iCloud account security breached

[ariahault]

Can any one share details how it happened with my iPhone 6 S Plus:

Lost Mode was enabled for lost iPhone 6 S Plus from another Apple device in same iCloud account. Lost iPhone 6 S Plus was found missing from the Found Phone list after few days.

 

[noobinator]

Did you receive any texts/emails from "Apple" telling you something about your apple account and to go to a link and enter your username and pw?

 

[ariahault]

Did you receive any texts/emails from "Apple" telling you something about your apple account and to go to a link and enter your username and pw?

no such communication. just to share the lost phone is still showing in iCloud > Devices

 

[noah82]

You need to change your iCloud password immediately and you need to turn on two factor authentication.

 

[Applejuiced]

So they didn't remove it from your icloud account then.

 

[ariahault]

So they didn't remove it from your icloud account then.

Apple Justification :
Thief opened you iPhone with correct passcode, which removed it from Find iPhone list. I tested this scenario using iPhone 4, which was not removed from Find iPhone list.

I refused to accept their justification.

Being in Device list is partially useless, as I cannot put it back to Find iPhone list and enable its Lost Mode.
[doublepost=1491595003][/doublepost]

You need to change your iCloud password immediately and you need to turn on two factor authentication.

two factor authentication enabled already. how it can help in my concern now?

 

[Apple_Robert]

Apple Justification :
Thief opened you iPhone with correct passcode, which removed it from Find iPhone list. I tested this scenario using iPhone 4, which was not removed from Find iPhone list.

I refused to accept their justification.

Being in Device list is partially useless, as I cannot put it back to Find iPhone list and enable its Lost Mode.
[doublepost=1491595003][/doublepost]

two factor authentication enabled already. how it can help in my concern now?

Did you have a 4 digit passcode, 6 digit, or a character passcode?

 

[ariahault]

Did you have a 4 digit passcode, 6 digit, or a character passcode?

iPhone 6 S Plus : 6 digit passcode

 

[Apple_Robert]

iPhone 6 S Plus : 6 digit passcode

With a 6 digit passcode, the odds are certainly in the owner's corner. However, a thief can get lucky with guesses.

If Apple states that the phone was unlocked properly with the passcode, I am inclined to believe them. They have no reason to lie.

 

[ariahault]

With a 6 digit passcode, the odds are certainly in the owner's corner. However, a thief can get lucky with guesses.

If Apple states that the phone was unlocked properly with the passcode, I am inclined to believe them. They have no reason to lie.

I have reason to not believe what they assume:

1) First they said one of my family members using same iCloud account removed the device. I asked them to check their logs and share with me, which they excused later.

2) Once they said correct passcode was used, which caused its removal from Find Phone list and disabled its Lost Mode, I test the same steps with Apple support with me on call using iPhone 4 device.

- I opened iPhone 4 using correct passcode.
- I connected the iPhone 4 to net, then device Lost Mode was disabled in Find Phone list for device.
- iPhone 4 was visible, hence not disappeared as claimed by Apple support.

So, I have sound reason to refuse their assumption.

Here, another concern is raised, I received popup message in other devices that iPhone 4 is found, but no popup observed for iPhone 6 S Plus. Also, this assumption of Apple support leads to fact that iPhone 6 S Plus was connected to net and my iCloud account, Apple should be able to share logs for this activity.

I am surprised to a lost device once put into Lost Mode, how it is allowed to removed from Lost Mode once access by passcode. It should be disabled only from Find Phone service in iCloud or other device ( poor apple security).

 

[Applejuiced]

Apple Justification :
Thief opened you iPhone with correct passcode, which removed it from Find iPhone list. I tested this scenario using iPhone 4, which was not removed from Find iPhone list.

I refused to accept their justification.

Being in Device list is partially useless, as I cannot put it back to Find iPhone list and enable its Lost Mode.
[doublepost=1491595003][/doublepost]

two factor authentication enabled already. how it can help in my concern now?

