Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

Small Sample of iCloud Credentials Provided By Hackers Are Valid, But Questions Remain

MacRumors

macrumors bot
Original poster
Apr 12, 2001
51,084
12,635



On Wednesday we reported that Apple had become the target of a ransom threat, with hackers claiming to have access to more than 600 million iCloud accounts. A group known as the "Turkish Crime Family" said they would reset and wipe the accounts unless Apple paid them $150,000 in Bitcoin by April 7.

Apple responded to the threat by stating that there had not been any breach of its systems, and that if hackers did have access to iCloud accounts then it could only be because of compromised third-party services.


Yesterday, ZDNet said it had received a set of 54 account credentials from the hacker group for "verification" and subsequently reported that all of the accounts were valid, based on a check using Apple's online password reset function.

The accounts include @icloud.com addresses dating back to 2011, as well as legacy @me.com and @mac.com domains from as early as 2000. The list of credentials is said to contain email addresses and plain-text passwords separated by a colon. According to Troy Hunt, data breach expert and owner of notification site Have I Been Pwned, this would suggest the data could have been aggregated from various sources.

ZDNet worked to contact each account holder via iMessage to confirm their password, and found that many of the accounts are no longer registered with Apple's messaging platform. However, of those that could be contacted, 10 people - all based in the U.K. - confirmed that the passwords were accurate, and they have changed them as a result.

When pressed about the original source of the data, the hackers claimed that it was "handled in groups" without explaining how or why. The hackers also refused to hand over a U.S.-based sample of accounts.

All of the people with compromised accounts said that until now, they had never changed their iCloud passwords before. One person said that the password he confirmed with ZDNet was no longer in use as of about two years ago, which narrows down the possible date of a breach or multiple breaches to somewhere between 2011 and 2015.

Most of the people confirmed that they used their iCloud email address and password on other sites, such as Facebook and Twitter. However, three people said that their iCloud email address and password were unique to iCloud, and were not used on any other site. Also, two people claimed someone had tried to reset their iCloud passwords in the past day.

It's unclear if the sample provided is representative of the wider pool of credentials the hackers claim to have, but based on its communications with the group, ZDNet suspects that its members are "naïve and inexperienced" and primarily seeking publicity.

Given that Apple has denied a breach, the account information may have been obtained from a major hacking incident, such as the one that befell Yahoo. iCloud users who have the same username and password that was used for both a hacked site and for iCloud should change their passwords immediately.

Anyone else concerned about the hacking claims should change their password and consider using two-factor authentication to secure their Apple ID credentials. Apple has said that it is "actively monitoring to prevent unauthorized access to user accounts and are working with law enforcement to identify the criminals involved".

Article Link: Small Sample of iCloud Credentials Provided By Hackers Are Valid, But Questions Remain
 

keysofanxiety

macrumors G3
Nov 23, 2011
9,534
25,270
Given that Apple has denied a breach, the account information may have been obtained from a major hacking incident, such as the one that befell Yahoo. iCloud users who have the same username and password that was used for both a hacked site and for iCloud should change their passwords immediately.

Agreed. If the same email address/password for their Apple ID were used on other compromised accounts, which happens more frequently than you'd imagine, then they could have got the information that way. Furthermore a person's Apple ID username/password could have easily been taken from phishing attempts (we've seen a lot of those emails floating around recently).

But overall it doesn't look like a larger scale breach of Apple's internal security, which is the main thing. And please, for anybody who hasn't yet enabled two-factor authentication -- do it!
 
Comment

jclardy

macrumors 68040
Oct 6, 2008
3,533
2,503
These just look like cherry picked accounts from phishing attacks, or possibly just using logins from other breaches from people who use the same password everywhere.

Either way, people should be using 2 factor and you won't have a problem with this. Or use 1Password and when one of your accounts inevitably gets stolen, you don't have to change a thing.
 
