Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

MacRumors

macrumors bot
Original poster
Apr 12, 2001
54,972
17,356



Over the last day or two, several Mac users appear to have been locked out of their machines after hackers signed into their iCloud accounts and initiated a remote lock using Find My iPhone.

With access to an iCloud user's username and password, Find My iPhone on iCloud.com can be used to "lock" a Mac with a passcode even with two-factor authentication turned on, and that's what's going on here.

maclockedfindmyiphone-800x600.jpg

Apple allows users to access Find My iPhone without requiring two-factor authentication in case a person's only trusted device has gone missing.

2faicloud-800x557.jpg
2-factor authentication not required to access Find My iPhone and a user's list of devices.

Affected users who have had their iCloud accounts hacked are receiving messages demanding money for the passcode to unlock a locked Mac device.

Y'all my MacBook been locked and hacked. Someone help me @apple @AppleSupport pic.twitter.com/BE110TMgSv - Jovan (@bunandsomesauce) September 16, 2017

The usernames and passwords of the iCloud accounts affected by this "hack" were likely found through various site data breaches and have not been acquired through a breach of Apple's servers.

Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details.

lockmacfindmyiphone.jpg
It's easy to lock a Mac with a passcode in Find My iPhone if you have someone's Apple ID and password.​

To prevent an issue like this, Apple users should change their Apple ID passwords, enable two-factor authentication, and never use the same password twice. Products like 1Password, LastPass, and even Apple's own iCloud Keychain are ideal ways to generate and store new passwords for each and every website.

So a hacker gained access to my iCloud account (despite two-factor authorization) while I was asleep this morning. - Jason Caffoe (@jcaffoe) September 20, 2017

Users who have had their Macs locked will need to get in contact with Apple Support for assistance with removing the Find My iPhone lock.

(Thanks, Eli!)

Article Link: Hackers Using iCloud's Find My iPhone Feature to Remotely Lock Macs and Demand Ransom Payments
 

Relentless Power

macrumors Nehalem
Jul 12, 2016
36,020
39,462
Macurmors quote:

"Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details."

And this is exactly why I reconfigure all my passwords for my accounts on a regular basis. Stagnancy can be part of the problem.
 

Mlrollin91

macrumors G5
Nov 20, 2008
13,741
9,333
Ventura County
Macurmors quote:

"Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details."

And this is exactly why I reconfigure all my passwords for my accounts on a regular basis. Stagnancy can be part of the problem.
And always use 2Factor. I don’t buy the second tweet about someone getting hacked with having 2FA enabled. Even if they could guess your password and the security code, your trusted device would still get a notification and you could block access.

Edit: Apparently FMI is immuned to 2FA. My bad.
 
Last edited:

bromosa

macrumors newbie
Sep 20, 2017
2
1
Bet they're using some stolen Equifax credentials since these folks likely used the same password across multiple accounts.
 
  • Like
Reactions: FriendlyMackle

Vol7ron

macrumors 6502
Jun 11, 2009
281
189
Derry, NH
Yup, this happened to me back in June when I installed beta 1 of MacOS High Sierra. Frustrating and embarrassing when your an IT engineer and your own device gets hacked! Had to bring it to Apple and provide proof of ownership before they would remove the lock.

And always use 2Factor. I don’t buy the second tweet about someone getting hacked with having 2FA enabled. Even if they could guess your password and the security code, your trusted device would still get a notification and you could block access.

I had 2 factor enabled, saw that someone was trying to access my account, denied them, and still had my account locked.
 

archvile

macrumors 6502
Oct 27, 2007
463
597
And always use 2Factor. I don’t buy the second tweet about someone getting hacked with having 2FA enabled. Even if they could guess your password and the security code, your trusted device would still get a notification and you could block access.

You can access Find my iPhone without needing 2FA authorization. Try it, go to iCloud.com, deny the 2FA request after entering username/password, then click on Find my iPhone at the bottom. This is what happened to these folks.

An easy solution would be if your account has multiple trusted devices, to require 2FA even when accessing FMI, since it would be highly unlikely you would lose access to all of your trusted devices at once.

To edit, you can actually access a good bit of things even without the 2FA authorization. You can remove Apple Pay cards and other devices from your iCloud account. I really think Apple needs to reconsider this ability.
 

shplock

macrumors 6502a
Dec 25, 2015
621
394
Somewhere in a Galaxy far far away
This is why I have absolutely no sympathy for those affected. If you use the same password for multiple sites and do not understand even the basics of security then you deserve to get hacked. This is also why I do not put my Apple ID anywhere on any website and the only people other than myself who know what it is is Apple.
It is also why I use the most complex lengthy password possible and never use the same password twice anywhere.
As well as using different email addresses for sites and services.
 
  • Like
Reactions: jjm3

Xavier

Contributor
Mar 23, 2006
2,664
1,261
Columbus
This isn't fun, but could have been avoided if the password wasn't simple or had two factor authentication (preferably both).
 
  • Like
Reactions: jjm3

moz5835

macrumors newbie
Sep 5, 2007
27
21
This isn't new. One of our team had this exact thing happen four weeks ago. Had to take his MBP to the Apple Store, where it was kept overnight. The Genius Bar person said that they see two or three of these a day.
 

Mlrollin91

macrumors G5
Nov 20, 2008
13,741
9,333
Ventura County
You can access Find my iPhone without needing 2FA authorization. Try it, go to iCloud.com, deny the 2FA request after entering username/password, then click on Find my iPhone at the bottom. This is what happened to these folks.

An easy solution would be if your account has multiple trusted devices, to require 2FA even when accessing FMI, since it would be highly unlikely you would lose access to all of your trusted devices at once.
My bad. I did not know that. Thank you.
 
  • Like
Reactions: BigMcGuire

Primejimbo

macrumors 68040
Aug 10, 2008
3,295
131
Around
If you already have a password for your Mac, I don’t think you can add one with find my iPhone. I think if you don’t have a password, you then can add one.
 

bbeers

macrumors regular
Dec 14, 2007
160
5
Maryland
MacRumors, why are you recommending two-factor authentication if you then go onto say you can access Find My iPhone without needing 2FA??

Here's a better recommendation: turn off Find My Mac until Apple correct course and Find My iPhone requires 2FA.

And how would forcing 2FA work if say I miss placed my trusted device, which also happen to be my phone, while on vacation and not near a second trusted device?
 

jpizzle31

macrumors newbie
Sep 20, 2017
1
0
This is what happen on my iPhone and I had 2 phase Authentication on it.. Apple said they have not see this before and i must have been messing around with them.. They only way I got it fixed was by taking out my sim and putting it in another iPhone and have it send a code to that phone to unlock the the block.. wow..
 

jlc1978

macrumors 68040
Aug 14, 2009
3,626
2,009
This isn't new. One of our team had this exact thing happen four weeks ago. Had to take his MBP to the Apple Store, where it was kept overnight. The Genius Bar person said that they see two or three of these a day.
So Apple can bypass the lock? It makes sense for situations such as this or when a lost or stolen device is recovered.
 

chucker23n1

macrumors 603
Dec 7, 2014
6,254
7,982
An easy solution would be if your account has multiple trusted devices, to require 2FA even when accessing FMI, since it would be highly unlikely you would lose access to all of your trusted devices at once.

Yeah. It's a tricky situation, though.

This is why I have absolutely no sympathy for those affected. If you use the same password for multiple sites and do not understand even the basics of security then you deserve to get hacked.

What's your basis for the assumption that the affected users re-used their password?
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.