Small Sample of iCloud Credentials Provided By Hackers Are Valid, But Questions Remain

by

On Wednesday we reported that Apple had become the target of a ransom threat, with hackers claiming to have access to more than 600 million iCloud accounts. A group known as the "Turkish Crime Family" said they would reset and wipe the accounts unless Apple paid them $150,000 in Bitcoin by April 7.

Apple responded to the threat by stating that there had not been any breach of its systems, and that if hackers did have access to iCloud accounts then it could only be because of compromised third-party services.


Yesterday, ZDNet said it had received a set of 54 account credentials from the hacker group for "verification" and subsequently reported that all of the accounts were valid, based on a check using Apple's online password reset function.

The accounts include @icloud.com addresses dating back to 2011, as well as legacy @me.com and @mac.com domains from as early as 2000. The list of credentials is said to contain email addresses and plain-text passwords separated by a colon. According to Troy Hunt, data breach expert and owner of notification site Have I Been Pwned, this would suggest the data could have been aggregated from various sources.

ZDNet worked to contact each account holder via iMessage to confirm their password, and found that many of the accounts are no longer registered with Apple's messaging platform. However, of those that could be contacted, 10 people – all based in the U.K. – confirmed that the passwords were accurate, and they have changed them as a result.

When pressed about the original source of the data, the hackers claimed that it was "handled in groups" without explaining how or why. The hackers also refused to hand over a U.S.-based sample of accounts.

All of the people with compromised accounts said that until now, they had never changed their iCloud passwords before. One person said that the password he confirmed with ZDNet was no longer in use as of about two years ago, which narrows down the possible date of a breach or multiple breaches to somewhere between 2011 and 2015.

Most of the people confirmed that they used their iCloud email address and password on other sites, such as Facebook and Twitter. However, three people said that their iCloud email address and password were unique to iCloud, and were not used on any other site. Also, two people claimed someone had tried to reset their iCloud passwords in the past day.

It's unclear if the sample provided is representative of the wider pool of credentials the hackers claim to have, but based on its communications with the group, ZDNet suspects that its members are "naïve and inexperienced" and primarily seeking publicity.

Given that Apple has denied a breach, the account information may have been obtained from a major hacking incident, such as the one that befell Yahoo. iCloud users who have the same username and password that was used for both a hacked site and for iCloud should change their passwords immediately.

Anyone else concerned about the hacking claims should change their password and consider using two-factor authentication to secure their Apple ID credentials. Apple has said that it is "actively monitoring to prevent unauthorized access to user accounts and are working with law enforcement to identify the criminals involved".

Tag: iCloud

Top Rated Comments

(View all)
Avatar
46 months ago
It's clear from this thread that cyber education is still required ;)
Score: 20 Votes (Like | Disagree)
Avatar
46 months ago

fall for what, a site linking to apple.com?

Well, you just fell for it. The URL leads to a login website that looks identical to Apple's; except it isn't Apple's. After you've 'signed in', they've just got your details. Simple as that. It's not too difficult to change the URL path in an email while keeping what looks like a legitimate link.

That's how phishing works. It gets smarter and smarter.
Score: 16 Votes (Like | Disagree)
Avatar
46 months ago
Wonder if an email I got this morning is anything to do with this:

From: Apple (email address: neojacks@frankyhazard.com)

Dear Customer,

Your Apple ID (xxxxxxx@xxxxxx) was used to sign in tο iCloud οn an iPhοne 7.

Date and Time: March 24, 2017, 01:53 AM PST
Operating System: iOS 10.0.3

If you have nοt recently signed in tο an iPhοne 7 with your Apple ID and believe sοmeone may have accessed your account, gο tο Apple ID (https://appleid.apple.cοm actual link goes to https://appleid.apple.xn--cm-jbc/) and update your information as sοon as possible.

I don't have an iPhone 7 and I am not on iOS 10.0.3

Wonder how many people fall for this :)
Score: 8 Votes (Like | Disagree)
Avatar
46 months ago

fall for what, a site linking to apple.com?

Right click, copy link.



Score: 7 Votes (Like | Disagree)
Avatar
46 months ago

It's clear from this thread that cyber education is still required ;)

Yeah! To those hoping for more tips, I'd recommend going to https://www.cybereducation.com ('//www.youtube.com/watch?v=dQw4w9WgXcQ') for further information.

And it's that easy. Trust nothing and no-one online. Question everything. Ensure every link goes to where you expect it to. Go directly through the URL bar rather than following an email link if you're unsure. Phishing gets more and more elaborate and convincing.
Score: 7 Votes (Like | Disagree)
Avatar
46 months ago

Educate yourself. There are a ton of resources available at your fingertips. Sick of people making excuses or being dumb. You don't need to walk to a library anymore or enroll in a university to get information.

People should educate themselves on cars and seek help from more than one person since mechanics can take advantage of innocent people.
[doublepost=1490360738][/doublepost]

We got one! Sorry that your account has been compromised. Maybe you'll learn from your mistake in the future.

