• 0161 872 0921
  • enquiries@cssystems.net
FacebookTwitterLinkedin
CS Systems | Mac & PC specialists
CS Systems | Mac & PC specialists
Just another WordPress site
  • Home
  • Services
    • Services
    • Network Design
    • System Integration
    • IT Support Manchester
    • Database Design
    • Offsite Backup
    • Web Hosting
    • Hosted Email Service
  • Clients
  • News
  • Contact Us
MENU CLOSE back  
w

A few years ago, a number of users in Australia were victimized by attackers remotely locking iPhones, iPads, and Macs using Find My iPhone on iCloud. Compromised devices typically displayed Russian ransom messages demanding payments of around $50 to $100 for the device to be unlocked.

australian_ios_device_hacked
A ransom message targeting a Mac in 2014 with the common pseudonym “Oleg Pliss”

At the time, IT security expert Troy Hunt noted that the attackers were likely using compromised emails and passwords exposed from various online security breaches to log in to iCloud accounts. AOL and eBay, for example, were among several high-profile companies that suffered data breaches in 2014.

Apple later confirmed that iCloud was not compromised, and that the eventually-arrested attackers had instead gained access to Apple IDs and passwords through external sources. Russian website MKRU said the attackers obtained the credentials via phishing pages and social engineering techniques.

Since then, CSO security blog Salted Hash has discovered that, since at least February of this year, these ransom attacks have returned and now target users in the U.S. and Europe. The methods used by attackers are said to be the same ones used in 2014, starting with a compromised Apple ID.
It starts with a compromised Apple ID. From there, the attacker uses Find My iPhone and places the victim’s device into lost mode. At this point, they can lock the device, post a message to the lock screen and trigger a sound to play, drawing attention to it.

In each of the cases reported publicly, the ransom demanded is usually $30 to $50. If a victim contacts the referenced email address, in addition to payment instructions, they’re told they have 12 hours to comply or their data will be deleted.
The website shared screenshots and linked to a number of Facebook, Twitter, and Reddit users whose devices appear to have been held for ransom in recent months, but there is speculation that the problem could be much larger than that. The following excerpt is highly questionable, however, and could very likely be incorrect.
Earlier this week, a security professional posted a message to a private email group requesting information related a possible compromise of at least 40 million iCloud accounts.

Salted Hash started digging around on this story after the email came to our attention. In it, a list member questioned the others about a rumor concerning “rumblings of a massive (40 million) data breach at Apple.”

The message goes on to state that the alleged breach was conducted by a Russian actor, and vector “seems to be via iCloud to the ‘locate device’ feature, and is then locking the device and asking for money.”
The report adds that “for now, let’s assume there hasn’t been a massive iCloud data breach.” Apple has not commented on the matter.

Given that the Apple ID credentials involved in the ransom attacks are believed to originate from online security breaches, Salted Hash pointed towards a recently compromised Mac-Forums.com database, which allegedly includes 291,214 accounts, being sold for around $775 on the darknet.

There is currently no evidence to suggest that the Mac-Forums database has any relation to these ransom attacks, but users with an account on that website should change their passwords out of an abundance of caution. Setting a device passcode and enabling two-factor authentication for your Apple ID is also highly recommended.

Apple has a support document outlining steps to take if you think your Apple ID has been compromised. Also read security and your Apple ID

July 15, 2016By CS SystemsAll PostsLeave a comment
What You Need to Know About Mac Malware ‘Backdoor.MAC.Eleanor’What You Need to Know About Mac Malware ‘Backdoor.MAC.Eleanor’

Related posts

update-xp
Possible New Apple Products for 2017
January 3, 2017
macbooktouchpanelspotify
Next-Generation MacBook Pro’s Touch ID Feature Likely Built Into the Power Button
August 19, 2016
stock-photo-82980317-silver-laptop-closeup-front-view
The New Apple MacBook Pro.
July 18, 2016
dt-163
Apple Launch Public Betas of iOS 10 and macOS
July 15, 2016
login
What You Need to Know About Mac Malware ‘Backdoor.MAC.Eleanor’
July 15, 2016
Fotolia_64513827_S
Are passwords enough to protect your online accounts?
September 12, 2014

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *


× 9 = forty five

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

clear formSubmit

Archives
  • January 2017
  • August 2016
  • July 2016
  • September 2014
  • August 2014
  • July 2014
  • June 2014
News Categories
  • (13)All Posts
  • (1)Cloud
  • (1)Google
  • (1)Malware
  • (4)Microsoft
  • (3)Security
  • (2)Tips and Tricks
Search
Contact info :
  • Address:
    CS Systems. Victoria Court, 435 Chester Road, Old Trafford, Manchester, M16 9HA
  • Phone number:
    0161 872 0921
  • E-mail:
    enquiries@cssystems.net

Find us on:

FacebookTwitterLinkedin
Partners & Accreditations :
  • Microsoft Small Business
  • Apple
  • Cisco
  • Citrix
  • AVG
  • Adobe
  • Microsoft
  • Fujitsu
Useful links :
  • Home
  • Services
  • Clients
  • Contact Us
Click for support
Request Support
Click to connect to a CS Systems engineer. Helpdesk operates Monday to Friday 9.00am - 5.30pm
Copyright 2014 CS Systems | All Rights Reserved
  • Home
  • Services
  • Clients
  • Contact Us
Useful links

Designed by Cyan Marketing