iOS Device Ransom Attacks Continue to Target Users in U.S. and Europe

A few years ago, a number of users in Australia were victimized by attackers remotely locking iPhones, iPads, and Macs using Find My iPhone on iCloud. Compromised devices typically displayed Russian ransom messages demanding payments of around $50 to $100 for the device to be unlocked.

australian_ios_device_hacked

A ransom message targeting a Mac in 2014 with the common pseudonym "Oleg Pliss"

At the time, IT security expert Troy Hunt noted that the attackers were likely using compromised emails and passwords exposed from various online security breaches to log in to iCloud accounts. AOL and eBay, for example, were among several high-profile companies that suffered data breaches in 2014.

Apple later confirmed that iCloud was not compromised, and that the eventually-arrested attackers had instead gained access to Apple IDs and passwords through external sources. Russian website MKRU said the attackers obtained the credentials via phishing pages and social engineering techniques.

Since then, CSO security blog Salted Hash has discovered that, since at least February of this year, these ransom attacks have returned and now target users in the U.S. and Europe. The methods used by attackers are said to be the same ones used in 2014, starting with a compromised Apple ID.

It starts with a compromised Apple ID. From there, the attacker uses Find My iPhone and places the victim's device into lost mode. At this point, they can lock the device, post a message to the lock screen and trigger a sound to play, drawing attention to it.

In each of the cases reported publicly, the ransom demanded is usually $30 to $50. If a victim contacts the referenced email address, in addition to payment instructions, they're told they have 12 hours to comply or their data will be deleted.

The website shared screenshots and linked to a number of Facebook, Twitter, and Reddit users whose devices appear to have been held for ransom in recent months, but there is speculation that the problem could be much larger than that. The following excerpt is highly questionable, however, and could very likely be incorrect.

Earlier this week, a security professional posted a message to a private email group requesting information related a possible compromise of at least 40 million iCloud accounts.

Salted Hash started digging around on this story after the email came to our attention. In it, a list member questioned the others about a rumor concerning "rumblings of a massive (40 million) data breach at Apple."

The message goes on to state that the alleged breach was conducted by a Russian actor, and vector "seems to be via iCloud to the 'locate device' feature, and is then locking the device and asking for money."

The report adds that "for now, let's assume there hasn't been a massive iCloud data breach." Apple has not commented on the matter.

Given that the Apple ID credentials involved in the ransom attacks are believed to originate from online security breaches, Salted Hash pointed towards a recently compromised Mac-Forums.com database, which allegedly includes 291,214 accounts, being sold for around $775 on the darknet.

There is currently no evidence to suggest that the Mac-Forums database has any relation to these ransom attacks, but users with an account on that website should change their passwords out of an abundance of caution. Setting a device passcode and enabling two-factor authentication for your Apple ID is also highly recommended.

Apple has a support document outlining steps to take if you think your Apple ID has been compromised. Also read security and your Apple ID.

Top Rated Comments

(View all)
Avatar
51 months ago

Apple under Tim Cook is slipping...

WTF? That comment doesn't make any sense here.
Score: 57 Votes (Like | Disagree)
Avatar
51 months ago

Apple under Tim Cook is slipping...

Reading comprehension is slipping faster, apparently.
Score: 39 Votes (Like | Disagree)
Avatar
51 months ago

Apple under Tim Cook is slipping...

Apple is responsible for third party security breaches? Really now.

I've got an idea! Let's start reading articles instead of making baseless comments after glancing at a headline. Deal?
Score: 33 Votes (Like | Disagree)
Avatar
51 months ago

Apple under Tim Cook is slipping...

What does Tim Cook have to do with people using weak passwords, using the same passwords between accounts, not changing them regularly, ect. ?
Score: 27 Votes (Like | Disagree)
Avatar
51 months ago
Apple under Tim Cook is slipping...
Score: 15 Votes (Like | Disagree)
Avatar
51 months ago
This sort of thing makes me wonder why companies have not latched on more vigorously to things like touchID. I can not just impersonate that over the phone in a far off land. I have to get into your secure enclave or have your physical phone. This is the direction everything needs to go.
Score: 7 Votes (Like | Disagree)

Top Stories

Apple Doubles the Price of RAM Upgrade on Entry-Level 13-Inch MacBook Pro

Saturday May 30, 2020 4:00 pm PDT by
Apple today doubled the price for upgrading the RAM on the entry-level 13-inch MacBook Pro, with customers in the United States now being charged $200 to move from 8GB to 16GB compared to the previous $100 upgrade price. Similar increases are seen in other countries, such as moving from €125 to €250 in Germany and from £100 to £200 in the United Kingdom. Current pricing on RAM upgrade for ...

