access to their Apple ID, you can access recent photos and back-ups if they have these features enabled.

While we don’t know the exact method people used to access celebrities’ accounts, Apple did release a statement which appears to confirm that a method similar to that described above was used.

The main issue with this setup is that if you’re a celebrity, or are someone who has been using social media for a long time and revealed various details about your life, then the answers to the security questions could be available online. Here are a few of the 21 security questions you can choose:

What was the first name of your first boss?

What was the first car you owned?

What is the name of the street where you grew up?

What is the name of the first beach you visited?

What is the name of your favorite sports team?

Where was your least favourite job?

The Guardian has seen forum threads where people have allegedly used the methods above to access people’s iCloud back-ups to obtain photos.

To see how difficult it is to crack someone’s account, we’re going to try and access each other’s accounts and see how far we get.

Nick Evershed

Getting Paul’s date of birth and email address was easy. We’re already friends on Facebook, where his birthday is available, and I already had his personal Gmail address (which is also available online following a quick Google search).

That got me past the first two steps on the password reset site. So now I just need to know two of the following: the name of the first album he owned, the name of his favourite teacher, or his least favourite job.

From Facebook I found out which high school he’d attended. I used this to get a list of teachers from this high school from a teacher rating site. I also got a list of artists he’d liked on Facebook and picked the earliest as my first guess.

This is about as far as I got. After less than a dozen attempts at guessing, I was locked out of his account for eight hours. Paul did confirm that the answer to the teacher question was on my list though, so I would have eventually come to the right one.

I never got the band name or least favourite job, though. Perhaps a bit more time spent may have yielded one of these – Paul mentioned he still has a MySpace page online which I didn’t find.

Paul Farrell

I ran into an early stumbling block trying to hack into Nick’s account because I didn’t know his year of birth. I already knew the date and month of his birthday because we’ve gone out for drinks before. His email address was also easy to find.

But Nick’s age is a more closely guarded secret than I initially thought. He doesn’t keep the information on Facebook and I couldn’t find any posts or tweets that would give me the answer.

I even asked his wife whether she would tell me but, perhaps unsurprisingly, she didn’t get back to me. I manage to bluff my way through this and get Nick to accidentally reveal his year of birth. Pretending that I had discovered it already I exclaimed to him that I never knew he was over 30 – a fact he confirmed, and I could pin it down from there. This was a pretty basic type of social engineering, another tool used by hackers to break into accounts.

Once I got through to the questions I also noticed another interesting feature about Apple’s password reset function – while you need to answer only two questions to get into someone’s account there are three questions that they have answered. If you can’t get the answer to one of them you can just hit refresh to change the sequence and bring up the other question.

Nick’s three questions were: what was his least favourite job? What was his first car? Who was his first childhood friend?

I had a crack at the car question, and did actually manage to get the answer to this fairly quickly. I found some old photos of an old car that appeared to be Nick’s, and it was indeed his first car! Unfortunately, I know nothing about cars beyond the fact they have four wheels and an engine, but my colleague Helen Davidson helpfully pointed out the model. This gave me one of the two answers I needed to gain access to Nick’s account.

The other two questions were harder. I couldn’t even find out what primary school Nick went to so that one was a dead end. I thought I would have better luck with the worst job question, as I managed to find a number of Nick’s former employers through web searches. I tried a couple but didn’t get them - then Apple locked me out because I had made too many attempts.

While it might seem hard to guess this sort of information for random people, for celebrities who have disclosed massive amounts of personal information in interviews it may actually be quite achievable to find it all through fairly basic web searches.

For those concerned about the security of their accounts, Apple recommends enabling two-step verification. Apple was asked to comment on the process above and directed Guardian Australia to their earlier statement.