Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

Australian Apple Macs, iPhones, iPads hijacked, digitally held for ransom
MacDailyNews ^ | Tuesday, May 27, 2014 · 9:27 am ·

Posted on 05/27/2014 10:42:08 AM PDT by Swordmaker

click here to read article


Navigation: use the links below to view more comments.
first 1-2021-25 next last
What is happening is the owners' passwords have been accessed through iCloud and their devices locked through Apple's Find My Device's normal locking service. The users' passwords have apparently been compromised at some other breach, for example, the recent massive security breach at eBay, and these iPhone, iPad and iMac owners, like many people, using the same password on iCloud they were using on eBay. The "hacker" has merely logged into their iCloud account and locked their devices!

It is imperative for Apple device owners to

1: change their passwords if they had an account on eBay and used the same password!

2: IMMEDIATELY set a pass code on your device! Owners with pass codes set could immediately UNLOCK and gain back control of their devices!

3: set iCloud to use the two level authentication before changes can be made.

PayPal states there are no accounts associated with the emails the money is to be sent. PayPal will refund any money sent to them for payment on this extortion attempt.

1 posted on 05/27/2014 10:42:08 AM PDT by Swordmaker
[ Post Reply | Private Reply | View Replies]

To: Swordmaker

Those dam Dingos


2 posted on 05/27/2014 10:42:50 AM PDT by al baby (Hi MomÂ…)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

I don’t use iCloud with my Macs or my iPod Touch. My personal devices remain comparatively personal.


3 posted on 05/27/2014 10:45:20 AM PDT by Dr. Sivana ("I'm a Contra" -- President Ronald Reagan)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

I hope law enforcement will go after these criminals with enthusiasm. I don’t have an iPhone, but I’d be happy to send the robbers to prison for a decade or more.


4 posted on 05/27/2014 10:47:47 AM PDT by Pollster1 ("Shall not be infringed" is unambiguous.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

Get a Mac.


5 posted on 05/27/2014 10:54:48 AM PDT by 867V309 (GOPe? NOPe!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

Get a Mac.


6 posted on 05/27/2014 10:54:48 AM PDT by 867V309 (GOPe? NOPe!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ~Kim4VRWC's~; 1234; Abundy; Action-America; acoulterfan; AFreeBird; Airwinger; Aliska; altair; ...
SECURITY ALERT!!! Scammers using passwords, perhaps stolen from the massive ebay breach last week, are using the fact that many people use the same password on multiple services to scam iCloud users! Hackers are logging onto iCloud users accounts with IDs stolen fron other breaches, then using the Apple "Find My Device" ability to lock iPhones, iPads, and Mac computers to do just that! They then hold the device hostage until $50 to $100 is sent by PayPal! NOTE, This is NOT a hack of the Ipad, iPhone, or Mac, but a theft of the users' user name and password which allows them to activate normal features of Apple service against the owner. . . Unless the owner has a local pass code set on his or her device! If you do, you can get control of you devices back immediately. —PING!


Apple SECURITY WARNING Ping!

If you want on or off the Mac Ping List, Freepmail me.

7 posted on 05/27/2014 10:54:51 AM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 1 | View Replies]

To: 867V309
Get a Mac.

Sorry to say, the crooks can remotely lock a Mac just as easily. . . this is a security feature Apple provides to secure your data in case your Apple device is stolen. . . and makes it useless to the thief. The problem here is that those who are having this happen used the same password on their Apple iCloud as they did on their eBay account. . . and eBay was hacked last week and millions of unencrypted email addresses and passwords were stolen. They are being used by crooks to try accesses to see if they can get in and when they do. . .

This merely highlights WHY one should have different passwords for every site one uses. . . Pain in the neck though that may be.

8 posted on 05/27/2014 11:03:17 AM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 5 | View Replies]

To: Swordmaker

Welcome Apple users to the real world, where your devices are constantly hacked.


9 posted on 05/27/2014 11:15:18 AM PDT by Jonty30 (What Islam and secularism have in common is that they are both death cults)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

I keep a notebook of my passwords.


10 posted on 05/27/2014 11:16:24 AM PDT by Jonty30 (What Islam and secularism have in common is that they are both death cults)
[ Post Reply | Private Reply | To 8 | View Replies]

How to defend against Apple's Oleg Pliss iCloud attack
By Jonny Evans
May 27, 2014 7:50 AM EDT

Australian Apple device users are finding their iDevices locked by some hacker demanding cash. Here's how to defend yourself, and what to do if you've been hit.

There have been several high-profile attacks in which passwords and email addresses have been stolen -- principally, attacks on Adobe and eBay.

Those who use the same password across several accounts (ebay and iCloud, for example) are vulnerable. If that's you, then change your password for both accounts immediately. Stop reading this and change them now. (If you use the same passwords on other accounts you should also change those.) Use an original password for each account.

Apple offers two-step verification for devices. Everyone should use this -- iCloud is already a central repository for contact, password, payment and other essential information. This means it makes absolute sense to make iCloud as secure as possible, and that means two-step verification. Read Apple's FAQ for information about this additional security layer.

The hacker who is attacking Australian users employs Apple's Find My iPhone service to lock devices and leave a ransom note on the display.

"iPad woke me at 4.30am with the message 'Your device has been hacked by Oleg Pliss'," a user said.

If you have a passcode for your device, then you don't have a problem -- just use the passcode to get into your device again, and change your iCloud password. Find My iPhone can only set its own code if you have not created your own passcode for the device.