Tim Cook Addresses George Floyd's Death and Ensuing Protests and Riots as Apple Temporarily Closes Some U.S. Stores

Sunday May 31, 2020 8:04 pm PDT by
Amid unrest in numerous U.S. cities following last week's killing of George Floyd by police in Minneapolis, Apple CEO Tim Cook has shared an internal memo with employees (via Bloomberg) addressing the pain that many are feeling and urging others to commit "to creating a better, more just world for everyone." Cook also announced that Apple is making donations to several groups challenging...

Apple's First MacBook Pro With a Retina Display Will Become 'Obsolete' in 30 Days

Monday June 1, 2020 7:50 am PDT by
If you are still hanging on to a Mid 2012 model of the 15-inch MacBook Pro with a Retina display, and require a new battery or other repairs, be sure to book an appointment with a service provider as soon as possible. In an internal memo today, obtained by MacRumors, Apple has indicated that this particular MacBook Pro model will be marked as "obsolete" worldwide on June 30, 2020, just over...

Top Stories: macOS 10.15.5, New Powerbeats Pro Colors, iPhone 12 and 13 Rumors, and More

Saturday May 30, 2020 6:00 am PDT by
This week saw an interesting mix of news and rumors on the Apple front, led by the release of macOS 10.15.5, which brings a new battery health feature to newer Mac notebooks, while we also saw the official announcement of new colors for the Powerbeats Pro earphones. On the rumor front, we heard a few tidbits about not just this year's iPhone 12 but also next year's iPhone, while we saw...

8 Mac Tips and Tricks You Might Not Know

Friday May 29, 2020 12:36 pm PDT by
There are tons of hidden features and shortcuts for Macs that Apple has built into macOS over the years, ranging from shortcuts to keyboard commands to other little hacks to make Mac usage just a bit simpler. In our latest YouTube video, we highlighted several of these tips and tricks, and some of them might just be new to you. Subscribe to the MacRumors YouTube channel for more videos. Tr...

6.1-inch 'iPhone 12' Production to Begin in July Ahead of Other 2020 Models

Monday June 1, 2020 2:36 am PDT by
Volume production of Apple's forthcoming 6.1-inch "iPhone 12" models will start in July-August ahead of the rest of the company's flagship iPhone lineup this year, according to a new report by DigiTimes. Apple is widely rumored to be launching four new ‌iPhone‌ models in the usual September or October timeframe, although supply constraints and delays in production ramp-up could cause a...

Apple Releases iOS and iPadOS 13.5.1 With Fixes for Recent 'unc0ver' Jailbreak Vulnerability

Monday June 1, 2020 9:58 am PDT by
Apple today released iOS and iPadOS 13.5.1, minor updates that come a little over a week after the release of iOS and iPadOS 13.5, major updates that brought the Exposure Notification API, FaceTime changes, mask-related unlocking updates and more. The iOS and iPadOS 13.5.1 updates are available on all eligible devices over-the-air in the Settings app. To access the updates, go to Settings >...

Apple Introducing New Internal USB-C Diagnostic Tool

Sunday May 31, 2020 7:26 pm PDT by
Apple is introducing a new internal USB-C Diagnostic Tool as a successor to its existing Serial Number Reader, which can be used to both collect a device's serial number directly from its logic board and test power on a device itself. Image via Giulio Zompetti With only a Lightning version previously available, images have surfaced of a new USB-C Diagnostic Tool (UDT) that appears to be known ...

Powerbeats Pro Debut in Four New Colors: Spring Yellow, Cloud Pink, Lava Red, and Glacier Blue

Friday May 29, 2020 10:00 am PDT by
Following a couple of leaks in recent weeks, Beats today is officially announcing four new colors for its Powerbeats Pro wireless earphones: Spring Yellow, Cloud Pink, Lava Red, and Glacier Blue. The new earphones will go on sale June 9 and sell for the same $249.95 price as the existing color options. Aside from the colors, the new Powerbeats Pro models are otherwise identical to the...

Apple Releases macOS Catalina 10.15.5 Supplemental Update With Security Fix

Monday June 1, 2020 10:56 am PDT by
Apple today released a supplemental update for macOS Catalina 10.15.5, the fifth update to the macOS Catalina operating system that was released in October 2019. The supplemental update comes a week after the release of the macOS Catalina 10.15.5 update. ‌macOS Catalina‌ 10.15.5 is a free update that can be downloaded from the Mac App Store using the Update feature in the System...