Hacker Team Claims Compromise of Apple's iCloud and Activation Lock, Possibly via SSL Bug [Updated]

Discussion in 'MacRumors.com News Discussion' started by MacRumors, May 21, 2014.

  1. macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    [​IMG]
    A pair of hackers from the Netherlands and Morocco, identifying themselves as AquaXetine and MerrukTechnolog, claim to have compromised the security of Apple's iCloud system for locking iOS devices.

    The hack will unlock stolen iPhones by bypassing Activation Lock, making it possible for thieves to resell the phones easily on the black market, reports Dutch publication De Telegraaf [Google Translate]. It also may provide hackers with access to Apple ID passwords and other personal information stored in Apple's iCloud service.

    The hackers reportedly worked on the vulnerability for five months, studying the transmission of data between iPhone handsets and Apple's iCloud services. The pair claim to be able to unlock a locked iPhone by placing a computer between the iPhone and Apple's servers. In this configuration, the iPhone mistakenly identifies the hacker's computer as one of Apple's servers and follows instructions provided by the nefarious computer to reverse activation lock on the handset.

    While the hackers did not reveal precise information on how their intercepting computer can spoof Apple's iCloud activation servers, it appears that they may be taking advantage of an SSL bug that is present in iTunes for Windows, as noted by iPhone in Canada, who spoke to security researcher Mark Loman about the issue. The previously disclosed issue was fixed in iOS 7.0.6 and OS X 10.9.2, but it appears that iTunes for Windows is still affected.
    The vulnerability reportedly allows hackers to intercept Apple ID credentials, which can then be used to unlock iOS devices that have been locked after having been lost or stolen.
    Using this technique, the hackers claim to have unlocked 30,000 iPhones in the past few days. The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information.

    Update 10:43 AM: One of the hackers has denied that the bypass involves an SSL bug.

    Article Link: Hacker Team Claims Compromise of Apple's iCloud and Activation Lock, Possibly via SSL Bug [Updated]
     
  2. macrumors regular

    crossifixio

    Joined:
    Mar 21, 2007
    Location:
    London
    #2
    Damn that would be bad!
     
  3. Guest

    Sky Blue

    Joined:
    Jan 8, 2005
    #3
    "The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information."

    lol, Apple
     
  4. macrumors 6502a

    stiligFox

    Joined:
    Apr 24, 2009
    Location:
    10.0.1.3
    #4
    I imagine this will be solved with a simple iOS update and a change of Apple's server.

    That being said -- on a similar topic - Now that Activation Lock exists, it is astonishing to me the sheer amount of iCloud locked iPhones on eBay that are pretty much only good for parts/trash. On the one hand, yes it might keep phones in the owners possession, but on the other hand, it creates a lot of garbage that will end up in the landfill.

    Possibly even more surprising to me is that people are paying almost full price for these locked phones :(
     
  5. macrumors 601

    Yvan256

    Joined:
    Jul 5, 2004
    Location:
    Canada
    #5
    In my opinion, that's the proper way to do it.

    1. Contact the manufacturer to inform them of the problem.
    2. Give them some time to fix it.
    3. If they haven't fixed it after a few months, go public to force them to react.
     
  6. macrumors 68000

    keysofanxiety

    Joined:
    Nov 23, 2011
    #6
    Yep. Locked phone = stolen phone.
     
  7. Crosscreek, May 21, 2014
    Last edited: May 21, 2014

    macrumors 68000

    Crosscreek

    Joined:
    Nov 19, 2013
    Location:
    Margarittaville
    #7
    The NSA knew this all along.
     
  8. macrumors 6502a

    stiligFox

    Joined:
    Apr 24, 2009
    Location:
    10.0.1.3
    #8
    Not 100% of the time -- I've seen phones where the original owner forgot to unlock the phone before selling it, but Apple doesn't provide a way to contact/email the original owner :(

    But aye, they are mostly stolen.
     
  9. macrumors 603

    Stella

    Joined:
    Apr 21, 2003
    Location:
    Canada
    #9
    They did, in March. Still not fixed.
     
