Slashdot Mirror
How Hackers and Scammers Break Into iCloud-Locked iPhones (vice.com)
Motherboard's Joseph Cox and Jason Koebler report of the underground industry where thieves, coders, and hackers work to remove a user's iCloud account from a phone so that they can then be resold. They reportedly are able to do this by phishing the phone's original owners, or scam employees at Apple Stores, which have the ability to override iCloud locks. The other method (that is very labor intensive and rare) involves removing the iPhone's CPU from the Logic Board and reprogramming it to create what is essentially a "new" device. It is generally done in Chinese refurbishing labs and involves stealing a "clean" phone identification number called an IMEI. Here's an excerpt from their report: Making matters more complicated is the fact that not all iCloud-locked phones are stolen devices -- some of them are phones that are returned to telecom companies as part of phone upgrade and insurance programs. The large number of legitimately obtained, iCloud-locked iPhones helps supply the independent phone repair industry with replacement parts that cannot be obtained directly from Apple. But naturally, repair companies know that a phone is worth more unlocked than it is locked, and so some of them have waded into the hacking underground to become customers of illegal iCloud unlocking companies.
In practice, "iCloud unlock" as it's often called, is a scheme that involves a complex supply chain of different scams and cybercriminals. These include using fake receipts and invoices to trick Apple into believing they're the legitimate owner of the phone, using databases that look up information on iPhones, and social engineering at Apple Stores. There are even custom phishing kits for sale online designed to steal iCloud passwords from a phone's original owner. [...] There are many listings on eBay, Craigslist, and wholesale sites for phones billed as "iCloud-locked," or "for parts" or something similar. While some of these phones are almost certainly stolen, many of them are not. According to three professionals in the independent repair and iPhone refurbishing businesses, used iPhones -- including some iCloud-locked devices -- are sold in bulk at private "carrier auctions" where companies like T-Mobile, Verizon, Sprint, AT&T, and cell phone insurance providers sell their excess inventory (often through third-party processing companies.)
In practice, "iCloud unlock" as it's often called, is a scheme that involves a complex supply chain of different scams and cybercriminals. These include using fake receipts and invoices to trick Apple into believing they're the legitimate owner of the phone, using databases that look up information on iPhones, and social engineering at Apple Stores. There are even custom phishing kits for sale online designed to steal iCloud passwords from a phone's original owner. [...] There are many listings on eBay, Craigslist, and wholesale sites for phones billed as "iCloud-locked," or "for parts" or something similar. While some of these phones are almost certainly stolen, many of them are not. According to three professionals in the independent repair and iPhone refurbishing businesses, used iPhones -- including some iCloud-locked devices -- are sold in bulk at private "carrier auctions" where companies like T-Mobile, Verizon, Sprint, AT&T, and cell phone insurance providers sell their excess inventory (often through third-party processing companies.)
Very interesting timing on this story. Friday my son's iPhone 7 was stolen at school around 11 AM. Before he made it home at 3 PM his iPhone had been taken over - he had emails between 2:42 and 2:45 showing where someone had changed his gmail password, logged into his gmail account on a different phone, changed the password on his Apple account (which used the gmail account for the Apple ID), and disabled Find My Phone on his stolen phone (and the email from Apple helpfully indicated that now the device could be reset and logged into without the Apple ID credentials). The IP address that was done from was at his high school (the phone did not have cellular service - he used it with WiFi only).
I'm still trying to wrap my head around the fact that someone at this relatively small school knew how to take over an iPhone locked with a 6 digit passcode. It appears that gmail was the weak link here. My guess is to what happened is that since the google apps were installed on the iPhone, when a "lost password" was triggered from a different phone, Google sent a reset code to the stolen phone. I haven't bothered to try and test this, but my hunch is that the reset code that Google sent to his phone was a notification accessible while the phone was locked.
The lesson I have learned here (in any case, since the first step that occurred was his Google account password was changed and logged into from a different phone) is NEVER use gmail addresses for your Apple ID. That was the attack vector, and if it is too easy for someone to change your gmail password, then it's too easy for them to take over your hardware devices as well.
Better known as 318230.
Erasing a phone should be as easy as erasing a computer -- storage module should be removable, and you should be able to reinstall the OS. Encrypt the thing, of course, to prevent data theft. It's terrible that usage of a device that you own (or possess, anyway) is at Apple, Google, or another company's whim...
Yeah, yeah, thieves. Know what? I'm not a coward. And frankly, if my phone is stolen, I'd still rather have it be useful to someone than end up polluting a landfill somewhere in Africa. Gaia first!
The article conflates recycling & reusing Apple hardware with criminal behaviour. People who unlock, repair, service, & recycle computer hardware shouldn't be labelled criminals. I think now would be the time to pass "right to repair" laws & stop wasting tax payers' money on policing corporations' crappy, unreasonable EULAS & warranties.
Is free data for thieves
Have no fear, the Cybersecurity and Infrastructure Security Agency* (CISA) is here! Yes, new and improved CISA will save everyone from everything bad cyber! All we want is a lot more money, more power, and no accountability (wait, we already have that last one). That way our managers can continue to go on junkets to London, Rome, Amsterdam, Zurich, etc. Odd that none of those places are in the US "homeland", but hey, we don't care - just keep that delicious tax money coming!
*We had to change the name since the National Protection and Programs Directorate had such a deservedly shitty reputation. Of course, we promoted everyone who made that reputation and then we had a lot of parties.
Loving the Hillary Bot.
I am not saying that your kid lied to you.... But consider that if he "gave" the phone to bullies, then all is very simply explained.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Does the school log access to websites? If so, the police could ask the It staff to check the logs.
At the school I worked in we logged all web access using a Squid Proxy Server. This would have allowed us to look up who on that day at that time had accessed both Googlemail and Apple iCloud.
Highly likely then to have the login name of the kid or staff member who did it. Unless their password was stolen too.
They may also be able to see what access point the phone was connected to. In fact, they may still see the MAC address of the phone as it wanders around the school between classes.
My brother-in-law has an old iPhone 5c which he can't get into - the iCloud account is clearly still set to one of his Email addresses (he owns hisname.com and even the obfuscated version with first and last letters are the right ones) but password reset emails never arrive. I've encouraged him for a year now to come with me to the nearest Apple store and get their help but could not promise they'd manage it, and he's never had the spare time between work and kids. But if they can definitely do it (once convinced of our bona-fides) then that's more of a reason to make time to go, and not just let this slab of glass depreciate any further!
Perfectly Normal Industries