HELP: I think my iPad was hacked overnight ** pls help :(

[Sodner]

He is wrong.



No.

Are you sure that you didn't purchase something with your parent's credit card on Amazon and then came to MacRumors to create a thread with a psuedonym that can't be linked to you personally to justify the story of the possibility that it was due to hacking?

Once an attacker has access to an online purchase account, it is easy to change the delivery destination to somewhere else that does not reveal the identity of the attacker other than the targets home. It does not make sense that the items were sent to your house.

I am afraid that if this is not a troll that I have to call it a scam on the part of the OP.

This sounds like one very elaborate hack that in the end gained the culprit nothing, zip, nadda..... since all these fraudulent changes were in fact being delivered to your own home??? Be like a bank robber breaking into a vault, stealing all the money only to take it to another bank and deposit it into an account under the name of the bank he just robbed.

 

[rworne]

This sounds like one very elaborate hack that in the end gained the culprit nothing, zip, nadda..... since all these fraudulent changes were in fact being delivered to your own home??? Be like a bank robber breaking into a vault, stealing all the money only to take it to another bank and deposit it into an account under the name of the bank he just robbed.

Sure they can deliver to the home. Why?

1. No problems with the CC company and merchant (shipping address == billing address)
2. They stake out the property and grab the packages as soon as the UPS truck pulls away.

Yeah it all goes to hell if someone is actually home, but lots of deliveries take place during people's work hours.

 

[munkery]

Just because the iPad is asleep does not mean background tasks aren't running. It's up to the app developer to set that option. I don't know about Safari, but let's assume for the moment it does run in the background.

I thought client side apps do not run in the background?

Isn't this type of multitasking not present in iOS (unless jailbroken?) in favour of the pause/resume paradigm?

The only exception to this that I can think of is for push notifications, which I assume are controlled via some specific API within iOS given the lack of client-side multitasking in iOS.

BTW, the OP already stated that the iPad was not jailbroken.

 

[Gav2k]

Wirelessly posted (Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8J2 Safari/6533.18.5)

I think you forgot an important date and your wife is punishing you!

 

[Sodner]

Sure they can deliver to the home. Why?

1. No problems with the CC company and merchant (shipping address == billing address)
2. They stake out the property and grab the packages as soon as the UPS truck pulls away.

Yeah it all goes to hell if someone is actually home, but lots of deliveries take place during people's work hours.

Again, the most sophisticated and elaborate hack to an iOS product ever and the thief orders 4 grand worth of stuff for delivery to the owners home hoping that by some chance the owner is not home at the time of delivery so they can complete the heist?

Come on!!!!

 

[Smittay]

He is wrong.



No.

Are you sure that you didn't purchase something with your parent's credit card on Amazon and then came to MacRumors to create a thread with a psuedonym that can't be linked to you personally to justify the story of the possibility that it was due to hacking?

Once an attacker has access to an online purchase account, it is easy to change the delivery destination to somewhere else that does not reveal the identity of the attacker other than the targets home. It does not make sense that the items were sent to your house.

I am afraid that if this is not a troll that I have to call it a scam on the part of the OP.

first off, im 36, my parents havent paid for anything in my whole life since i was 18, my grandmother passed away this year and my father and aunt have custody of the house where she used to live... that is where i was at on vacation, the wireless modem is in my dad and aunts name...

i do not have the capability at all to do any of the things you said, above, only a horrible person would do that....i would never ever do that to anybody, + it was my personal credit card and amazon account that was hacked... not parents or ANYBODY else which you implied above...everything is already taken care of and amazon has canceled the charges and i had my cc linked to amazon changed and just got my new one in the mail.

and i think that the kid who might have done this was so stupid, he didnt change the mail address in amazon (i too know this is very easy, because i have 4 mail to addresses on amazon to my work home wifes work and friends house, that is why we drove home from vacation.... cause they might have shipped them here at home

i dont understand the vindictiveness of people being skeptical of me.. all i want to know is how this happened, i dont know what else to say and ive been honest from the beginning hoping for an answer... i cant believe you told me i was a kid running a scam on my parents cc, thats just horrible... i am the nicest most honest person around, too bad i cant show that over the web.

thank you though for everybody who has helped... i really appreciate it in all sincerity..

 

[rworne]

Again, the most sophisticated and elaborate hack to an iOS product ever and the thief orders 4 grand worth of stuff for delivery to the owners home hoping that by some chance the owner is not home at the time of delivery so they can complete the heist?

Come on!!!!

I'm just mentioning a common scam.

If you read my post, I pretty much figured it was unlikely that the device was hacked just for this purpose.

The attacker: knowing or cracking the WiFi password, finding a way to waken and control an iOS device, then getting the Amazon password and ordering a bunch of stuff.

Yes, it sounds implausible to me too. I'm just going along and trying to figure out how such a thing *could* happen. I can get pieces of it, but there are gaps I cannot figure out.

