Chinese Authorities Allegedly Harvesting iCloud Logins Using Redirected Dummy Site

MacRumors · Oct 20, 2014

Chinese authorities allegedly are using a man-in-the-middle attack to harvest Apple ID information from Chinese users visiting Apple's iCloud service, reports web censorship blog Great Fire (via The Verge). A similar attack reportedly targets Microsoft's login.live.com website.

According to Great Fire, Chinese users trying to access iCloud.com are redirected to a fake site that resembles Apple's iCloud website. While some browsers will issue a warning, popular Chinese browser Qihoo gives no indication users are entering their Apple credentials into a dummy site. Users fooled by the site may be putting their personal information at risk as attackers can then use these login details to access contacts, messages and more stored in iCloud.

This is clearly a malicious attack on Apple in an effort to gain access to usernames and passwords and consequently all data stored on iCloud such as iMessages, photos, contacts, etc. Unlike the recent attack on Google, this attack is nationwide and coincides with the launch today in China of the newest iPhone. While the attacks on Google and Yahoo enabled the authorities to snoop on what information Chinese were accessing on those two platforms, the Apple attack is different. If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities.

This attack follows the Chinese launch of the new iPhone 6 and 6 Plus and may be related to the encryption options and increased security of Apple's iOS 8. It is possible Chinese authorities are using this hack to penalize Apple for taking extra measures that would prevent the government from snooping on phones.

Great Fire advises Chinese users to switch to a trusted browser such as Firefox and Chrome, which will warn users when they access an illegitimate site. Apple owners also can use a VPN to bypass this redirection and connect directly to iCloud.com. Two-factor authentication may also prevent attackers from accessing an iCloud account using a compromised username and password.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: Chinese Authorities Allegedly Harvesting iCloud Logins Using Redirected Dummy Site

Solver · Oct 20, 2014

Even the NSA wouldn't do this. Would they?

JoEw · Oct 20, 2014

Trying to stop the revolution that surely is coming.

nerdAFK · Oct 20, 2014

DIE Communist Party DIE DIE DIE!

haruhiko · Oct 20, 2014

Just don't use fishy web browsers like Qihoo whatever and you're safe.

whooleytoo · Oct 20, 2014

Solver said:
Even the NSA wouldn't do this. Would they?

Too lazy. They just go straight to Apple and ask them to hand the data over.

haruhiko · Oct 20, 2014

whooleytoo said:
Too lazy. They just go straight to Apple and ask them to hand the data over.

But Tim Cook just gave these governments a big middle finger - "even we're required to provide the data we cannot decrypt it"...

(if Tim is not lying)

macnisse · Oct 20, 2014

Wow! Doubling down? Looking fwd to Tim's response!

brendu · Oct 20, 2014

haruhiko said:
But Tim Cook just gave these governments a big middle finger - "even we're required to provide the data we cannot decrypt it"...

(if Tim is not lying)

He claims they (Apple) can't decrypt it. To the best of his knowledge this is likely true. I still wouldn't bet against the possibility that the NSA has full access to Apple's (and everyone else's) servers and no one at Apple even knows about it.

Solver · Oct 20, 2014

whooleytoo said:
Too lazy. They just go straight to Apple and ask them to hand the data over.

Apple has been publicly resistant to these requests. Some people/companies will hand over other people's confidential data before the ink hits a formal written request while others resist the urge until a least the first fingernail is pulled.

Deelron · Oct 20, 2014

It is possible Chinese authorities are using this hack to penalize Apple for taking extra measures that would prevent the government from snooping on phones.

A similar attack reportedly targets Microsoft's login.live.com website.

It's seems to me it's just what Chinese authorities do (not trying to penalize Apple specificly), and of course they are.

menano · Oct 20, 2014

Freedom of information: doing it wrong

dannyyankou · Oct 20, 2014

macnisse said:
Wow! Doubling down? Looking fwd to Tim's response!

This is a classic example of phishing, so it's not Apple's fault. They should use a better browser next time.

i.mac · Oct 20, 2014

haruhiko said:
But Tim Cook just gave these governments a big middle finger - "even we're required to provide the data we cannot decrypt it"...

(if Tim is not lying)

Ignorance.

troy14 · Oct 20, 2014

dannyyankou said:
This is a classic example of phishing, so it's not Apple's fault. They should use a better browser next time.

Well, Phishing is generally not associated with actual government organizations. This is something much different in my opinion, and using a better browser "might" be a solution, however, it seems as if Qihoo is the equivalent to using Firefox in the U.S.

Fzang · Oct 20, 2014

I'm in Beijing, and even accessing iCloud through Baidu gives me the (allegedly) official site, https://iCloud.com with Apple's certificate. Does that mean I'm permanently safe? I've been using the website several times in the last couple of days before seeing these news.

roland.g · Oct 20, 2014

Fzang said:
I'm in Beijing, and even accessing iCloud through Baidu gives me the (allegedly) official site, https://iCloud.com with Apple's certificate. Does that mean I'm permanently safe? I've been using the website several times in the last couple of days before seeing these news.

