Hackers Using iCloud's Find My iPhone Feature to Remotely Lock Macs and Demand Ransom Payments

[mazz0]

But resetting the device fixes it? I thought it let you lock it completely to make it not worth stealing?

 

[schlitzz]

Oh wait, Hillary......

 

[expiredyogurt]

IIRC when this happens, you have to bring the mac and a POP to an AASP instead of the ARS according to an internal article to get the FMIP thing disabled on the mac. ARS would work too i guess but you need POP for the mac as well to prove owenership

 

[spazzcat]

Macurmors quote:

"Impacted users likely used the same email addresses, account names, and passwords for multiple accounts, allowing people with malicious intent to figure out their iCloud details."

And this is exactly why I reconfigure all my passwords for my accounts on a regular basis. Stagnancy can be part of the problem.

I also have an iCloud only email account...

 

[JamesIV]

Meh, this is why things live on external drives. If I lost or had my laptop stolen, I'd wipe it and be back up and running in 25 minutes without the hassle.

Exactly. External drive plus offsite cloud backup. Make sure your covered from all angles.

 

[johnparjr]

Erasing will not fix this issue

 

[Apple_Robert]

How is it the hackers got past two-factor?

 

[OzyOly]

Exactly. External drive plus offsite cloud backup. Make sure your covered from all angles.

iCloud is my cloud backup.

 

[840quadra]

I wouldn’t not use 2FA because of this. I would simply update my password to something MEGA complex, that isn’t used with another service you use or have access to. While I doubt mine was part of any leak, I took the precaution to update my Password when I saw this article.


Then..

Wait for Apple to produce a fix for this (quite bad) loophole.

Hopefully they will enable people to shut off the web portal, especially for those of us with multiple trusted devices.

 

[remydlc]

2FA is not longer secure. Do not use your phone number as 2FA, use something else, like a 2 Step Authentication service like Google's Authenticator or LastPass, etc.

 

[Chocolatemilty]

I love how I realized I haven't changed my iCloud password in years, so I go to do it and the iCloud website keeps throwing an error. That's comforting.

 

[iBluetooth]

They most likely obtained the credentials from a phishing attempt. I had about 3 attempts in the last month and they look legit.
Don't click on a link from mail to log in anywhere!

 

[brianvictor7]

Some evil people out there. Always vary your passwords.

 

[JamesIV]

iCloud is my cloud backup.

Try BackBlaze. $5/month for peace of mind.

 

[jlseattle]

Updated already complex password with a new one. Too much personal information iCloud to let hackers get access to.

 

[bobmepp]

I liked how he said "y'all"

"y'all come back now ! yah hear?!"

Probably from Texas, where my son & his family live. Used a lot there, even in urbane Houston and Austin. Don't make fun.

 

[robbysibrahim]

Thankfully, for now, Macs don't use Activation Lock. However, for an iOS device if the hacker *also* changed your iCloud password then you won't be able to remove Activation Lock even if you wipe the device. You'd be required to unlock it with your iCloud password during setup.

 

[ersan191]

To those saying 'require find my iphone to use 2FA' - how exactly are you going to authorize the iCloud login if you can't find your device...

 

[lunarworks]

Apple should allow you to log into iCloud and reverse the device lock.

 

[alexclst]

From the article:

Users who have had their Macs locked will need to erase their machines or restore from a backup to remove the lock if no passcode is available.

As far as I know the passcode that Find My Mac sets is a Firmware Password. This is in addition to any Firmware Password you've explicitly set on the Mac (as in, if you've set one, Find My Mac can still set its own temporary one). Firmware Passwords cannot be removed without knowing them, except by using special hardware that Apple Support has, so by going to a Genius. They will ask you for proof of purchase. Erasing a Mac, and restoring from a backup, will not remove the Firmware Password. This is in the very nature of the kind of security Firmware Passwords are meant to be. Older Macs, I think 2011 and below, could get the Firmware Password wiped by doing a NVRAM reset, or SMC reset, or something. But all newer Macs require the special hardware to remove the Firmware Password.

 

[thespacekid]

The problem I've seen is that changing the iCloud password causes so many problems, it's painful to do it.

 

[JamesIV]

To those saying 'require find my iphone to use 2FA' - how exactly are you going to authorize the iCloud login if you can't find your device...

Write down your backup codes? ¯\_(ツ)_/¯

 

[neurophysicist]

Users who have had their Macs locked will need to erase their machines or restore from a backup to remove the lock if no passcode is available. Apple Support can offer specific assistance on the steps that need to be followed to remove the lock.

Question; I don't use Find My Mac, but I assume it locks the Mac with a firmware password, which would require a reset from Apple. How would erasing the machine or restoring from backup fix the situation? That would just wipe the hard drive. You could replace a hard drive, but that wouldn't get you past the firmware password screen.

 

[nsayer]

2FA is not longer secure. Do not use your phone number as 2FA, use something else, like a 2 Step Authentication service like Google's Authenticator or LastPass, etc.

That's as may be, but it has absolutely nothing to do with this story. 2FA was not... a factor... in these incidents.

 

[canadianreader]

I feel sorry for those who rely on iCloud for work...