The Man Who Hacked Hollywood

[InfoSec News <alerts () infosecnews org>]

http://www.gq.com/news-politics/newsmakers/201205/chris-chaney-hacker-nude-photos-scarlett-johansson

By David Kushner
GQ
May 2012

The hacker's eyes widened as the image filled his screen. There, without 
her makeup, stood Scarlett Johansson, her famous face unmistakable in 
the foreground, her naked backside reflected in the bathroom mirror 
behind her, a cell phone poised in her hand snapping the shot. Holy 
sh*t, he thought. This was a find -- even for him. For years, he had 
stealthily broken into the e-mail accounts of the biggest players in 
Hollywood. He had daily access to hundreds of messages between his 
victims and their managers, lawyers, friends, doctors, family, agents, 
nutritionists, publicists, etc. By now he knew more dirt than almost 
anyone in L.A. -- the secret romances, the hidden identities, films in 
all stages of development. Still, this photo, a private self-portrait of 
one of our biggest stars, was something new, something larger than life, 
especially his. "You feel like you've seen something that the rest of 
the world wanted to see," he says. "But you're the only one that's seen 
it."

Chris Chaney never wanted to become famous as The Man Who Hacked 
Hollywood. In the beginning at least, he was just a 33-year-old loner 
looking for something to do. Two years unemployed, he lived in a rundown 
brick house in a middle-class neighborhood in Jacksonville, Florida, 
where the streets are named for fairy tales: Cinderella Road, Peter Pan 
Place. He'd spent his entire life in this same area, had never flown on 
a plane or traveled beyond the occasional trip to see family in Iowa or 
Alabama. His parents separated when he was 4, and during his freshman 
year in high school he moved into this house near Mother Hubbard Drive 
with his grandmother. Taking a room hardly bigger than his bed, he hung 
a Fight Club poster on the wall, stacked his DVDs in the corner, lined 
up his He-Man dolls below the television, and called it home.

One night in early 2008, while his grandma slept, the balding, 290-pound 
Chaney was idly surfing movie sites like Ain't It Cool News when he 
stumbled on the latest celebrity scandal. Stolen pictures had leaked 
online of Miley Cyrus posing half-dressed, her midriff exposed. Chaney 
sparked a clove cigarette and considered the story. He couldn't have 
cared less about the Miley shots themselves. What intrigued him was the 
guy who stole them. How'd he do it? Chaney wasn't a hacker; he didn't 
even own a computer until his late twenties and couldn't write a lick of 
code. But he'd always loved solving puzzles -- completing crosswords, 
shouting out answers to Jeopardy! This was a tantalizing new riddle: "I 
was like, 'How hard could this be if it's happening all the time?' "

What Chaney lacked in technical skills, he made up for in effort. 
Finding a working e-mail address was a simple process of trial and 
error. In a Word document, he made a list of random celebrities and, one 
by one, entered them into Gmail - first name followed by last - until, 
days later, an address was finally accepted. (In the blur of celebs to 
follow, he wouldn't be able to recall his first.) Unlocking the account, 
he knew, would be more difficult. To retrieve a lost password, sites 
often ask subscribers so-called challenge questions: What's your 
mother's maiden name? What's your place of birth? Or, in the case of 
this celebrity, what's your pet's name? It was widely known that the 
hacker who broke into Paris Hilton's phone had done it with her 
Chihuahua's name, Tinkerbell. If her dog's name was easily available 
online, so too, Chaney figured, were other clues.

[...]


_______________________________________________
LayerOne Security Conference
May 26-27, Clarion Hotel, Anaheim, CA
http://www.layerone.org