Slashdot Mirror
Apple Devices Held For Ransom, Rumors Claim 40M iCloud Accounts Hacked; Apple-Related Forums Compromised (csoonline.com)
Steve Ragan, reporting for CSOOnline: Since February, a number of Apple users have reported locked devices displaying ransom demands written in Russian. Earlier this week, a security professional posted a message to a private email group requesting information related a possible compromise of at least 40 million iCloud accounts. Salted Hash started digging around on this story after the email came to our attention. In it, a list member questioned the others about a rumor concerning "rumblings of a massive (40 million) data breach at Apple." The message goes on to state that the alleged breach was conducted by a Russian actor, and vector "seems to be via iCloud to the 'locate device' feature, and is then locking the device and asking for money."In a separate report, the publication reports that three websites owned by Penton Technology -- MacForums.com, HotScripts.com, and WebHostingTalk.com -- have been compromised and their databases are now being sold on the Darknet. While nothing is confirmed, there is a possibility that some of the rumored 40M compromised Apple ID credentials may have come from these forums, or from LinkedIn's recent hack.
the publication reports that three websites owned by Penton Technology -- MacForums.com, HotScripts.com, and WebHostingTalk.com -- have been compromised and their databases are now being sold on the Darknet. While nothing is confirmed, there is a possibility that some of the rumored 40M compromised Apple ID credentials may have come from these forums, or from LinkedIn's recent hack.
People who post info on social media are fools!
Oh. Wait.
Faster! Faster! Faster would be better!
Who is responsible for devices getting hijacked? With PCs you can argue the end user is responsible for what is done with the machine. For more locked down devices is the manufacturer ultimately fully responsible for the function of the device?
There will be legal lawsuits for sure. Class action and individual.
A bigger question will be what view does the public take? Do they blame themselves of the manufacturer?
But we sure like to make lots of noise about it! With important sounding scary woooords!
Don't worry! your data is safe in the cloud. Keep all your data in the cloud. Just pay the ranson, and get all your data back from the cloud.
Occasionally the cloud rains.
There's no connection between the hacked forums and the Apple ID incident. According to this Softpedia article (who apparently talked to the hacker), he used a vBulletin zero-day to hack the forums. What does that have to do with Apple? http://news.softpedia.com/news...
Don't insult gay people, please
Sorry for the off-topicness
Well, it's official.
I suspected it a while ago, and yesterday I added a comment regarding the Dallas terror / terrorist attacks in one of the other threads. I check now and it's gone. And yes I checked for negative / hidden comments etc..
I thought Slashdot would not selectively delete comments ?!
Don't censor the people that insult gay people that aren't really gay!
Then again, this is a new crew, enamoured with vapid breathless bullshit and not so much with... other things.
I'm ready.
Too bad the sequel is never as good as the original.
when can we download all of the fappening 2.0 pics?
using the word "fanboy" confirms you're gay
That would be 'fanboipussy'
In the free world the media isn't government run; the government is media run.
These are not "compromised Apple ID credentials"... they are compromised email addresses and passwords for for OTHER mac/apple related websites... so if you're dumb enough to reuse your Apple ID email address and password on those sites they might match up.
thank god i use linux
Smells like another NSA stunt to blame on Russia for cyber-hacking the whole world bullshit. Why would they write instructions in Russian and consequently only directly address a tiny proportion of users? Anyone capable of creating ransomware and targetting the whole world would write it in English, period.
I read this, thinking, "What hack?" cause I haven't had any issues at all. Then I realized the what actually happened. This sounds like the same thing that happened with the supposed hacking of Teamviewer. It was a matter of people reusing the same credentials in multiple locations, so as soon as one low-security place is compromised, you're still screwed in other places even if they have high security.
All I can say is that, today, you *have* to use either MFA, a personal password database, preferably both. I use 1password to store all my passwords, and Duo Security (free for personal use) for MFA. There are other options as well, such as Google Authenticate for MFA, or keypass for password storage.
1password is relatively expensive, but it's virtually hassle free and will let me sync my db across all my devices (Linux is read-only, unfortunately) and integrates with all major browsers. I don't use Keypass, but IIRC it works on all platforms including Linux, but it's browser plugins are lacking.
The most important aspect of password databases, is that they let you generate a very long, random password that is unique to the site you visit. You don't care what the password is, because you can just call it up from the database, but it makes your account essentially unhackable (provided the site you're accessing doesn't do something stupid like store the passwords in plain text).
This is 2016, not 1970. People can no longer afford to be naive about password management anymore. It would be nice if articles like these could take a couple moments out of their breathless handwaving to let people know that these options exist.
You KNOW I hate Apple. This just makes me smile. I know you hate making me smile, so what gives?
But the worse kind of infiltration is the ones that the big boys bury,if someone had a repeatable way in to,say Apple's servers,that Apple could not fathom how it's being done,exactly how much do you reckon they would pay for someone to please stop,and here's a very large sum of money to tell us how your doing it...you really think they would make it public knowledge,if it was done properly,only a very few folk at the top of which ever Corp it Is would have any knowledge of such an attack,+ possibly one or two from their security branch and possibly one or two in government,but a tiny number would be told,just how much is their reputation for being secure worth ?
I wouldn't say no to 10% of what ever they would pay an attacker to go away and hand over how it's being done !!
I suspected this was coming, no less than 3 times last week was my iCloud account locked due to multiple failed attempts to login. Of course I expect everything I sign up to will be hacked so my email has a different password (and now 2 factor auth).
nelson.jpg suck it vapor heads
Someone reset my Apple ID password on February 27th 2016 do you think it could be related?
Account has since been recovered and as far as I can tell nothing else was changed.
Minimum threshold fixed. Thanks!