Yes, but redirects from legitimate sites and goofy unintelligible code looking URLs are common for logging into banking and many other secure websites, so users may not realize the fake redirect is not legitimate.

V.K. · Oct 20, 2014

macnisse said:
Wow! Doubling down? Looking fwd to Tim's response!

did you even read the article?! WTH does it have to do with doubling down?! this is a classic man-in-the-middle attack. it has nothing to do with hacking Apple itself.

MacRumors said:
[url=http://cdn.macrumors.com/im/macrumorsthreadlogodarkd.png]Image[/url]

It is possible Chinese authorities are using this hack to penalize Apple for taking extra measures that would prevent the government from snooping on phones.

Article Link: Chinese Authorities Allegedly Harvesting iCloud Logins Using Redirected Dummy Site

I suspect this is it. It would also explain the strange delay in granting iphone 6 licenses in China. They were likely trying to get Apple to give them some kind of back door access to icloud. when that didn't work they resorted to this brazen man-in-the-middle attack.

whooleytoo · Oct 20, 2014

haruhiko said:
But Tim Cook just gave these governments a big middle finger - "even we're required to provide the data we cannot decrypt it"...

(if Tim is not lying)

Could Cook have a gag order preventing him revealing data-sharing arrangements? We know that's the case elsewhere. Maybe he's over-selling Apple being on the side of privacy - that would impress a lot of people. Or maybe he's absolutely correct and truthful. Who knows?

At this stage, who do you trust? The thing about trust is that once lost, it's a lot harder to get back. I now work on the basis that any data/documents that I send or store on cloud services is readable by outside parties.

Tech companies have been really caught in the middle of this, but still they are the entities to which we're giving our personal data, and they're the ones I hold responsible for the security and privacy of that data. As the song (kinda) goes...

Tim Cook says "We will protect you"
I don't subscribe to this point of view
Believe me when I say to you
I hope the NSA love their privacy too.

netslacker · Oct 20, 2014

haruhiko said:
Just don't use fishy web browsers like Qihoo whatever and you're safe.

No, you're not. As the article on iDownloadblog.com states, many users are clicking through the security warnings anyways and continuing through to the fraudulent site. Using a different browser still can't save stupid from being stupid.

Jibbajabba · Oct 20, 2014

whooleytoo said:
Too lazy. They just go straight to Apple and ask them to hand the data over.

Or they aren't that stupidly obvious when fishing for data

----------

netslacker said:
No, you're not. As the article on iDownloadblog.com states, many users are clicking through the security warnings anyways and continuing through to the fraudulent site. Using a different browser still can't save stupid from being stupid.

Indeed. Wife was browsing to her online banking site and got a security error and clicked faster than I could say 'stop'. Granted, the SSL was 'uist' expired rather than a dodgy website, but regardless I suggested waiting a day making sure they have renewed it.

kd5jos · Oct 20, 2014

brendu said:
He claims they (Apple) can't decrypt it. To the best of his knowledge this is likely true. I still wouldn't bet against the possibility that the NSA has full access to Apple's (and everyone else's) servers and no one at Apple even knows about it.

And I would take that bet. Apple designs the hardware AND the OS. No, I don't see the government sneaking something in on this one. Another provider where the OS is closed source and many people manufacture what goes in the box... I could see the government getting access. No, I don't believe in magic, which is what the NSA would have to be using at this point.

3282868 · Oct 20, 2014

It is possible Chinese authorities are using this hack to penalize Apple for taking extra measures that would prevent the government from snooping on phones.

It's "possible" or "fact"?

If this pans out to be valid, it makes me even more ill that so much business is conducted in China.

Then again, our NSA, CIA, etc aren't angels by any stretch.

Fzang · Oct 20, 2014

Okay, so now I've tried Safari 8, IE 11 and the latest Qihoo. None of them give any security messages. Qihoo's URL and certificate looks perfectly legit.

What's going on? What can I trust!?

OtherJesus · Oct 20, 2014

Coexist!!! Coexist!!!!!!!!!!!!!!!!!!

Chinese Authorities Allegedly Harvesting iCloud Logins Using Redirected Dummy Site

macrumors bot

macrumors 65816

macrumors 68000

macrumors 6502

macrumors 604

macrumors 604

macrumors 604

macrumors 6502

Cancelled

macrumors 65816

macrumors regular

macrumors regular

macrumors G5

macrumors 6502a

macrumors 6502a

macrumors 65816

macrumors 604

macrumors 6502a

macrumors 604

macrumors 6502

macrumors 65816

macrumors 6502

macrumors 603

macrumors 65816

macrumors 6502

Our Staff