  10. macrumors newbie

    Joined:
    May 21, 2014
    #10
    These billion dollar companies really need to stay on top of all this. They're happy to take your money but not so quick to safeguard your details.

    And now there's trouble at eBay.
     
  11. macrumors member

    Joined:
    Apr 26, 2006
    #11
    Annnnnnd cue the tech press over-reacting and blowing this way out of proportion.

    Not that this isn't a serious flaw; it is. But because it's Apple it will be presented as the end of the world, and covered by every major news outlet where-as a similar bug in Android is barely mentioned by anyone at all.
     
  12. macrumors regular

    Joined:
    Mar 10, 2014
    #12
    So they wasted 5 months of work so Apple can patch it in a week? I don't see the point
     
  13. macrumors 65816

    Joined:
    Jun 19, 2013
    #13
    They claimed they unlocked 30,000 iPhones??? I'm to believe that many iPhones' activation lock was bypassed and the internet community was not ablazed with that info???
     
  14. macrumors demi-god

    Shrink

    Joined:
    Feb 26, 2011
    Location:
    New England, USA
    #14
    Source, please.
     
  15. macrumors 65816

    556fmjoe

    Joined:
    Apr 19, 2014
    #15
    Apple didn't patch it in a week. They haven't done a thing about it since March. The point is to get Apple to secure their products, and publicly releasing vulnerabilities is the only way to do that.
     
  16. Administrator/Editor

    WildCowboy

    Staff Member

    Joined:
    Jan 20, 2005
    #16
    There is, however, a difference between simply going public with the info and exploiting the issue to unlock 30,000 locked phones as they claim to have done.
     
  17. macrumors newbie

    McGrath1982

    Joined:
    May 21, 2014
    Location:
    Crewe UK
    #17
    First eBay now Apple :eek:

    2013 13" MBP iPad Air iPhone 5s
     
  18. macrumors 65816

    556fmjoe

    Joined:
    Apr 19, 2014
    #18
    It puts more pressure on Apple to get a fix rolled out and prevents them from passing it off as a theoretical attack.
     
  19. macrumors 6502a

    Joined:
    Aug 6, 2008
    #19
    So anyone can claim anything they want and people instantly believe them without a shadow of doubt? When did the public become so easily gullible?

    I'm not saying its not true. I'm saying none of us know. Just because some hackers claim something doesn't make it true. And how exactly are they trustworthy to begin with? These are people hacking into places they shouldn't be, unlocking stolen phones, and you don't even have a sliver of doubt about their honesty?
     
  20. macrumors 65816

    556fmjoe

    Joined:
    Apr 19, 2014
    #20
    The fact that they're exploiting the vulnerability means they're pretty trustworthy when they say there is one.
     
  21. macrumors 603

    Stella

    Joined:
    Apr 21, 2003
    Location:
    Canada
    #21
    Chill.
    Don't take it as a personal attack on yourself.
     
  22. macrumors newbie

    Joined:
    Jan 8, 2011
    #22
    clearly you don't understand security. If a lock is pickable, you get a better lock. This was a discovery that a lock was able to be bypassed. So Apple can and should build a better lock, even if it's only 5 minutes worth of work.

    Yeah, it smells of SSL GoToFail and Man-in-the-middle. A bummer of a time SSL has had lately.
     
  23. macrumors 68030

    Joined:
    Feb 17, 2009
    #23
    How would you know that they haven't done a thing about it?

    Obviously they will not broadcast anything when things like that happen.

    And, fixes are not really pulled out off a drawer.

    Analysis, testing etc. has to happen first. That takes time.

    But..........................
     
  24. macrumors 65816

    Joined:
    Aug 28, 2013
    #24
    Anyone who claims Apple doesn't take security of its products and services seriously, and doesn't care passionately about protecting our personal information - put simply they don't know Apple. There is no company on earth who has a better track record in this arena than Apple.
     
  25. macrumors 603

    Michaelgtrusa

    Joined:
    Oct 13, 2008
    Location:
    Everywhere And Nowhere
    #25
    More time than they can handle.
     

Share This Page