Stefan Mileschin

On November 13, 2010, 34-year old Jacksonville, Florida resident Christopher Chaney went hunting for unreleased nude photos of celebrities. According to court documents, he had the e-mail address for celebrity stylist and handbag designer Simone Harouche, but he didn't have Harouche's password. No matter; after connecting to Apple's e-mail servers, Chaney used the password reset feature. He answered the required security questions by supplying publicly available information gleaned from the Internet—and he was in. What to do next?

Account settings were a top priority. From there, Chaney could have a copy of all Harouche's incoming e-mail mirrored to nickchulbert@yahoo.com—an account created specially for this purpose. Even after Harouche regained control of her account, she was unlikely to start poking around immediately in her account settings, and Chaney might maintain his virtual view of her life for weeks or even months.

With the mirroring in place, a quick stroll through the actual contents of the account might be in order. For Hollywood celebrities, a search of all e-mails containing attachments could bring up everything from film scripts to scans of a driver's license to intimate photos. When he found these last items, Chaney saved them to separate folders on his computer. He then used three e-mail accounts with names like trainreqsuckswhat@yahoo.com—an I'm-better-than-you reference to a 2008 hacker named "trainreq" who had broken into Miley Cyrus's Gmail account—to distribute nude pictures to various Internet sites.

But such pictures weren't always sitting around, waiting to be downloaded; sometimes Chaney had to work for them.

http://arstechnica.com/tech-policy/n...cam paign=rss