Like the three steps to profit with the Underwear Gnomes.

 

[LagFighter]

OP... First off, I'm going to tell you that I'm not trolling you. This is going to sound really strange, but... is it possible that you yourself did this in your sleep?

Have you ever been known to sleepwalk? I've heard of crazier things done, but believe me when I say it's not outside the realm of possibility. If you were thinking about a bunch of high-tech stuff, you might have dozed off and walked over to your iPad, subconsciously ordering tons of stuff in a dream-state.

Not saying this happened, or even that I suspect it happened. But you can't rule it out either.

inb4 the entire thread calls me a quack.

 

[wpotere]

Drunken spending spree? Just kidding...

 

[munkery]

i dont understand the vindictiveness of people being skeptical of me..

The vindictiveness and skepticism is due to the scenario you provided being entirely implausible.

If this isn't some scam by you, it is a scam by someone that you know that had physical access to the iPad.

Sorry, but it is the only rational explanation.

If I am wrong, I am pretty sure I will start to hear about more of these attacks in the mainstream news media.

 

[kalex]

reason why its skeptical is because it makes no sense.

So are you sure that you didn't go a bender the night before and order all this?

If it did happen something hasn't been disclosed. Missing pieces of the story.

Now you are blaming everything in sight. If your verizon router got hacked there is no way it would open 9 windows on your Ipad and browse 150 pages. In order to do that u need to run some sort of a server on your ipad. Things doesn't just magically happen like they do in movies.

If your ipad is not jailbroken than its impossible for that to happen. VPN is also out of question as you need to actually run VPN server on your ipad in order to connect to it, which of course needs to be installed on it first. Ipad has a built in VPN client which connects to something else.

Another thing is like others said why would anyone order this crap from amazon and ship it to your home address?


another theory - You went on a bender and right before you crashed u decided to treat yourself to stuff

 

[Smittay]

Here's my two cents:

If the perp wanted to order $8K of stuff off of Amazon *and* he had access to your iPad, you would have woken up less one iPad.

Just because the iPad is asleep does not mean background tasks aren't running. It's up to the app developer to set that option. I don't know about Safari, but let's assume for the moment it does run in the background.

Since safari is graphical, they would have to run a VNC-type app to see what they were doing.

If so, they would have to access the device through a router and NAT. Or just hack the wifi.

Now your story said this:

"anyways last night, i put the ipad into sleep mode at 1am (which i do all the time at home, never had a problem), locked the doors to the house and went to bed with the ipad in the night stand drawer next to my bed. only my wife and i were in the house...all week.

i wake up this morning and turn on my 64gb/3G 1st gen ipad (running 4.3) at 11am. i entered my 4 DIGIT PASSCODE to unlock the ipad and i click the safari app in the dock and 9 pages of history automatically opened up to sites i had never been to. so then i checked safari history and there were about 150 web pages visited, most notable, amazon.com"

What were you doing with the iPad at that time? Were you using Safari? If not, the orders could have taken place if you set the thing down (unlocked) and someone decided to mess with it. Even so, when I order from Amazon, it requires me to know my Amazon password just to complete the order.

My experience from Amazon also says that I get order confirmations within seconds of making my orders. Also, 150 websites are a hell of a lot to visit, even in one night.

If what you say is true, you hit the holy grail of a hack. Why? Every Apple hater out there is chomping at the bit for just this type of vulnerability to be exposed in iOS. You have one hell of a story for the press here.

But there is this type of vulnerability:
Did you jailbreak, put ssh on it and leave in the default password? The only other thing I can think of is a Trojaned 3rd party app loaded from the app store.

So if you are serious - and if you believe that is what truly happened, stop using the iPad - completely. Contact Apple support, let them know what happened and let them get look at the device to get whatever forensic evidence they can find.

THANK YOU SO MUCH FOR THIS.. for believing me... ive been using apple for 15 - 20 years and never ever had a problem!!

yes my safari history showed like 100 websites that were visited... and i got emails from amazon to my mobileme, indicating shipments starting at 9:15 am until 10:45 am, (we slept until about 11am and then checked the ipad about at 11:20 ish, i always check it every morning.

so if the kid did break into my ipad, WHY didnt he erase the friggin emails from amazon??? thats what i would have done and i would have changed the shipping address!!!! he left them on there, thats how i knew in addition to the safari pages that were open what he did!! i had auto-confirm emails from amazon to my mobileme !!!!

i have never ever jailbroken my ipad, i dont even know how to do it, plus it would void all warranties and i only have an ipad for an iOS platform... plus i am super paranoid all the time --- i have a hard time trusting any network or wifi with password, theres no way in hell i would jailbreak my device.

i did bring it to the apple store --- they hooked it up to forensics or whatever to a white macbook, he said there were apps running in the background causing low memory (genius double clicked my home button and there were like 2-4 apps running tops), i asked him if he could print out the report and forgot to get it from him -- the genius looked at me like i was crazy....

thank you for helping me. it was very kind of you, i just dont want to have to wipe the ipad or have a backup made when i sync it that has a bad file or program that will get into my computer...

thanks, smitt

 

[RossMc]

WEP is not secure at all. It can be hacked in under a minute if someone knows what they are doing.

