Apple Devices Held For Ransom, Rumors Claim 40M iCloud Accounts Hacked; Apple-Related Forums Compromised (csoonline.com) 73
Steve Ragan, reporting for CSOOnline: Since February, a number of Apple users have reported locked devices displaying ransom demands written in Russian. Earlier this week, a security professional posted a message to a private email group requesting information related a possible compromise of at least 40 million iCloud accounts. Salted Hash started digging around on this story after the email came to our attention. In it, a list member questioned the others about a rumor concerning "rumblings of a massive (40 million) data breach at Apple." The message goes on to state that the alleged breach was conducted by a Russian actor, and vector "seems to be via iCloud to the 'locate device' feature, and is then locking the device and asking for money."In a separate report, the publication reports that three websites owned by Penton Technology -- MacForums.com, HotScripts.com, and WebHostingTalk.com -- have been compromised and their databases are now being sold on the Darknet. While nothing is confirmed, there is a possibility that some of the rumored 40M compromised Apple ID credentials may have come from these forums, or from LinkedIn's recent hack.
Hahahaha Social Media (Score:2, Troll)
the publication reports that three websites owned by Penton Technology -- MacForums.com, HotScripts.com, and WebHostingTalk.com -- have been compromised and their databases are now being sold on the Darknet. While nothing is confirmed, there is a possibility that some of the rumored 40M compromised Apple ID credentials may have come from these forums, or from LinkedIn's recent hack.
People who post info on social media are fools!
Oh. Wait.
Re: (Score:2, Insightful)
This doesn't even make sense. There's no way these sites were using AppleID accounts, or collecting them.
Now, reverse engineering based on login is possible, but that's user stupidity, not Apple's fault that people use the same log in for multiple things.
Re:Hahahaha Social Media (Score:5, Insightful)
This doesn't even make sense. There's no way these sites were using AppleID accounts, or collecting them.
Seriously, it is not even in the realm of things that are possible that someone who prefers using devices that are marketed as "it just works" would use the same credentials on multiple services. In fact, such a thing is literally inconceivable. It's so inconceivable that I don't even know what I'm talking about. None of this makes sense.
Re: (Score:1)
In fact, such a thing is literally inconceivable. It's so inconceivable that I don't even know what I'm talking about.
You keep using that word, I do not think it means what you think it means
Re: (Score:1)
Re: (Score:2)
Oh, yes. You have a great point. I'm sure O N L Y Apple users do this...
Re: (Score:2)
Re: (Score:2)
Interesting. I make six figures using devices that "just work". So do most people working in Silicon Valley. Clearly I must be a moron incapable of having good passwords. So are all the smart people on Windows? Just curious.
Re: (Score:2)
Well, I make six figures using Windows and Linux machines, so obviously you and I are a fantastic set of data points.
Re: (Score:2)
So now you care about data points? rofl
go troll elsewhere
Re: (Score:2)
I make 7 figures, but I prefer big chief pads and pencils. What a wacky world.
Re: (Score:1)
No worries, this is Slashdot. This is anti-social media.
meta discussion who is responsible for hacks? (Score:1)
Who is responsible for devices getting hijacked? With PCs you can argue the end user is responsible for what is done with the machine. For more locked down devices is the manufacturer ultimately fully responsible for the function of the device?
There will be legal lawsuits for sure. Class action and individual.
A bigger question will be what view does the public take? Do they blame themselves of the manufacturer?
Re: (Score:1)
You can't complain when it has been
Re: (Score:2)
Except that when 40M people are locked out of their Apple accounts, it will inevitably make Apple look bad, regardless of how dumb their user base is.
This is why every smart company will move to two factor authentication before long.
iOS offers 2FA. However, it is up to the user to use it.
Re: (Score:2)
Two factor will be the ONLY choice in the near future.
Did I miss something in the Keynote?
Re: (Score:1)
If the company was hacked and the passwords were stored insecurely, then it is responsible. If a second company gets hacked and you shared the same passwords, the second company is responsible for the damage done to it, and you are responsible for the damage done to you. The first company should not be held accountable. They didn't decide your password. They allow you the freedom to set it yourself. Don't be a fool and split passwords among various services. Seriously. You can't complain when it has been repeated so often NOT TO USE COMMON PASSWORDS. YOUR SECURITY IS THAT OF THE WEAKEST PASSWORDS. You can't complain because you failed to enable two-factor. You can't complain if your password was easy to guess and the attackers guessed it (you can if the company allows millions to be tested without locking out your account and blocking the attack, this is a brute force password break, and should be mitigated in authentication software).
Ahh, because when you visit icloud.com your monitor will eject a fingerprint scanner for you to use. I forgot about that feature!
Re: (Score:2)
Foreseeable consequence of disclosing the password, so whether the first company can be held accountable is very much open to debate, unless they've had the foresight to drop something appropriate into their terms and conditions. Even then, the FTC has a few things to say concerni
Re: meta discussion who is responsible for hacks? (Score:2)
Ugh, no.
