Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
Hacker Team Claims Compromise of Apple's iCloud and Activation Lock, Possibly via SSL Bug [Updated]
A pair of hackers from the Netherlands and Morocco, identifying themselves as AquaXetine and MerrukTechnolog, claim to have compromised the security of Apple's iCloud system for locking iOS devices.
The hack will unlock stolen iPhones by bypassing Activation Lock, making it possible for thieves to resell the phones easily on the black market, reports Dutch publication De Telegraaf [Google Translate]. It also may provide hackers with access to Apple ID passwords and other personal information stored in Apple's iCloud service.
The hackers reportedly worked on the vulnerability for five months, studying the transmission of data between iPhone handsets and Apple's iCloud services. The pair claim to be able to unlock a locked iPhone by placing a computer between the iPhone and Apple's servers. In this configuration, the iPhone mistakenly identifies the hacker's computer as one of Apple's servers and follows instructions provided by the nefarious computer to reverse activation lock on the handset.
While the hackers did not reveal precise information on how their intercepting computer can spoof Apple's iCloud activation servers, it appears that they may be taking advantage of an SSL bug that is present in iTunes for Windows, as noted by iPhone in Canada, who spoke to security researcher Mark Loman about the issue. The previously disclosed issue was fixed in iOS 7.0.6 and OS X 10.9.2, but it appears that iTunes for Windows is still affected.
After looking into some claims of the jailbreak community, Mark Loman decided to do some investigating of his own and made a shocking discovery. SSL has two tasks: one, to verify communication with the intended server; and two, to prevent manipulation.The vulnerability reportedly allows hackers to intercept Apple ID credentials, which can then be used to unlock iOS devices that have been locked after having been lost or stolen.
“The problem is with verifying the certificate. Apple appears to have deliberately left out this essential step required for proper secure communication. They fixed it last month for iOS but forgot to fix it for iTunes. But the jailbreak community is already making use of it — which is how I figured it out.”
Actually, the data IS encrypted. But when an attacker strips SSL during a so-called man-in-the-middle attack the AppleID account name and password can be extracted as they are sent in plain text inside SSL, Mark Loman said in an email sent to iPhone in Canada.Using this technique, the hackers claim to have unlocked 30,000 iPhones in the past few days. The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information.
Update 10:43 AM: One of the hackers has denied that the bypass involves an SSL bug.
Tag: Activation Lock
[ 135 comments ]
Top Rated Comments
(View all)
66 months ago
The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information.
In my opinion, that's the proper way to do it.
[LIST=1]
* Contact the manufacturer to inform them of the problem.
* Give them some time to fix it.
* If they haven't fixed it after a few months, go public to force them to react.
66 months ago
"The group allegedly contacted Apple about this vulnerability in March, but Apple never responded, prompting the hackers to go public with the information."
lol, Apple
lol, Apple
66 months ago
Annnnnnd cue the tech press over-reacting and blowing this way out of proportion.
Not that this isn't a serious flaw; it is. But because it's Apple it will be presented as the end of the world, and covered by every major news outlet where-as a similar bug in Android is barely mentioned by anyone at all.
Not that this isn't a serious flaw; it is. But because it's Apple it will be presented as the end of the world, and covered by every major news outlet where-as a similar bug in Android is barely mentioned by anyone at all.
66 months ago
These billion dollar companies really need to stay on top of all this. They're happy to take your money but not so quick to safeguard your details.
And now there's trouble at eBay.
And now there's trouble at eBay.
66 months ago
They did, in March. Still not fixed.
So anyone can claim anything they want and people instantly believe them without a shadow of doubt? When did the public become so easily gullible?
I'm not saying its not true. I'm saying none of us know. Just because some hackers claim something doesn't make it true. And how exactly are they trustworthy to begin with? These are people hacking into places they shouldn't be, unlocking stolen phones, and you don't even have a sliver of doubt about their honesty?
66 months ago
I imagine this will be solved with a simple iOS update and a change of Apple's server.
That being said -- on a similar topic - Now that Activation Lock exists, it is astonishing to me the sheer amount of iCloud locked iPhones on eBay that are pretty much only good for parts/trash. On the one hand, yes it might keep phones in the owners possession, but on the other hand, it creates a lot of garbage that will end up in the landfill.