  • Like
Reactions: t1meless1nf1n1t
Comment

honglong1976

macrumors 65816
Jul 12, 2008
1,422
878
UK
Wonder if an email I got this morning is anything to do with this:

From: Apple (email address: neojacks@frankyhazard.com)

Dear Customer,

Your Apple ID (xxxxxxx@xxxxxx) was used to sign in tο iCloud οn an iPhοne 7.

Date and Time: March 24, 2017, 01:53 AM PST
Operating System: iOS 10.0.3

If you have nοt recently signed in tο an iPhοne 7 with your Apple ID and believe sοmeone may have accessed your account, gο tο Apple ID (https://appleid.apple.cοm actual link goes to https://appleid.apple.xn--cm-jbc/) and update your information as sοon as possible.

I don't have an iPhone 7 and I am not on iOS 10.0.3

Wonder how many people fall for this :)
 
Last edited by a moderator:
Comment

SoN1NjA

macrumors 68020
Feb 3, 2016
2,020
2,120
the pool
Wonder if an email I got this morning is anything to do with this:

From: Apple (email address: neojacks@frankyhazard.com)

Dear Customer,

Your Apple ID (xxxxxxx@xxxxxx) was used to sign in tο iCloud οn an iPhοne 7.

Date and Time: March 24, 2017, 01:53 AM PST
Operating System: iOS 10.0.3

If you have nοt recently signed in tο an iPhοne 7 with your Apple ID and believe sοmeone may have accessed your account, gο tο Apple ID (https://appleid.apple.cοm) and update your information as sοon as possible.

I don't have an iPhone 7 and I am not on iOS 10.0.3

Wonder how many people fall for this :)
fall for what, a site linking to apple.com?
 
Comment

keysofanxiety

macrumors G3
Nov 23, 2011
9,534
25,270
fall for what, a site linking to apple.com?

Well, you just fell for it. The URL leads to a login website that looks identical to Apple's; except it isn't Apple's. After you've 'signed in', they've just got your details. Simple as that. It's not too difficult to change the URL path in an email while keeping what looks like a legitimate link.

That's how phishing works. It gets smarter and smarter.
 
Comment

keysofanxiety

macrumors G3
Nov 23, 2011
9,534
25,270
It's clear from this thread that cyber education is still required ;)

Yeah! To those hoping for more tips, I'd recommend going to https://www.cybereducation.com for further information.

And it's that easy. Trust nothing and no-one online. Question everything. Ensure every link goes to where you expect it to. Go directly through the URL bar rather than following an email link if you're unsure. Phishing gets more and more elaborate and convincing.
 
Comment

honglong1976

macrumors 65816
Jul 12, 2008
1,422
878
UK
Wonder if an email I got this morning is anything to do with this:

From: Apple (email address: neojacks@frankyhazard.com)

Dear Customer,

Your Apple ID (xxxxxxx@xxxxxx) was used to sign in tο iCloud οn an iPhοne 7.

Date and Time: March 24, 2017, 01:53 AM PST
Operating System: iOS 10.0.3

If you have nοt recently signed in tο an iPhοne 7 with your Apple ID and believe sοmeone may have accessed your account, gο tο Apple ID (https://appleid.apple.cοm) and update your information as sοon as possible.

I don't have an iPhone 7 and I am not on iOS 10.0.3

Wonder how many people fall for this :)

fall for what, a site linking to apple.com?

It's phishing and doesn't go to Apple. Someone has taken an Apple email and edited it ready to scam someone.

I only got this today so someone has obtained my email (along with millions of others) to try to scam.

2 factor is turned on (has been since it was enabled) same for google.

Don't fall for these dumb emails. Check the actual email and link point to who they say they do :)
 
Comment

RightMACatU

macrumors 65816
Jul 12, 2012
1,412
1,098
192.168.1.1
Yeah! To those hoping for more tips, I'd recommend going to https://www.cybereducation.com for further information.