That's weird.
So they removed the find my iPhone icloud lock from it? Putting in the correct pin does no remove it from find my iPhone. They need your icloud password.
You cant view it in the device list any more when you log in icloud?
So they guessed your 6 digit pin within so many wrong attempts before the device locks and resets?
And then after they got in they disabled find my iPhone?
What are the odds of that happening?
Another new member that just registered with a story that doesn't make sense...

 

[noobinator]

There's no way this happened as presented. It's like astronomical odds.

 

[ariahault]

That's weird.
So they removed the find my iPhone icloud lock from it? Putting in the correct pin does no remove it from find my iPhone. They need your icloud password.
You cant view it in the device list any more when you log in icloud?
So they guessed your 6 digit pin within so many wrong attempts before the device locks and resets?
And then after they got in they disabled find my iPhone?
What are the odds of that happening?
Another new member that just registered and story that doesn't make sense...

I have registered case with Apple. see below call log from Apple support.

 

[Apple_Robert]

I agree with Noob and AJ. While it is possible that someone could correctly guess a 6 digit code, they would need to know your iCloud email and password to do the other things you are talking about. There is no way that they did all that without having access to such information. The odds of someone knowing your iCloud Email and correctly guessing your password, not to mention the 6 digit pin code to unlock the phone is so far into deep space, it is all beyond plausible. The only way that someone could quickly and accurately guess / input such details, is if said person were a close family member and knew the information.

 

[ariahault]

There's no way this happened as presented. It's like astronomical odds.

I was having same believe until 4/4/2017 10:00am KSA time, the moment I saw device in Find Phone list and in Lost Mode.

see attached apple calls.

[doublepost=1491602088][/doublepost]

I agree with Noob and AJ. While it is possible that someone could correctly guess a 6 digit code, they would need to know your iCloud email and password to do the other things you are talking about. There is no way that they did all that without having access to such information. The odds of someone knowing your iCloud Email and correctly guessing your password, not to mention the 6 digit pin code to unlock the phone is so far into deep space, it is all beyond plausible. The only way that someone could quickly and accurately guess / input such details, is if said person were a close family member and knew the information.

I am with my family living in Saudi Arabia and iPhone lost during my 10 days visit in Pakistan. iPhone was lost in market during rush hours and found off within 10 min (as I came to know it is lost), and was put in Lost mode with in 30 minutes and was offline until 4/4/2017. Hence, even there is 0 % chance if some one was able to guess correct passcode.

In case my iCloud account was accessed, Apple should be able to provide logs as I requested already.

 

[Applejuiced]

What are the odds of someone guessing your 6 digit passcode without getting the iphone disabled?

• 1-5 incorrect passcode attempts: No problem.
• 6 incorrect attempts: iPhone disabled for 1 minute.
• 7 incorrect attempts: iPhone disabled for 5 minutes.
• 8 incorrect attempts: iPhone disabled for 15 minutes.
• 9 incorrect attempts: iPhone disabled for 60 minutes.
• 10 incorrect attempts: “iPhone is disabled. Connect to iTunes”

 

[Apple_Robert]

I was having same believe until 4/4/2017 10:00am KSA time, the moment I saw device in Find Phone list and in Lost Mode.

see attached apple calls. View attachment 695354
[doublepost=1491602088][/doublepost]

I am with my family living in Saudi Arabia and iPhone lost during my 10 days visit in Pakistan. iPhone was lost in market during rush hours and found off within 10 min (as I came to know it is lost), and was put in Lost mode with in 30 minutes and was offline until 4/4/2017. Hence, even there is 0 % chance if some one was able to guess correct passcode.

In case my iCloud account was accessed, Apple should be able to provide logs as I requested already.

Apple will not provide logs without a court order.

I don't know if the language barrier is making this more incredible than has already been presented but, the odds of someone (not a family member or very close friend who has seen you input such information many times before) correctly guessing your email, password and 6 digit pin code in a matter of moments as you stated is impossible, provided your password isn't "password 123" etc.

What you have stated in the thread isn't adding up correctly.