 

[munkery]

Important parts of rworne's post:

If the perp wanted to order $8K of stuff off of Amazon *and* he had access to your iPad, you would have woken up less one iPad.

So, physical access.

Did you jailbreak, put ssh on it and leave in the default password? The only other thing I can think of is a Trojaned 3rd party app loaded from the app store.

Or, jailbroken.

Given that you said the device is not jailbroken, I suggest looking into someone having physical access to the iPad.

 

[Smittay]

This sounds like one very elaborate hack that in the end gained the culprit nothing, zip, nadda..... since all these fraudulent changes were in fact being delivered to your own home??? Be like a bank robber breaking into a vault, stealing all the money only to take it to another bank and deposit it into an account under the name of the bank he just robbed.

exactly!!!! it just caused me hell... and i had to leave my vacation and change everything around with password to everything !!!

and as rworne said -- why the hell didnt he just take my ipad if he was going to order all the stuff from amazon ??????

(btw i typed $8000K above in the first post, and corrected it in a previous post, it was about around $4200K from amazon)

i am so confused... thanks for helping, smitt

 

[munkery]

Btw,

yes, it sounds implausible to me too.

 

[kalex]

 

[Smittay]

Sure they can deliver to the home. Why?

1. No problems with the CC company and merchant (shipping address == billing address)
2. They stake out the property and grab the packages as soon as the UPS truck pulls away.

Yeah it all goes to hell if someone is actually home, but lots of deliveries take place during people's work hours.

also i believe they knew i was on vacation because i was 2 hours away from my physical billing and shipping amazon address... maybe they were stupid enough to drive up here to intercept?? too bad i crushed it with amazon fraud within 2 hours, so nothing shipped and all charges got voided...that is also why we came home, just in case...

seriously you guys, what should i do with this ipad?? i deleted about 20-30 apps and havent opened it up on my WIFI at home yet... i was afraid i might give the hacker access to my home network.. the AppleCare guy said on the phone, it was most likely a proximity issue on an unsecure network... so do i have to worry anymore??

what would you guys do to the iPad?? i dont want to reset all my apps .... but my cousin who uses a PC said that there were keylogger apps for the ipad that tracked every stroke, and i said, im pretty sure there are not.. and i looked all over for two hours last night and could find nothing... only keyloggers for mac computers and keyloggers for iPads that were jailbroken and mine is not...

im afraid that if i sync it with my itunes on my work computer, if there was a trojan horse or something bad in one of the apps, it would back it up before it synced it...

???

 

[Sodner]

If this is true, I hope you can understand anyone's skepticism, and to NOT reformat and reload the iPad as if new would be crazy.

 

[Smittay]

The vindictiveness and skepticism is due to the scenario you provided being entirely implausible.

If this isn't some scam by you, it is a scam by someone that you know that had physical access to the iPad.

Sorry, but it is the only rational explanation.

If I am wrong, I am pretty sure I will start to hear about more of these attacks in the mainstream news media.

thank you for writing that, i understand your frustration believing this, thats why i turned to the boards, because apple store geniuses and applecare for ipad pretty much shut me out like i was crazy... thank you for the honesty and integrity of your post above, i too am in complete disbelief and trying to be honest and tell everything i can to try to get a resolution of what to do

 

[munkery]

also i believe they knew i was on vacation because i was 2 hours away from my physical billing and shipping amazon address... maybe they were stupid enough to drive up here to intercept?? too bad i crushed it with amazon fraud within 2 hours, so nothing shipped and all charges got voided...that is also why we came home, just in case...

seriously you guys, what should i do with this ipad?? i deleted about 20-30 apps and havent opened it up on my WIFI at home yet... i was afraid i might give the hacker access to my home network.. the AppleCare guy said on the phone, it was most likely a proximity issue on an unsecure network... so do i have to worry anymore??

what would you guys do to the iPad?? i dont want to reset all my apps .... but my cousin who uses a PC said that there were keylogger apps for the ipad that tracked every stroke, and i said, im pretty sure there are not.. and i looked all over for two hours last night and could find nothing... only keyloggers for mac computers and keyloggers for iPads that were jailbroken and mine is not...

im afraid that if i sync it with my itunes on my work computer, if there was a trojan horse or something bad in one of the apps, it would back it up before it synced it...

???

It is now completely useless. Just give it away to someone willing to spend the time to figure out how it was compromised.