And it's that easy. Trust nothing and no-one online. Question everything. Ensure every link goes to where you expect it to. Go directly through the URL bar rather than following an email link if you're unsure. Phishing gets more and more elaborate and convincing.

But... but... but... is your link trustworthy? :p
 
  • Like
Reactions: keysofanxiety
Comment

netwalker

macrumors regular
Jul 28, 2007
209
209
Sadly it should just be standard education now. Troy Hunt has done some excellent video training on this and I've seen some others, too.
And who educates those that no longer go to school and think that a phone or tablet is the same as a toaster or TV?
 
Comment

keysofanxiety

macrumors G3
Nov 23, 2011
9,534
25,270
And who educates those that no longer go to school and think that a phone or tablet is the same as a toaster or TV?

Unless they've got a Note 7, it's unlikely they'll think of their phone as a toaster!

There's only so much that can be done. Of course it would be nice if Apple had a few more tips in iOS 11 for those less informed about how to stay safe online. But otherwise I think Apple are doing a really good job with encryption, two-factor authentication, iCloud keychain, etc.
 
Comment

foxconn

Suspended
Sep 6, 2016
421
506
www
No sympathy from me for those that fall for email scams. There's way too much information about it to be ignorant. At this point, you're just stupid.
 
Comment

SoN1NjA

macrumors 68020
Feb 3, 2016
2,020
2,120
the pool
No sympathy from me for those that fall for email scams. There's way too much information about it to be ignorant. At this point, you're just stupid.
Sure that's what mechanics think about people who don't know about their car
Yes, it does seem quite foolish

But if we keep pushing people who don't know out and calling them stupid instead of educating them, you can't call them stupid
 
Comment

foxconn

Suspended
Sep 6, 2016
421
506
www
Sure that's what mechanics think about people who don't know about their car
Yes, it does seem quite foolish

But if we keep pushing people who don't know out and calling them stupid instead of educating them, you can't call them stupid

Educate yourself. There are a ton of resources available at your fingertips. Sick of people making excuses or being dumb. You don't need to walk to a library anymore or enroll in a university to get information.

People should educate themselves on cars and seek help from more than one person since mechanics can take advantage of innocent people.
[doublepost=1490360738][/doublepost]
Good for you, bud.

We got one! Sorry that your account has been compromised. Maybe you'll learn from your mistake in the future.
 
Comment

BeachDuc

macrumors member
May 18, 2014
38
9
NSW Australia
Wonder if an email I got this morning is anything to do with this:

From: Apple (email address: neojacks@frankyhazard.com)

Dear Customer,

Your Apple ID (xxxxxxx@xxxxxx) was used to sign in tο iCloud οn an iPhοne 7.

Date and Time: March 24, 2017, 01:53 AM PST
Operating System: iOS 10.0.3

If you have nοt recently signed in tο an iPhοne 7 with your Apple ID and believe sοmeone may have accessed your account, gο tο Apple ID (https://appleid.apple.cοm) and update your information as sοon as possible.

I don't have an iPhone 7 and I am not on iOS 10.0.3

Wonder how many people fall for this :)


Yup. That is pretty much the email I got this morning. Almost identical to the legitimate one last night, after reading the first Hacker post, when I logged in to iCloud to check my devices. The only real difference is the that the email I generated (by logging in) linked to apple.com and the scam one linked to goodness knows where. I'd imagine a good number of people fall for these scams, otherwise why waste your time perfecting them? I gather us Australians are one of the most gullible nations, in this respect.
 
  • Like
Reactions: Shirasaki
Comment

scott911

macrumors 6502a
Aug 24, 2009
722
439
2 stage authentication has been suggested by many, but I have a question.

If one has a family computer - picture an imac in a home office, that many people use. how would 2 stage authentication work? I assume just one mobile devise would get the code - which could be a problem if that person wasn't home. How often would the code be needed?
 
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.