Use weak, shitty passwords for weak services. Who cares? Let them take your forum account. Use the same dumb easy to remember password in as many places as you can get away with so you can remember a strong password for each important service.
It's hard to remember a lot of passwords, and some things aren't worth protecting, honestly. It just takes up headspace to try. But make sure you've got something good when it counts and don't use it anywhere else.
Re: (Score:2)
No... just no.
Use a good password manager instead, one that uses an encrypted database. Store that database on a cloud sync service such as Dropbox or OneDrive so you can share it among your devices. Even if the cloud service is compromised, your data is safe and you still have your local copies, and you only have to remember a small number of passwords.
Re: (Score:2, Insightful)
(and modded -5 in 5.. 4... 3... 2... 1... see ya!)
Posted at 1:48 PM Pacific Daylight Time; it is now 2:21 PM Pacific Daylight time, and its current score is 2.
So either it was modded -5 and then un-modded, or it wasn't modded -5 at all.
Re: (Score:2)
(and modded -5 in 5.. 4... 3... 2... 1... see ya!)
Posted at 1:48 PM Pacific Daylight Time; it is now 2:21 PM Pacific Daylight time, and its current score is 2.
So either it was modded -5 and then un-modded, or it wasn't modded -5 at all.
I am shocked. SHOCKED. Where are all the fanboys??? Oh maybe all their slashdot accounts got hacked too! :D
Re: (Score:3, Insightful)
ah, trolls. It was tempting to mod you appropriately (I have the points), but I dislike down-modding and reserve it for the never-give-up (like APK). Do you understand how your smug and self-conceited claim to be moderated into oblivion was, at best, a self-fulfilling prediction (after all, you posted a troll comment, so why would the comment not be moderated as such?)
This "local Apple fanboy" wouldn't happen to be a figment of your imagination, would he? I mean, such a creature is possible, but considering
Re: meta discussion who is responsible for hacks? (Score:3)
Is Apple responsible for users selecting weak passwords? Yes and no.
Forcing a user to use a TFA protocol significantly reduced the danger of a weak or reused password might pose.
Can Apple stop someone from reusing a password (weak or otherwise)? No.
Can Apple force users to use TFA? Yes.
Re: (Score:1)
Posting ANYTHING negative, or even non-complementary, about Apple on slashdot is guaranteed to get you modded to oblivion, so I figure hey what the hell! I may as well be hung for a sheep as for a lamb!
Re: (Score:1)
Re: (Score:1)
using the word "fanboy" confirms you're gay
That would be 'fanboipussy'
Re: (Score:2, Offtopic)
They've been doing it a lot more since the last buyout. I've had several deleted, none of which were even trolling.
Re: Slashdot is deleting comments (Score:1)
To be fair, "productive posters" are usually vitriolic idiots. Real slashdot discussions died about a decade ago.
Re: (Score:3)
Do you have any proof? Screenshots, internet archive, etc? Anything at all?
Let's be clear... (Score:5, Insightful)
These are not "compromised Apple ID credentials"... they are compromised email addresses and passwords for for OTHER mac/apple related websites... so if you're dumb enough to reuse your Apple ID email address and password on those sites they might match up.
Re: (Score:2)
If you have a set of Apple ID credentials, and someone steals credentials from another site and then notices they also work on the Apple service, wouldn't you call that a compromised set of Apple ID credentials?
What hack? (Score:5, Informative)
I read this, thinking, "What hack?" cause I haven't had any issues at all. Then I realized the what actually happened. This sounds like the same thing that happened with the supposed hacking of Teamviewer. It was a matter of people reusing the same credentials in multiple locations, so as soon as one low-security place is compromised, you're still screwed in other places even if they have high security.
All I can say is that, today, you *have* to use either MFA, a personal password database, preferably both. I use 1password to store all my passwords, and Duo Security (free for personal use) for MFA. There are other options as well, such as Google Authenticate for MFA, or keypass for password storage.
1password is relatively expensive, but it's virtually hassle free and will let me sync my db across all my devices (Linux is read-only, unfortunately) and integrates with all major browsers. I don't use Keypass, but IIRC it works on all platforms including Linux, but it's browser plugins are lacking.
The most important aspect of password databases, is that they let you generate a very long, random password that is unique to the site you visit. You don't care what the password is, because you can just call it up from the database, but it makes your account essentially unhackable (provided the site you're accessing doesn't do something stupid like store the passwords in plain text).
This is 2016, not 1970. People can no longer afford to be naive about password management anymore. It would be nice if articles like these could take a couple moments out of their breathless handwaving to let people know that these options exist.
Re: (Score:2)
I use Touch ID to open my 1Password app and hopefully from the next version of macOS, I should be able to unlock it on mac through a Touch ID on my phone.
Stop Trolling Me, Slashdot!!! (Score:1)
February you say? (Score:2)
Someone reset my Apple ID password on February 27th 2016 do you think it could be related?
Account has since been recovered and as far as I can tell nothing else was changed.