What's with the lemon juice attitude? Everybody started somewhere. If you spent your energy and efforts trying to help people rather than patronising them or saying "serves you right", you might find it a rewarding experience.

At the absolute least, you'll assist people from falling victim to these phishing attempts.
Score: 6 Votes (Like | Disagree)

Top Stories

When Will the iPhone 12 Launch? Here's What We Know

Wednesday September 16, 2020 6:12 am PDT by
Yesterday's "Time Flies" Apple event saw the release of the Apple Watch Series 6, Apple Watch SE, iPad 8, and iPad Air 4, but no new iPhone models. Rumors before the event strongly alleged that it would not see the unveiling of new iPhones, with many reports pointing to an October launch. The lack of new iPhone models yesterday seems to confirm that the iPhone 12 lineup will not appear...

iOS 14 Picture in Picture No Longer Working With YouTube's Mobile Website in Safari [Without Premium]

Friday September 18, 2020 12:21 pm PDT by
Apple in iOS 14 added Picture in Picture to the iPhone, a feature designed to let you watch a video in a small screen on your device while you continue to do other things on the phone. When Picture in Picture was working with YouTube The YouTube app doesn't support Picture in Picture, but up until yesterday there was a functional workaround that allowed videos from YouTube.com to be watched...

Hands-On With the New Apple Watch Series 6 and Apple Watch SE

Friday September 18, 2020 1:19 pm PDT by
Today's the official launch date for the Apple Watch Series 6 and the Apple Watch SE, both of which Apple announced on Tuesday. We picked up a couple of the new models and thought we'd give them a quick look for MacRumors readers thinking of ordering a new watch. Apple Watch Series 6 & Apple Watch SE Hands-On! When it comes to design, both the $399 Series 6 and the $279 SE look just like...

Here's How You Can Download iOS 14 and iPadOS 14 Around the World [It's Out]

Wednesday September 16, 2020 2:36 am PDT by
Apple's official public release of iOS 14 and iPadOS 14 dropped on Wednesday, September 16, just a day after the company released the Golden Master to third-party developers. Also set to be made available to the general public for the first time are watchOS 7 and tvOS 14. Getting Started With iOS 14 Video Click image to watch iOS 14 Getting Started While that's left a lot of developers...

Apple Releases iOS 14 and iPadOS 14 With Home Screen Redesign, App Library, Compact UI, Translate App, Scribble Support, App Clips, and More

Wednesday September 16, 2020 12:48 pm PDT by
Apple has released iOS 14 and iPadOS 14, the newest operating system updates designed for the iPhone and iPad. As with all of Apple's software updates, iOS 14 and iPadOS 14 can be downloaded for free. iOS 14 is available on the iPhone 6s and later, while iPadOS 14 is available on the iPad Air 2 and later. The updates are available on all eligible devices over-the-air in the Settings app. To ...

iOS 14.2 Beta Adds New Shazam Music Recognition Feature for Control Center

Thursday September 17, 2020 3:36 pm PDT by
Apple today released the first beta of iOS 14.2 to developers for testing purposes, and the new update introduces a Music Recognition control for the Control Center. The new feature lets you discover music playing around you and it recognizes the music playing with in apps, even when you're wearing AirPods. Songs pop up as notifications, and you can tap to listen in Apple Music....

Apple Updates AirPods 2 and AirPods Pro Firmware to Version 3A283

Monday September 14, 2020 11:24 am PDT by
Apple today released new 3A283 firmware updates for the second-generation AirPods and the AirPods Pro. The second-generation AirPods are being updated from the 2D15 firmware they were previously running, while the AirPods Pros are being updated from the 2D27 firmware they had installed previously. Apple does not provide details on what's included in refreshed firmware so we don't know what's ...

Rumor Report Card: Assessing the Accuracy of Leaks After Apple's Event

Friday September 18, 2020 12:57 pm PDT by
Apple hosted its virtual "Time Flies" event this week, where it introduced four new products, including the Apple Watch Series 6, lower-cost Apple Watch SE, a 10.9-inch iPad Air with an all-screen design, and an updated 10.2-inch iPad with a faster A12 Bionic chip. As expected, there were no new iPhones, which are believed to be coming in October instead. Apple also announced that it will be ...

Epic Games Announces 'Fortnite: Save the World' Will No Longer Be Playable on macOS

Friday September 18, 2020 4:50 am PDT by
Epic Games has announced that "Fortnite: Save the World" will no longer be playable on macOS, after Apple terminated Epic Games' developer account. Fortnite has been in violation of the ‌App Store‌ rules since August 13, when it introduced a direct payment option that skirted Apple's in-app purchase system by allowing payments directly to ‌Epic Games‌. Shortly after Epic blatantly...

Deals: Cellular Carriers Introduce First Offers on Apple Watch Series 6 and SE

Friday September 18, 2020 7:43 am PDT by
With the launch of the Apple Watch Series 6 and Apple Watch SE today, cellular carriers have now introduced special offers for these new wearable devices. Note: MacRumors is an affiliate partner with these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Starting with AT&T, if you buy one Apple Watch Series 3, Series...