Slashdot Mirror
Hackers Using iCloud's Find My iPhone Feature To Remotely Lock Macs, Demand Ransom Payments (macrumors.com)
AmiMoJo shares a report from Mac Rumors: Over the last day or two, several Mac users appear to have been locked out of their machines after hackers signed into their iCloud accounts and initiated a remote lock using Find My iPhone. With access to an iCloud user's username and password, Find My iPhone on iCloud.com can be used to "lock" a Mac with a passcode even with two-factor authentication turned on, and that's what's going on here. Affected users who have had their iCloud accounts hacked are receiving messages demanding money for the passcode to unlock a locked Mac device. The usernames and passwords of the iCloud accounts affected by this "hack" were likely found through various site data breaches and have not been acquired through a breach of Apple's servers. Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details.
As if thousands of smug douchebags cried out in terror, and were suddenly silenced.
SJW: Someone who has run out of real oppression, and has to fake it.
So that's how my email and bank account was drained at the same time as my luggage was broken into.
This has been happening at least since 2016.
---- join dshield.org Distributed Intrusion Detec
While asking for a ransom isn't a bad business model, there is nothing in the summary or article to suggest that is going on.
What about "Affected users who have had their iCloud accounts hacked are receiving messages demanding money for the passcode to unlock a locked Mac device."
lucm, indeed.
The usernames and passwords of the iCloud accounts affected by this "hack" were likely found through various site data breaches and have not been acquired through a breach of Apple's servers.
Citation needed (excluding Apple marketing)
lucm, indeed.
one would have to understand what they read to get that info. most people don't even read the freaking article so why is it surprising that they didn't see the phrase " demanding money for the passcode to unlock a locked Mac device" and understood that as a ransom demand?
Apple can lock your mac anytime they want.
Apple doesn't do that and the feature can be useful (especially for an iPhone that you forgot somewhere)
Slashdot, fix the reply notifications... You won't get away with it...
> Find My iPhone on iCloud.com can be used to "lock" a Mac with a passcode even with two-factor authentication turned on
iCloud is nice and all but suffers from security concerns. Such a powerful tool needs a stronger security implementation, and has to offer users the way to see when and where connections do come from. Gmail has been doing that for a long time, and Apple is still lagging behind.
Slashdot, fix the reply notifications... You won't get away with it...
It's called sensationalism. Slashdot is well known for it now since the real Slashdot died years ago.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Not only is "demanding ransom" in the summary, it's in the title.
But this is Slashdot. People posting without even reading the title? Sure, why not?
Reading the what?
#DeleteChrome
the real Slashdot died years ago.
Did Netcraft confirm it?
I don't care if it's 90,000 hectares. That lake was not my doing.
I personally approve of people who post without reading the title - they're doing the equivalent of going commando. I'm pretty sure that BeauHD himself doesn't read the clickbait titles that he copy-pastes from macrumors and Apple press releases, and as we can all witness that doesn't stop him from publishing interesting and awe-inspiring content.
It's a bit rich though when people who don't read the summary or article complain that "nothing in the summary or article suggest..." something. That's pushing the envelope a bit too far.
lucm, indeed.
Most of the attacks are based on password re-use, not password resets via email. A password reset could also be thwarted with two-factor authentication, but not this attack.
> Apple doesn't do that
But the point is that they can because you have basically given them the key to your computer.
> Apple doesn't do that
But the point is that they can because you have basically given them the key to your computer.
Well, all OS implementations might include such hidden feature too (and most software), if the code is injected into an update. Do they do that? No.
Apple could do that, but doing so would be a huge mistake, and they'd lose many consumers.
Slashdot, fix the reply notifications... You won't get away with it...
> Apple doesn't do that
But the point is that they can because you have basically given them the key to your computer.
Do you really think Apple retains your actual Password?
I suppose they could use brute force with the their internal authorization routines; but they do not retain your actual Password, and thus cannot easily lock your Mac.
And why oh why would they want to?
Time for another layer of tinfoil on that hat, laddy!
2FA is NOT used. You can lock a device with a passcode with only the iCloud password and it doesn't use 2FA to confirm it - because Apple assumes you probably have lost the device that provides that second authentication factor and that's why you're locking it.
iPhones use the same technique, right?
It little behooves the best of us to comment on the rest of us.
Who didn't see this coming? Surprised it didn't start happening when this feature was released in the first place.
In Soviet Russia, Netcraft only reads old people!
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
My mom fell for an Apple phishing attack. Fucking Yahoo didn't flag a non-Apple email as spam and hid the email address from display so you didn't see the obvious fake domain. She entered all her details, birthday, credit card, maiden name, etc. She thought it was strange Apple would ask all this info, but did it anyway. I got the call when their ipad said it was remotely locked and she couldn't get into it. After figuring out the scam, we did password resets on both parents accounts and got control back of the ipad. It still took several minutes of convincing her to immediately cancel her credit card as it was 100% scam. She still didn't believe me until I said the website she put her details into is on a porn site. She got a call the next day her credit card was used twice within a few hours.