Call it the "security fail" experience for Amazon and Apple.

On Aug. 3, an "epic hack" compromised technology journalist Mat Honan's Twitter account. Along the way, the attacker--known as "Phobia"--also managed to remotely erase Honan's Apple laptop, iPhone, and iPad. Furthermore, Phobia did it by socially engineering--as in, tricking--customer service representatives at Amazon and Apple, allowing him to gain sufficient information to first access Honan's iCloud and Gmail accounts.

Obviously, a self-described 19-year-old's ability to execute a multi-layered social engineer attack also calls into question who else--intelligence agencies, criminals, or legions of bored teenagers--may have already been putting these techniques to work, only without victims ever wising up.

Who's to blame? Start with the identity verification system employed by the technology giants. "Amazon's system is partially at fault, but the weakest link by far is Apple," says Marco Arment, the co-founder of Tumblr, on his blog. "It's appalling that they will give control of your iCloud account to anyone who knows your name and address, which are very easy for anyone to find, and the last four digits of your credit card, which are usually considered safe to display on websites and receipts."

[ Learn how to protect yourself. Read 8 Ways To Avoid Getting Your Life Hacked. ]

When it comes to screening consumers, businesses are lazy. "What it comes down to is authentication--how do you verify that someone is who they say they are? Right now, the industry norm is that you provide some bits of personal information," says the threat intelligence manager for Trustwave SpiderLabs, who goes by "Space Rogue," speaking by phone. Cue the now-obvious problem: "None of that stuff is secret information," he says. "All of that is fairly easily gotten to through Google or other methods."

The failure of the security teams at Amazon and Apple to proactively spot--or else bother to address--Phobia-style attacks is glaring. (Both companies are reportedly reevaluating their checks and balances.) At the Black Hat Europe conference in Amsterdam earlier this year, penetration testers detailed gigs in which they'd been hired by a business to identify its information security vulnerabilities. Oftentimes, they found the expected flaws in Web applications. But too often, they literally also encountered unlocked backdoors to the office itself, and printouts of usernames, passwords, or other sensitive information carefully indexed inside unlocked filing cabinets.

Professional penetration testers would have made short work of Amazon and Apple, given the ease with which consumers can be impersonated. "People do this all the time, this isn't an isolated case that happened to Honan," says Space Rogue, who helped found noted consultancy @Stake, and who's previously worked for security research think tank L0pht Heavy Industries.

If businesses are lazy, so are consumers, and Honan admitted culpability in the attack against his online identity. "Those security lapses are my fault, and I deeply, deeply regret them," he wrote in a recap of the attacks. Still, after making that statement early on in his article, Honan then spent 3,300 words analyzing everything that others, including Amazon and Apple, did wrong.

To reiterate: Don't be a Honan. He failed to back up his devices to a hard drive, despite the amazing "fire and forget" Time Machine backup software included with his Apple OS X laptop. He used identical email address prefixes--first initial, last name--across numerous services, which made his account addresses easy for an attacker to guess. And he tied numerous accounts together, thus creating a single point of failure.

Recommended Reading:

1 of 2