Gang of hackers behind nude celebrity photo leak routinely attacked iCloud

'Months of hard work' behind publication of more than 100 stars' private photos as hackers ask for bitcoin and go underground

• Can we learn not to gawp at degrading material online?

The Guardian, Charles Arthur and Alexandra Topping,  Tuesday 2 September 2014

Hackers claimed to have obtained nude pictures of Jennifer Lawrence
at the end of August. Photograph: Frederic J. Brown/AFP/Getty Images

A gang of hackers who collected and traded nude pictures of female celebrities by routinely breaking into Apple's iCloud system were the source of private photographs leaked online, new evidence shows.

Private photos and videos of more than 100 mostly female American and British stars were released on the internet on Monday from the 4chan website, sparking condemnation from the Oscar-winner Jennifer Lawrence and other actors including Kirsten Dunst, Kate Upton and Briton Jessica Brown Findlay.

Chatroom transcripts show that "OriginalGuy", a member of the gang who has now gone on the run, boasted that the hacking of accounts belonging to Lawrence and others "is the result of several months of long and hard work" and that "several people were in on it".

Other chatroom transcripts show that the gang had offered nude pictures of female celebrities and athletes for sale, and others offered to "rip" the iCloud backup accounts containing photos for anyone once they were given their user name and password. The iCloud backups come from the stars' iPhones, which automatically store photos online for up to 30 days or until they are downloaded.

The revelation comes as the FBI and Apple started investigating the security breach, the most serious ever to affect the iPhone maker and a serious blow to its efforts to push new devices expected to incorporate mobile payment functions next week.

There are more than 800 million iCloud accounts globally – but the chatroom transcripts suggest there is now a growing semi-professional trade in "ripping" iCloud accounts, posing a serious problem for Apple's security profile.

The FBI said it was "aware" of the hacking allegations and was "addressing the matter". Apple said in a statement that it was outraged by the hack and immediately mobilised engineers to discover the source. "After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the internet," the company said.

"None of the cases we have investigated has resulted from any breach in any of Apple's systems including iCloud or Find my iPhone. We are continuing to work with law enforcement to help identify the criminals involved."

The gang seems to have been gathering and swapping pictures collected from celebrities' backups for years.

On 26 August, one poster on AnonIB, an anonymous pornographic image sharing site, claimed to have secured a "major win" for hackers looking for nude pictures of Lawrence. He wrote: "I mean explicit vids and pics, see for yourself/don't have it tho, but everyone says its legit."

Now the poster has gone on the run, after posting a brief message asking for bitcoin donations, which are untraceable. The release of the photos appears to have been unplanned and to have thrown the gang into disarray, with some trying to cash in by offering photos for bitcoins on public sites such as 4chan, while others have gone further underground.

The photos fell into the hands of hackers even though Apple encrypts iCloud backups using the four-digit code users create when setting up their device.

The backups can be downloaded and cracked offline once a hacker has gained access to the user's account – which in the current cases was achieved by answering security questions on Apple's password reset system, such as "Where did your parents meet?", using publicly available information.

The gang appears to have operated in a similar way to child abuse rings, which are closed to newcomers unless they can provide "new" photos for the rest to share.

One user on the Reddit website said: "These guys conduct individual attacks on celebs through a mix of social engineering" – whereby hackers pose as support staff or send official-looking emails to gather information – "and, especially for more high-profile targets, straight-up hacking."

The long-running attempts to break into high-profile users' accounts could explain how photos from as long ago as December 2011 – two months after Apple launched iCloud – could appear in the lists of files held by some group members.

Another transcript seen by the Guardian includes a user claiming to "have nudes of possibly the hottest athlete there is", while another user says: "I have a confirmed iCloud email of a celebrity, was wondering if someone could help crack and rip it."

The existence of the group and its obsessive pursuit of stars' personal photos points to the growing risk from the use of "cloud" systems with smartphones.

Martin Garbus, a New York trial lawyer who over the years has represented actors Al Pacino, Sean Connery, Robert Redford and others, said on Tuesday that worried clients had approached him about security issues.

"Nothing is safe on the internet, period," he told Reuters. "Everything on your iPhone, whether it be phone calls, message texts, pictures, is all available." He said he was not surprised by the hacking because he said he has seen it in the past. "There are just so many different ways that one's privacy can be invaded."