iOS Device Ransom Attacks Continue to Target Users in U.S. and Europe

[aaarrrgggh]

Go ahead erase my Angry Birds apps.
Why would anybody keep important data on their iPhones without backing them up?
Now, if they hacked dropbox, I'd have a problem.

Well, do you have a Mac, and only Macs?

If so, AppleID becomes a gateway to access and lock everything, at the same time. Presumably it isn't too far before they can remote control your computer as well... which is authorized via AppleID as well.

Apple had better get moving on significant security improvements in the system, or Really Bad Things could happen.

 

[unplugme71]

I've used 'p@ssword' for all my forum accounts for 10+ years and never once was hacked. Then again, what does one gain by it.

 

[\-V-/]

globalmatt and Rigby are correct and I was wrong. When I was discussing this with Rigby earlier, I thought he was saying the same thing... that is logging in to the iCloud account to make FMM changes. I have 2FA on and playing with it this morning I see what Rigby means.

If you go to icloud.com in an untrusted browser and enter your AppleID and password you get this screen asking for a six digit code that was sent to your trusted device (like an iPhone). If you just ignore that and click Find my iPhone at the bottom it takes you straight to the FMM screen where you can select a device and lock it down. No 2FA verification code is needed.

I guess it makes sense if you think about it. If your iPhone is stolen you would not have the trusted device to receive the code, so would need to be able to login to FMM without it.

@Rigby > I apologize for the confusion I caused yesterday.

View attachment 639741

THAT ... defeats the entire purpose of the added security. You can't access that with two-step. Why is it accessible with two-factor?

 

[sbailey4]

THAT ... defeats the entire purpose of the added security. You can't access that with two-step. Why is it accessible with two-factor?

Earlier screenshots posted indicate you can access FMP with 2-step as well. The main article states the hacker can use FMP to put in lost mode and lock device. However when you do that it locks it to the existing passcode you have on the device. So how is that a problem? I cant imagine Apple would have these 2 security options and make FMP available such that they could do any damage or lock it up. That makes zero since. I have not seen anywhere in fmp where you can do anything to lock someone out of their own device.

 

[JackieInCo]

I think the time has come that Apple and other tech companies make two step verification mandatory.

I tried it months ago but turned it off because then I can't buy shows on my ATV2.

 

[Rigby]

Earlier screenshots posted indicate you can access FMP with 2-step as well. The main article states the hacker can use FMP to put in lost mode and lock device. However when you do that it locks it to the existing passcode you have on the device. So how is that a problem?

That's actually a good point. The system only allows the person who locks the phone to set a new passcode if the device currently doesn't have one.

However, the hacker can actually erase the device ...

I cant imagine Apple would have these 2 security options and make FMP available such that they could do any damage or lock it up. That makes zero since.

Consumer-oriented companies often compromise security in the name of convenience and to reduce the number of support calls they have to handle.

 

[Hieveryone]

Will the 2 step verification work? I just turned it on.

 

[attila]

Well at least the internet having "darknet" gives something over iOS 10 not having darkmode thus far.

I'd say Darknet is even more risky for a regular consumer, as there are zero laws or services to protect you from hackers.

 

[diipii]

WTF? That comment doesn't make any sense here.

Apple is obsessed with toys.
Apple has forgotten about its core professional computer users.
Apple no longer invents or makes cutting edge products.
Apple is constantly stealing patents and getting caught.
Apple treats its workers badly.
Apple have frightened away large investors.
Apple's grass roots customers are thinking twice.

I could go on but you might have got the message by now.

 

[ardchoille50]

Will the 2 step verification work? I just turned it on.

It should. Once two-step verification is in place, an attacker cannot sign into iCloud without the code that is sent to a trusted device.

 

[sbailey4]

That's actually a good point. The system only allows the person who locks the phone to set a new passcode if the device currently doesn't have one.

However, the hacker can actually erase the device ...
Consumer-oriented companies often compromise security in the name of convenience and to reduce the number of support calls they have to handle.