Possibly even more surprising to me is that people are paying almost full price for these locked phones :(
Yep. Locked phone = stolen phone.
66 months ago
Anyone who claims Apple doesn't take security of its products and services seriously, and doesn't care passionately about protecting our personal information - put simply they don't know Apple. There is no company on earth who has a better track record in this arena than Apple.
Like the stupid SSL bug that was there for at least a year if not more. Or even this one that Apple was notified about and apparently hasn't done anything about it so far. Apple might be good, but that doesn't mean they are the best and should just blindly be trusted and defended all the time.
66 months ago
I may be alone but I really don't see the big deal even IF this is true. If my phone was stolen and I remote wiped it and activation locked it I feel I have done my best and Apple has provided me with the tools to do my best.
This is like if someone broke into my house stole my safe with all my valuables and then used a plasma torch to open it. Do I run to my safe company and say how dare you make a safe so easy to break into? No I don't.
This is going to turn into a thing where people over react and demand we have security like a Mission Impossible self destructing phone that can be enabled through iCloud (sad that Im joking and at the same time not)
So basically I think this will be patched if its a real vulnerability and in the end keep an eye on your stuff so it doesn't get stolen, have some personal responsibility because in the end if your phone or anything else gets stolen you're already beat. thats my 2cents
This is like if someone broke into my house stole my safe with all my valuables and then used a plasma torch to open it. Do I run to my safe company and say how dare you make a safe so easy to break into? No I don't.
This is going to turn into a thing where people over react and demand we have security like a Mission Impossible self destructing phone that can be enabled through iCloud (sad that Im joking and at the same time not)
So basically I think this will be patched if its a real vulnerability and in the end keep an eye on your stuff so it doesn't get stolen, have some personal responsibility because in the end if your phone or anything else gets stolen you're already beat. thats my 2cents
66 months ago
A serious company has basic functionality tests in place for critical security components.
We know Apple does not.
So a hack that took five months of studying to exploit should be found in "basic functionality test"????
Newsflash....everything is hackable. With the right amount of time, equipment, skill and willpower nothing is completely 100% without any doubt invulnerable.
I'm a little hesitant to take hackers 100% at their word and say Apple hasn't done ANYTHING. Its true Apple hasn't done anything PUBLICLY - but you and I have no clue what's going on behind closed doors.
Moral of the story - Apple is better than most. With the rise of cyber crime and hacking happening, no one is safe. Companies are going to need to make HUGE investments in cyber security to stay ahead of the curve. Apple isn't exempt from any of that, but they also aren't alone.
----------
From Apple's website:
"With an easy-to-use interface, amazing features, and security at its core, iOS 7 is the foundation of iPhone, iPad, and iPod touch". Perhaps that's why.
Ok? So because they say "security" is at the core of iOS 7 that means it HAS to be invulnerable or else we go on a tirade about how Apple lies and doesn't do anything about the issues they have?
Please....
[ Read All Comments ]
Kanex today announced the launch of its iAdapt Multiport Docking Station for the 2018 iPad Pro models, designed to add a range of additional ports to the devices using the built-in USB-C port.
...
Microsoft has released a native Mac version of its To-Do app for the first time, meaning macOS users will no longer have to rely on company's the web app to access the to-do list service.
...
Apple appears to be continuing its recent trend of making app subscriptions more transparent and manageable, as evidenced by another change discovered in the latest developer beta of iOS 13. When you...
Belkin today announced that its InvisiGlass Ultra Front and Back Protection for the latest iPhone models is now available for purchase from Apple.
The InvisiGlass Ultra Front and Back...
Apple this morning released the second beta of watchOS 6, the software that runs on the Apple Watch. The second beta comes two weeks after Apple first unveiled the new update at the Worldwide...
Apple today seeded the second beta of an upcoming tvOS 13 update to developers, two weeks after first unveiling the tvOS 13 software at the Worldwide Developers Conference.
Designed for the...
Aspyr has announced that today is the last day of sales for its 32-bit Mac games, in anticipation of Apple's upcoming move to 64-bit only apps on macOS Catalina later this year.
After...
Amazon is offering the latest MacBook Pro at a new all-time-low price, with savings of up to $199 off original prices. Across the board these are the best deals available online from the major...