If you want, I can PM you a shipping address for a temporary PO box so that you can send it to me for analysis.

 

[Smittay]

reason why its skeptical is because it makes no sense.

So are you sure that you didn't go a bender the night before and order all this?

If it did happen something hasn't been disclosed. Missing pieces of the story.

Now you are blaming everything in sight. If your verizon router got hacked there is no way it would open 9 windows on your Ipad and browse 150 pages. In order to do that u need to run some sort of a server on your ipad. Things doesn't just magically happen like they do in movies.

If your ipad is not jailbroken than its impossible for that to happen. VPN is also out of question as you need to actually run VPN server on your ipad in order to connect to it, which of course needs to be installed on it first. Ipad has a built in VPN client which connects to something else.

Another thing is like others said why would anyone order this crap from amazon and ship it to your home address?


another theory - You went on a bender and right before you crashed u decided to treat yourself to stuff

thanks, i too am very confused, but the time of the ordering from amazon.com was at 9:00 in the morning until around 10:45, i was awake lying next to my wife in bed, talking about what we were going to do on vacation that day and the ipad was in the nightstand drawer in sleep mode, zipped in a case with a passcode on it... thats why this is mind boggling to me too --- thanks for trying to help me.

---------- Post added at 03:26 PM ---------- Previous post was at 03:21 PM ----------

If this is true, I hope you can understand anyone's skepticism, and to NOT reformat and reload the iPad as if new would be crazy.

ok, so wipe it and reformat it?? ughhhhh, to factory settings??

wont it backup my data from the ipad first before i even try to restore to factory settings?

---------- Post added at 03:30 PM ---------- Previous post was at 03:26 PM ----------

It is now completely useless. Just give it away to someone willing to spend the time to figure out how it was compromised.

If you want, I can PM you a shipping address for a temporary PO box so that you can send it to me for analysis.

haha...

seriously, would you guys wipe it or just move on like nothing happened???
or contact applecare again?

 

[RossMc]

It will only restore the data if you restore from backup. When it has restored just set up from new. I also highly doubt there was a keylogger in one of the apps you downloaded from the App store.

 

[munkery]

The fact that your story evolves to counter plausible explanations in support of the implausible only serves to verify that you are trying to be Criss Angel.

 

[Smittay]

HOLY CRAP YOU GUYS -- READ THIS SOMEONE JUST SENT ME FROM THE iPAD APPLE WEBSITE FORUM:

July 8, 2011 10:10am EST 4 Comments
Apple Promises Fix for iOS PDF Vulnerability

http://www.pcmag.com/article2/0,2817,2388255,00.asp

Apple this week pledged to issue a fix for an iOS vulnerability that could let hackers remotely control iPhones, iPads, and iPod touches.

"Apple takes security very seriously, we're aware of this reported issue and developing a fix that will be available to customers in an upcoming software update," an Apple spokesman said in a statement.

The move comes after the German Federal Office for Information Security (BSI) issued a warning earlier this week about the possibility of attacks via PDF files. In a translated version of the report, the agency said clicking on an infected PDF via email or on the Web is enough to infect an iOS device with malicious software and give the attacker administrative privileges on the device.

The BSI said the vulnerability affects the iPhone 3G, iPhone 4, iPad, and iPad touch running iOS up to version 4.3.3, though officials said they could not rule out the possibility that other versions of iOS were affected.

The warning said there have been no reported attacks, but anyone taking advantage of the vulnerability could potentially access things like passwords, online banking data, calendars, emails, text, or contact information. There could also be access to built-in cameras, the interception of telephone conversations, and the GPS localization of the user, BSI said.

Given that more and more professionals are using the iPad and iPhone in a business setting, BSI warned that the security hole could be used for "targeted attacks on leaders ... to get to confidential company information."

Until Apple issues its patch, therefore, BSI suggested that iOS users do not open unknown PDF files, whether they are received via email or linked on Web sites. Browser use and link clicking should also be restricted to trusted Web sites.

Apple did not release a timetable for its security update. Its last update, 4.3.3, was released in early May and solved a controversial "bug" with Apple's location-based services.

The fix comes amidst the release of JailBreakMe, software that will jailbreak an iOS device using the PDF vulnerability. The program quickly hit 1 million jailbreaks; "be sure to share a link with your friends while it's still available," Grant Paul, one of the creators, tweeted earlier this week.

"Along with the jailbreak, I am releasing a patch for the main vulnerability which anyone especially security conscious can install to render themselves immune; due to the nature of iOS, this patch can only be installed on a jailbroken device. Until Apple releases an update, jailbreaking will ironically be the best way to remain secure," JailBreakMe developer Comex said on its Web site.

HOLY CRAP - I MIGHT HAVE OPENED A PDF ON A WEBSITE !!! I HAVE NO IDEA???

crap, can someone pls read this??