Apple SECURITY WARNING Ping!
If you want on or off the Mac Ping List, Freepmail me.
Posted on 05/27/2014 10:42:08 AM PDT by Swordmaker
“Owners of Apple devices across Australia are having them digitally held for ransom by hackers demanding payment before they will relinquish control,” Ben Grubb reports for Fairfax Media. “iPad, iPhone and Mac owners in Queensland, NSW, Western Australia, South Australia and Victoria have reported having their devices held hostage.” “One iPhone user, a Fairfax Media employee in Sydney, said she was awoken at 4am on Tuesday to a loud ‘lost phone’ message that said ‘Oleg Pliss’ had hacked her phone. She was instructed to send $50 to a PayPal account to have it unlocked,” Grubb reports. “It is likely hackers are using the unusual name as a front to get money from people. A real Oleg Pliss is a software engineer at tech company Oracle. A similar name is listed on LinkedIN as a banking professional in Ukraine, while there are others in Russia.”
“Users who have a passcode on their device appear to be able to unlock it after the hacker has sent them the message demanding payment, but those who had not set a passcode are unable to,” Grubb reports. “A PayPal spokesman said there was no PayPal account linked to the email address the hacker used. The spokesman added that any money that may have been sent by victims would be refunded.”
“Comment is being sought from Apple. A Telstra spokesman said the telco was aware of the reports and had referred the matter to Apple,” Grubb reports. “Vodafone said no customers had reported the issue to its support centre. Optus said if customers had any questions about their Apple devices, they ‘should speak directly to Apple.’ The Australian Competition and Consumer Commission, which runs the federal government’s Scam Watch website, said only one user had reported the issue to it
(Excerpt) Read more at macdailynews.com ...
It is imperative for Apple device owners to
1: change their passwords if they had an account on eBay and used the same password!
2: IMMEDIATELY set a pass code on your device! Owners with pass codes set could immediately UNLOCK and gain back control of their devices!
3: set iCloud to use the two level authentication before changes can be made.
PayPal states there are no accounts associated with the emails the money is to be sent. PayPal will refund any money sent to them for payment on this extortion attempt.
Those dam Dingos
I don’t use iCloud with my Macs or my iPod Touch. My personal devices remain comparatively personal.
I hope law enforcement will go after these criminals with enthusiasm. I don’t have an iPhone, but I’d be happy to send the robbers to prison for a decade or more.
Get a Mac.
Get a Mac.
If you want on or off the Mac Ping List, Freepmail me.
Sorry to say, the crooks can remotely lock a Mac just as easily. . . this is a security feature Apple provides to secure your data in case your Apple device is stolen. . . and makes it useless to the thief. The problem here is that those who are having this happen used the same password on their Apple iCloud as they did on their eBay account. . . and eBay was hacked last week and millions of unencrypted email addresses and passwords were stolen. They are being used by crooks to try accesses to see if they can get in and when they do. . .
This merely highlights WHY one should have different passwords for every site one uses. . . Pain in the neck though that may be.
Welcome Apple users to the real world, where your devices are constantly hacked.
I keep a notebook of my passwords.
There have been several high-profile attacks in which passwords and email addresses have been stolen -- principally, attacks on Adobe and eBay.
Those who use the same password across several accounts (ebay and iCloud, for example) are vulnerable. If that's you, then change your password for both accounts immediately. Stop reading this and change them now. (If you use the same passwords on other accounts you should also change those.) Use an original password for each account.
Apple offers two-step verification for devices. Everyone should use this -- iCloud is already a central repository for contact, password, payment and other essential information. This means it makes absolute sense to make iCloud as secure as possible, and that means two-step verification. Read Apple's FAQ for information about this additional security layer.
The hacker who is attacking Australian users employs Apple's Find My iPhone service to lock devices and leave a ransom note on the display.
"iPad woke me at 4.30am with the message 'Your device has been hacked by Oleg Pliss'," a user said.
If you have a passcode for your device, then you don't have a problem -- just use the passcode to get into your device again, and change your iCloud password. Find My iPhone can only set its own code if you have not created your own passcode for the device.
If you've been hit
If you've been affected and already use a device passcode, just access your device using the code and change your password.
If you've been affected and are not using or have forgotten your passcode, then the nuclear option is to plug your device into your computer and run a Recovery Mode reset of your device. This will remove all your apps and data, but you can recover your most recent backup using iTunes, by following these instructions.
Some reports claim the following steps may help locked out users regain control of their device:
Common sense
While this experience is incredibly unfortunate for those affected, it is important to note people would not be impacted to any great extent if they simply follow common sense security advice -- and it has to call into question just how many users of other platforms are also vulnerable through complacency?
Sophos adds:
If nothing works, contact Apple support immediately. Apple did not immediately respond to queries on the matter.
I had something similar happen to my ipod about 2 weeks ago. It would let me do certain things but not all. So I wiped it all and rebooted from my weekly backup - problem solved. However, mine was not through iCloud as I don’t use that service.
I did have a passcode set and did not use the same on EBay.
The Find My Device application was installed and I was traveling in China at the time.
Interesting
No Apple devices have been hacked, Jonty. You're right about constant hacking. . . and that's what happened. . . but it was Windows machines that were hacked. Millions of IDs were stolen from hacks at Adobe and eBay including those of Apple device users and the criminals are using a safety feature of iOS and OSX to remotely lock the Apple devices through the owners' Apple iCloud account as if the Apple device owner were doing it himself.
This is another form of social engineering based on people's tendency to use the same password across multiple accounts. . . and the knowledge of their prefer to not use a pass code to access their devices. Both poor security practices used by owners of all devices. The Apple devices have not been breached. . . they are just as secure as they were.
That said, with the same access the criminals could remotely erase the data from the devices! Not access, and they also have access to the email account and any photos of the breached iCloud user. Not good. Moral of this? Don't use the same password on your iCloud account that you've used anywhere else!
"That said, with the same access the criminals could remotely erase the data from the devices! Not access, and they also have access to the email account and any photos of the breached iCloud user."
Should read:
"That said, with the same access the criminals could remotely erase the data from the devices! With that password access they also have access to the email account and any photos of the breached iCloud user."
Ah, I figured out what got lost in that post. Access to the iCloud password did not give the hacker access to any data on the computer or iOS device.
I use LastPass - a free extension for Chrome. Much more secure and will generate random and unique passwords for every site. Has security tests.
There’s a lot of that going on with just plain computers, too. A screen purporting to be the FBI pops up and says that you have been illegally downloading music or data, or viewing restricted porn sites, or some such other scam. It freezes your device and asks that you pay a fine by purchasing some sort of moneygram thing and entering the code number it gives you in a box.
Hostageware. Those usually work by opening several hundred duplicate alert screen that say the same thing. If you're patient, you can close them all.
I too, am leery of doing backups to the cloud. My regular backups of my devices like iPads go to my Macbook. And my Macbook is backed up constantly by Time Machine to a network hard drive attached to my router. On top of that, I make regular backups of the network hard drive to another portable hard drive that goes into a safe. So I always have two or more copies of backups in different locations. Devices are easily restored from backups at any time.
Regarding the passcode lock, a lot of people aren't aware that you can set your passcode to more than the default 4 characters. Set it to at least 5 characters. Be aware that if you set your device to erase after 10 failed attempts, you lose the tracking capability with a wiped device. Best not to, so you can wipe it remotely when and if you want.
E-bay uses windows server?
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.