Ah yeah maybe thats what they are talking about here. That is not as big a deal as the article implies since we all have backups AND have already put in a passcode . The erasing would not be an issue either. This article implies they can lock and take the device ransom so its bricked until you pay the ransom which apparently is not the case unless you never created a passcode. So long as the user has a passcode set and a backup they should be fine with their device. However I can see how the 2-factor helps protect your AppleID. If someone could get in to manage that they could do some damage.

 

[Thunderhawks]

Um did you read the article. Its about ransomware. Not deleting your apps or important data.

I was generalizing and taking it a step further as there are different kinds of ransom attacks.

If you didn't get the real point: Anybody who has data or info on their iphones which is not backed up
has no reason to complain.


[doublepost=1468242750][/doublepost]

Well, do you have a Mac, and only Macs?

If so, AppleID becomes a gateway to access and lock everything, at the same time. Presumably it isn't too far before they can remote control your computer as well... which is authorized via AppleID as well.

Apple had better get moving on significant security improvements in the system, or Really Bad Things could happen.

Yes, all Macs, but it is the exception that I log into my ID and don't do cloud other than dropbox.
Unfortunately for the phone it keeps asking to log in .

Maybe I get and extra Apple ID just for the phone.

As for Apple to work on this some other poster kind of said it already: Y
ou can't protect dumb people from themselves.

 

[LizKat]

1Password, among other options, is free (for the mobile version anyway....desktop is something else) and IMO pretty convenient. You may have to open an app to retrieve a password....but it beats having to remember (in my case) 70+ passwords.
[doublepost=1468000164][/doublepost]

That second one about security questions is really bothersome to me.....it seems 3/4 of the time when you select questions from a preset list that they are normally questions that would be easy for someone to dig up info on if they wanted to badly enough.

Who the heck gives actual answers to preset security questions. Make them up and write them down and secure them in 1Password or whatever.

Name of first dog? TheBotanyOfLizards

 

[macduke]

This happened to one of my parents out of the nowhere yesterday. Account was locked, but (the original) 2-factor authentication was on so whoever attempted to get in didn't get far. Obviously we unlocked the account and changed the password. At least this explains that, I guess. Really glad 2-FA did it's job here.

Yeah it was crazy because I've never had it work before. Still not sure how someone could have gotten a password if that's what happened. My new password is stronger, but my old one wasn't weak either using lower and uppers, special chars and numbers. I just made it longer this time. I don't share this password with any other site as I use a manager.

I finally got my iPhone to receive codes. I read that the codes are delivered through Find My iPhone, so I disabled that and re-enabled and it seems like it's getting codes again. But it was doing that before this hacking attempt so I don't think it's related, just a weird thing I had to work around.

 

[elmaco]

First they invade Ukraine, and now our Macs.

 

[\-V-/]

Earlier screenshots posted indicate you can access FMP with 2-step as well. The main article states the hacker can use FMP to put in lost mode and lock device. However when you do that it locks it to the existing passcode you have on the device. So how is that a problem? I cant imagine Apple would have these 2 security options and make FMP available such that they could do any damage or lock it up. That makes zero since. I have not seen anywhere in fmp where you can do anything to lock someone out of their own device.
View attachment 639806

That's what I thought. Just confused by these comments. lol

 

[Stpike2001]

It seems like the government can just follow the money and throw the culprits in jail and throw away the key.

 

[Thunderhawks]

Who the heck gives actual answers to preset security questions.

Same people who use "Password, QWERTY, and 123456" and don't do 2 step.

They also click on everything that shows up for it to go away.

Then they make it Apples fault and buy a PC instead, listening to their friends,
who NEVER had a PC problem.

Then they sue Apple for lost data.

 

[Shirasaki]

Same people who use "Password, QWERTY, and 123456" and don't do 2 step.

They also click on everything that shows up for it to go away.

Then they make it Apples fault and buy a PC instead, listening to their friends,
who NEVER had a PC problem.

Then they sue Apple for lost data.

Frankly, those customers should be thrown to trashcan. /rant

 

[LizKat]

Frankly, those customers should be thrown to trashcan. /rant

Yes because their behavior is essentially a cheap and easy gateway for hackers. Get in somehow on a users' weakness, wow i'm in !!!, then prowls around and hits on the rest of us via a server's weaknesses.