If you've been hit

If you've been affected and already use a device passcode, just access your device using the code and change your password.

If you've been affected and are not using or have forgotten your passcode, then the nuclear option is to plug your device into your computer and run a Recovery Mode reset of your device. This will remove all your apps and data, but you can recover your most recent backup using iTunes, by following these instructions.

Some reports claim the following steps may help locked out users regain control of their device:

Common sense

While this experience is incredibly unfortunate for those affected, it is important to note people would not be impacted to any great extent if they simply follow common sense security advice -- and it has to call into question just how many users of other platforms are also vulnerable through complacency?

Sophos adds:

If nothing works, contact Apple support immediately. Apple did not immediately respond to queries on the matter.

11 posted on 05/27/2014 11:19:41 AM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Swordmaker

I had something similar happen to my ipod about 2 weeks ago. It would let me do certain things but not all. So I wiped it all and rebooted from my weekly backup - problem solved. However, mine was not through iCloud as I don’t use that service.

I did have a passcode set and did not use the same on EBay.

The Find My Device application was installed and I was traveling in China at the time.

Interesting


12 posted on 05/27/2014 11:36:07 AM PDT by reed13k (For evil to triumph it is only necessary for good men to do nothings)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Jonty30
Welcome Apple users to the real world, where your devices are constantly hacked.

No Apple devices have been hacked, Jonty. You're right about constant hacking. . . and that's what happened. . . but it was Windows machines that were hacked. Millions of IDs were stolen from hacks at Adobe and eBay including those of Apple device users and the criminals are using a safety feature of iOS and OSX to remotely lock the Apple devices through the owners' Apple iCloud account as if the Apple device owner were doing it himself.

This is another form of social engineering based on people's tendency to use the same password across multiple accounts. . . and the knowledge of their prefer to not use a pass code to access their devices. Both poor security practices used by owners of all devices. The Apple devices have not been breached. . . they are just as secure as they were.

That said, with the same access the criminals could remotely erase the data from the devices! Not access, and they also have access to the email account and any photos of the breached iCloud user. Not good. Moral of this? Don't use the same password on your iCloud account that you've used anywhere else!

13 posted on 05/27/2014 11:40:57 AM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 9 | View Replies]

To: Swordmaker
Boy, did that get garbled!

"That said, with the same access the criminals could remotely erase the data from the devices! Not access, and they also have access to the email account and any photos of the breached iCloud user."

Should read:

"That said, with the same access the criminals could remotely erase the data from the devices! With that password access they also have access to the email account and any photos of the breached iCloud user."

14 posted on 05/27/2014 11:58:32 AM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 13 | View Replies]

To: Jonty30

Ah, I figured out what got lost in that post. Access to the iCloud password did not give the hacker access to any data on the computer or iOS device.


15 posted on 05/27/2014 12:02:14 PM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 13 | View Replies]

To: Jonty30
I keep a notebook of my passwords.

I use LastPass - a free extension for Chrome. Much more secure and will generate random and unique passwords for every site. Has security tests.

16 posted on 05/27/2014 12:04:02 PM PDT by DaveMSmith (Evil Comes from Falsity, So Share the Truth)
[ Post Reply | Private Reply | To 10 | View Replies]

To: Swordmaker

There’s a lot of that going on with just plain computers, too. A screen purporting to be the FBI pops up and says that you have been illegally downloading music or data, or viewing restricted porn sites, or some such other scam. It freezes your device and asks that you pay a fine by purchasing some sort of moneygram thing and entering the code number it gives you in a box.


17 posted on 05/27/2014 12:19:45 PM PDT by JimRed (Excise the cancer before it kills us; feed & water the Tree of Liberty! TERM LIMITS NOW & FOREVER!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: JimRed
There’s a lot of that going on with just plain computers, too. A screen purporting to be the FBI pops up and says that you have been illegally downloading music or data, or viewing restricted porn sites, or some such other scam. It freezes your device and asks that you pay a fine by purchasing some sort of moneygram thing and entering the code number it gives you in a box.

Hostageware. Those usually work by opening several hundred duplicate alert screen that say the same thing. If you're patient, you can close them all.

18 posted on 05/27/2014 1:13:24 PM PDT by Swordmaker (This tag line is a Microsoft insult free zone... but if the insults to Mac users continue...)
[ Post Reply | Private Reply | To 17 | View Replies]

To: reed13k
So I wiped it all and rebooted from my weekly backup - problem solved.

I too, am leery of doing backups to the cloud. My regular backups of my devices like iPads go to my Macbook. And my Macbook is backed up constantly by Time Machine to a network hard drive attached to my router. On top of that, I make regular backups of the network hard drive to another portable hard drive that goes into a safe. So I always have two or more copies of backups in different locations. Devices are easily restored from backups at any time.

Regarding the passcode lock, a lot of people aren't aware that you can set your passcode to more than the default 4 characters. Set it to at least 5 characters. Be aware that if you set your device to erase after 10 failed attempts, you lose the tracking capability with a wiped device. Best not to, so you can wipe it remotely when and if you want.

19 posted on 05/27/2014 2:39:29 PM PDT by roadcat
[ Post Reply | Private Reply | To 12 | View Replies]

To: Swordmaker
but it was Windows machines that were hacked

E-bay uses windows server?

20 posted on 05/28/2014 4:25:50 AM PDT by palmer (There's someone in my lead but it's not me)
[ Post Reply | Private Reply | To 13 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-25 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson