Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Hackers Using iCloud's Find My iPhone Feature to Remotely Lock Macs and Demand Ransom Payments

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
68,555
39,406



Over the last day or two, several Mac users appear to have been locked out of their machines after hackers signed into their iCloud accounts and initiated a remote lock using Find My iPhone.

With access to an iCloud user's username and password, Find My iPhone on iCloud.com can be used to "lock" a Mac with a passcode even with two-factor authentication turned on, and that's what's going on here.

maclockedfindmyiphone-800x600.jpg

Apple allows users to access Find My iPhone without requiring two-factor authentication in case a person's only trusted device has gone missing.

2faicloud-800x557.jpg
2-factor authentication not required to access Find My iPhone and a user's list of devices.​

Affected users who have had their iCloud accounts hacked are receiving messages demanding money for the passcode to unlock a locked Mac device.

Y'all my MacBook been locked and hacked. Someone help me @apple @AppleSupport pic.twitter.com/BE110TMgSv - Jovan (@bunandsomesauce) September 16, 2017
Click to expand...

The usernames and passwords of the iCloud accounts affected by this "hack" were likely found through various site data breaches and have not been acquired through a breach of Apple's servers.

Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details.

lockmacfindmyiphone.jpg
It's easy to lock a Mac with a passcode in Find My iPhone if you have someone's Apple ID and password.​

To prevent an issue like this, Apple users should change their Apple ID passwords, enable two-factor authentication, and never use the same password twice. Products like 1Password, LastPass, and even Apple's own iCloud Keychain are ideal ways to generate and store new passwords for each and every website.

So a hacker gained access to my iCloud account (despite two-factor authorization) while I was asleep this morning. - Jason Caffoe (@jcaffoe) September 20, 2017
Click to expand...

Users who have had their Macs locked will need to get in contact with Apple Support for assistance with removing the Find My iPhone lock.

(Thanks, Eli!)

Article Link: Hackers Using iCloud's Find My iPhone Feature to Remotely Lock Macs and Demand Ransom Payments
 
Article Link
https://www.macrumors.com/2017/09/20/hackers-find-my-iphone-remote-mac-lock/
Macurmors quote:

"Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details."

And this is exactly why I reconfigure all my passwords for my accounts on a regular basis. Stagnancy can be part of the problem.
 
  • Like
Reactions: SigEp265, cdcastillo, t1meless1nf1n1t and 9 others
Relentless Power said:
Macurmors quote:

"Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details."

And this is exactly why I reconfigure all my passwords for my accounts on a regular basis. Stagnancy can be part of the problem.
Click to expand...
And always use 2Factor. I don’t buy the second tweet about someone getting hacked with having 2FA enabled. Even if they could guess your password and the security code, your trusted device would still get a notification and you could block access.

Edit: Apparently FMI is immuned to 2FA. My bad.
 
Last edited:
  • Like
Reactions: SigEp265 and BigMcGuire
Bet they're using some stolen Equifax credentials since these folks likely used the same password across multiple accounts.
 
  • Like
Reactions: FriendlyMackle
Yup, this happened to me back in June when I installed beta 1 of MacOS High Sierra. Frustrating and embarrassing when your an IT engineer and your own device gets hacked! Had to bring it to Apple and provide proof of ownership before they would remove the lock.

Mlrollin91 said:
And always use 2Factor. I don’t buy the second tweet about someone getting hacked with having 2FA enabled. Even if they could guess your password and the security code, your trusted device would still get a notification and you could block access.
Click to expand...

I had 2 factor enabled, saw that someone was trying to access my account, denied them, and still had my account locked.
 
  • Like
Reactions: saiz66, Luke MacWalker, Ntombi and 8 others
Mlrollin91 said:
And always use 2Factor. I don’t buy the second tweet about someone getting hacked with having 2FA enabled. Even if they could guess your password and the security code, your trusted device would still get a notification and you could block access.
Click to expand...

You can access Find my iPhone without needing 2FA authorization. Try it, go to iCloud.com, deny the 2FA request after entering username/password, then click on Find my iPhone at the bottom. This is what happened to these folks.

An easy solution would be if your account has multiple trusted devices, to require 2FA even when accessing FMI, since it would be highly unlikely you would lose access to all of your trusted devices at once.

To edit, you can actually access a good bit of things even without the 2FA authorization. You can remove Apple Pay cards and other devices from your iCloud account. I really think Apple needs to reconsider this ability.
 
  • Like
Reactions: BigMcGuire, Robert.Walter, Shirasaki and 4 others
This is why I have absolutely no sympathy for those affected. If you use the same password for multiple sites and do not understand even the basics of security then you deserve to get hacked. This is also why I do not put my Apple ID anywhere on any website and the only people other than myself who know what it is is Apple.
It is also why I use the most complex lengthy password possible and never use the same password twice anywhere.
As well as using different email addresses for sites and services.
 
  • Like
Reactions: jjm3
This isn't fun, but could have been avoided if the password wasn't simple or had two factor authentication (preferably both).
 
  • Like
Reactions: jjm3
This isn't new. One of our team had this exact thing happen four weeks ago. Had to take his MBP to the Apple Store, where it was kept overnight. The Genius Bar person said that they see two or three of these a day.
 
archvile said:
You can access Find my iPhone without needing 2FA authorization. Try it, go to iCloud.com, deny the 2FA request after entering username/password, then click on Find my iPhone at the bottom. This is what happened to these folks.

An easy solution would be if your account has multiple trusted devices, to require 2FA even when accessing FMI, since it would be highly unlikely you would lose access to all of your trusted devices at once.
Click to expand...
My bad. I did not know that. Thank you.
 
  • Like
Reactions: BigMcGuire
If you already have a password for your Mac, I don’t think you can add one with find my iPhone. I think if you don’t have a password, you then can add one.
 
busyscott said:
MacRumors, why are you recommending two-factor authentication if you then go onto say you can access Find My iPhone without needing 2FA??

Here's a better recommendation: turn off Find My Mac until Apple correct course and Find My iPhone requires 2FA.
Click to expand...

And how would forcing 2FA work if say I miss placed my trusted device, which also happen to be my phone, while on vacation and not near a second trusted device?
 
  • Like
Reactions: t1meless1nf1n1t, ZZ9pluralZalpha and CombatCaptured
This is what happen on my iPhone and I had 2 phase Authentication on it.. Apple said they have not see this before and i must have been messing around with them.. They only way I got it fixed was by taking out my sim and putting it in another iPhone and have it send a code to that phone to unlock the the block.. wow..
 
moz5835 said:
This isn't new. One of our team had this exact thing happen four weeks ago. Had to take his MBP to the Apple Store, where it was kept overnight. The Genius Bar person said that they see two or three of these a day.
Click to expand...
So Apple can bypass the lock? It makes sense for situations such as this or when a lost or stolen device is recovered.
 
archvile said:
An easy solution would be if your account has multiple trusted devices, to require 2FA even when accessing FMI, since it would be highly unlikely you would lose access to all of your trusted devices at once.
Click to expand...

Yeah. It's a tricky situation, though.

shplock said:
This is why I have absolutely no sympathy for those affected. If you use the same password for multiple sites and do not understand even the basics of security then you deserve to get hacked.
Click to expand...

What's your basis for the assumption that the affected users re-used their password?
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back