Hacker Team Claims Compromise of Apple's iCloud and Activation Lock, Possibly via SSL Bug [Updated]

icloud_iconA pair of hackers from the Netherlands and Morocco, identifying themselves as AquaXetine and MerrukTechnolog, claim to have compromised the security of Apple's iCloud system for locking iOS devices.

The hack will unlock stolen iPhones by bypassing Activation Lock, making it possible for thieves to resell the phones easily on the black market, reports Dutch publication De Telegraaf [Google Translate]. It also may provide hackers with access to Apple ID passwords and other personal information stored in Apple's iCloud service.

The hackers reportedly worked on the vulnerability for five months, studying the transmission of data between iPhone handsets and Apple's iCloud services. The pair claim to be able to unlock a locked iPhone by placing a computer between the iPhone and Apple's servers. In this configuration, the iPhone mistakenly identifies the hacker's computer as one of Apple's servers and follows instructions provided by the nefarious computer to reverse activation lock on the handset.

While the hackers did not reveal precise information on how their intercepting computer can spoof Apple's iCloud activation servers, it appears that they may be taking advantage of an SSL bug that is present in iTunes for Windows, as noted by iPhone in Canada, who spoke to security researcher Mark Loman about the issue. The previously disclosed issue was fixed in iOS 7.0.6 and OS X 10.9.2, but it appears that iTunes for Windows is still affected.

After looking into some claims of the jailbreak community, Mark Loman decided to do some investigating of his own and made a shocking discovery. SSL has two tasks: one, to verify communication with the intended server; and two, to prevent manipulation.

“The problem is with verifying the certificate. Apple appears to have deliberately left out this essential step required for proper secure communication. They fixed it last month for iOS but forgot to fix it for iTunes. But the jailbreak community is already making use of it — which is how I figured it out.”

The vulnerability reportedly allows hackers to intercept Apple ID credentials, which can then be used to unlock iOS devices that have been locked after having been lost or stolen.

Actually, the data IS encrypted. But when an attacker strips SSL during a so-called man-in-the-middle attack the AppleID account name and password can be extracted as they are sent in plain text inside SSL, Mark Loman said in an email sent to iPhone in Canada.

Using this technique, the hackers claim to have unlocked 30,000 iPhones in the past few days. The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information.

Update 10:43 AM: One of the hackers has denied that the bypass involves an SSL bug.

Top Rated Comments

Yvan256 Avatar
108 months ago
The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information.

In my opinion, that's the proper way to do it.

[LIST=1]
* Contact the manufacturer to inform them of the problem.
* Give them some time to fix it.
* If they haven't fixed it after a few months, go public to force them to react.
Score: 32 Votes (Like | Disagree)
Sky Blue Avatar
108 months ago
"The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information."

lol, Apple
Score: 27 Votes (Like | Disagree)
ehmjay Avatar
108 months ago
Annnnnnd cue the tech press over-reacting and blowing this way out of proportion.

Not that this isn't a serious flaw; it is. But because it's Apple it will be presented as the end of the world, and covered by every major news outlet where-as a similar bug in Android is barely mentioned by anyone at all.
Score: 10 Votes (Like | Disagree)
dannyyankou Avatar
108 months ago
The NSA new this all along.

*knew

Sorry, couldn't resist.
Score: 8 Votes (Like | Disagree)
Millah Avatar
108 months ago
They did, in March. Still not fixed.
So anyone can claim anything they want and people instantly believe them without a shadow of doubt? When did the public become so easily gullible?

I'm not saying its not true. I'm saying none of us know. Just because some hackers claim something doesn't make it true. And how exactly are they trustworthy to begin with? These are people hacking into places they shouldn't be, unlocking stolen phones, and you don't even have a sliver of doubt about their honesty?
Score: 8 Votes (Like | Disagree)
fumi2014 Avatar
108 months ago
These billion dollar companies really need to stay on top of all this. They're happy to take your money but not so quick to safeguard your details.

And now there's trouble at eBay.
Score: 8 Votes (Like | Disagree)

Popular Stories

airpods pro black background

AirPods Pro 2: Five New Features and Improvements to Expect

Sunday August 14, 2022 3:28 pm PDT by
Apple's second-generation AirPods Pro are finally nearing launch, with a release expected later this year. If you are considering upgrading to the new AirPods Pro once they are released, keep reading for a list of five new features to expect. In addition to all-new features, the second-generation AirPods Pro will likely adopt some features added to the standard AirPods last year. H2 Chip ...
iPhone 14 Dummies 1 Feature

Everything Rumored for Apple's September Event: iPhone 14, Apple Watch Pro and More

Friday August 12, 2022 2:34 pm PDT by
There's just about a month to go until Apple holds its annual September event focusing on new iPhone and Apple Watch models. We thought we'd take a quick look at everything that's rumored for Apple's September event to give MacRumors readers a rundown on what to expect when the first fall event rolls around. iPhone 14 The iPhone 14 can probably be described more as an "iPhone 13S" because...
10th Generation iPad Render

10th-Generation iPad With Major Design Changes Reportedly in Production Ahead of September Launch

Monday August 15, 2022 8:02 pm PDT by
Apple's rumored 10th-generation iPad is currently in production and will feature "major" design changes, according to a report from Taiwanese website DigiTimes. A mockup of the potential 10th-generation iPad design by Renders By Shailesh The report did not provide any specific details about the 10th-generation iPad's new design, but rumors suggest the device will feature a larger 10.5-inch...
ios 16 lock screen feature2

Apple Seeds Sixth Betas of iOS 16 and iPadOS 16 to Developers [Update: Public Beta Available]

Monday August 15, 2022 10:04 am PDT by
Apple today seeded the sixth betas of upcoming iOS 16 and iPadOS 16 updates to developers for testing purposes, with the updates coming a week after Apple released the fifth developer betas. Registered developers can download the iOS and iPadOS 16 profiles from the Apple Developer Center, and once installed, the betas will be available over the air. iOS 16 introduces a revamped Lock...
apple watch se

Apple Watch SE vs. Apple Watch Series 8: New Features to Expect If You've Waited to Upgrade

Monday August 15, 2022 2:44 am PDT by
The Apple Watch SE was announced in September 2020 and has been a popular Apple Watch model for customers looking for their first smartwatch or an affordable Apple Watch. Apple Watch SE customers may be wondering, however, what's in store for them with the upcoming Apple Watch Series 8 and what new features they can expect. Continue reading to find out. Apple Watch SE vs. Apple Watch Series ...
odyssey ark 1

Samsung Launches $3,500 'Odyssey Ark' 55-Inch Curved Gaming Display

Monday August 15, 2022 7:15 am PDT by
Samsung today announced the launch of the Odyssey Ark, which the company says is the world's first 55-inch 4K curved display with a 165Hz refresh rate for improved gaming performance. Samsung first previewed the monitor at CES, but it is now available to order. Subscribe to the MacRumors YouTube channel for more videos. Priced at $3,500, the Samsung Odyssey Ark features mini-LED technology...
top stories 13aug2022

Top Stories: New Battery Percentage Icon in iOS 16, USB-C AirPods Rumor, and More

Saturday August 13, 2022 6:00 am PDT by
This week brought some shocking news for iOS 16 beta testers, with Apple bringing back the iPhone battery percentage to the status bar after a number of years. Other news and rumors this week included word that Apple has started recording portions of its media event planned for next month to introduce the iPhone 14 and Apple Watch Series 8, claims about iPhone 14 Pro pricing and Apple's...