 

[borgsauce]

Could you have your icloud login details maybe in your note app or perhaps in the image gallery?

 

[Geewhizz]

Easy
If they know your pin to go into your phone
Add a finger print
Then settings/safari/passwords use Touch ID then they can see your iCloud login details

 

[Applejuiced]

Easy
If they know your pin to go into your phone
Add a finger print
Then settings/safari/passwords use Touch ID then they can see your iCloud login details

I don't have any passwords stored or showing there.
And I use iCloud and find my iPhone.
The op story has many holes but I wish him best of luck.

 

[ariahault]

Could you have your icloud login details maybe in your note app or perhaps in the image gallery?

Nope, but still Apple should say it is done through my account. Which they confirmed through support, not done from my account.
[doublepost=1491630557][/doublepost]

Apple will not provide logs without a court order.

I don't know if the language barrier is making this more incredible than has already been presented but, the odds of someone (not a family member or very close friend who has seen you input such information many times before) correctly guessing your email, password and 6 digit pin code in a matter of moments as you stated is impossible, provided your password isn't "password 123" etc.

What you have stated in the thread isn't adding up correctly.

none of your assumption true. apple support confirmed not removed by my iCloud account and never used password like 123 etc.
[doublepost=1491630605][/doublepost]

I don't have any passwords stored or showing there.
And I use iCloud and find my iPhone.
The op story has many holes but I wish him best of luck.

could please highlight the story holes?
[doublepost=1491630659][/doublepost]

Easy
If they know your pin to go into your phone
Add a finger print
Then settings/safari/passwords use Touch ID then they can see your iCloud login details

u mean by this way one can see iCloud password?

 

[Applejuiced]

So now you're saying its not removed from your icloud account?
Its still there listed in find my iphone?

 

[ariahault]

So now you're saying its not removed from your icloud account?
Its still there listed in find my iphone?

Saying 'its not removed from your iCloud account?' and 'its not removed by your iCloud account?' has nothing in common as both are different statement.

I will say it again and try to make it more clear and specific :

1. iPhone 6 S Plus lost on 29/3/2017
2. Lost Mode enabled for lost iPhone 6 S Plus with in 30 minutes.
3. iPhone 6 S Plus appeared as offline in Find Phone
4. iPhone 6 S Plus disappeared from Find Phone list on 4/4/2017
5. Same day issue of iPhone 6 S Plus of lost iPhone 6 S Plus from Find Phone list as :

- One of my family member (as I have all family devices under same iCloud account) accidently removed
lost iPhone 6 S Plus from Find Phone list. I refused to accept this assumption and requested them to verify
it from their log etc. They confirmed that there is no logs that lost iPhone 6 S Plus was removed from Find Phone
list by any of my registered devices using my iCoud account.

- Some one was able to open iPhone 6 S Plus with correct passcode, hence it its lost mode disabled and
it disappeared from Find Phone list.

I refused to accept this justification, and requested them to provide technical justification and add
iPhone 6 S Plus back to Find Phone list. Support forwarded the issue to their Technical team and it is
pending until today (3 days).

- Some one used a 3rd party software etc ... I totally disappointed with this justification and refused to accept it.

Hence, what you are saying is wrong and misunderstanding.

Regards,

 

[Applejuiced]

You're trying to play with words now?
Is it on your icloud account or not?
What Apple is telling you is that someone that has access to your icloud removed it.
Somehow they guessed your 6 digit pass code and got in without disabling the device with too many wrong pass-code attempts? Yeah ok.
Not sure what else you're looking from us? If Apple cannot help you any further and the phone is lost looks like you are out of luck.
Good luck with whatever you decide to do.

 

[I7guy]

I don't have any passwords stored or showing there.
And I use iCloud and find my iPhone.
The op story has many holes but I wish him best of luck.

FWIW, on my phone I have a restrictions enabled, with a restriction on accounts. This effectively disables the ability to go into icloud on an unlocked phone without first going into restrictions, and enabling accounts. It's another level of protection, should I lose my iphone unlocked. The phone is set to lock in two minutes.