Hackers Claim Access To 300 Million iCloud Accounts, Demand $75,000 From Apple To Delete the Cache of Data (vice.com) 122
A hacker or group of hackers calling themselves the "Turkish Crime Family" claim they have access to at least 300 million iCloud accounts, and will delete the alleged cache of data if Apple pays a ransom by early next month. Motherboard is reporting that the hackers are demanding "$75,000 in Bitcoin or Ethereum, another increasingly popular crypto-currency, or $100,000 worth of iTunes gift cards in exchange for deleting the alleged cache of data." From the report: The hackers provided screenshots of alleged emails between the group and members of Apple's security team. One also gave Motherboard access to an email account allegedly used to communicate with Apple. "Are you willing to share a sample of the data set?" an unnamed member of Apple's security team wrote to the hackers a week ago, according to one of the emails stored in the account. (According to the email headers, the return-path of the email is to an address with the @apple.com domain). The hackers also uploaded a YouTube video of them allegedly logging into some of the stolen accounts. The hacker appears to access an elderly woman's iCloud account, which includes backed-up photos, and the ability to remotely wipe the device. Now, the hackers are threatening to reset a number of the iCloud accounts and remotely wipe victim's Apple devices on April 7, unless Apple pays the requested amount. According to one of the emails in the accessed account, the hackers claim to have access to over 300 million Apple email accounts, including those use @icloud and @me domains. However, the hackers appear to be inconsistent in their story; one of the hackers then claimed they had 559 million accounts in all. The hackers did not provide Motherboard with any of the supposedly stolen iCloud accounts to verify this claim, except those shown in the video.
Re: (Score:2, Funny)
Hmm, you used Slashdot.... Slashdot user! obviously you will certainly defend these criminals or blame Apple and the victims!
Drone Strike!
Yawn.
Re: (Score:1)
1) they're not civilians. They're economic terrorists. Drone strike.
2) they're not Americans. No US constitutional rights. Drone strike.
3) absolutely. A few drone strikes is a lot cheaper than upgrading my firewall every year for no reason because even that gets hacked. Drone strike.
Drone strike.
Two factor (Score:5, Funny)
Let's see if all this 2-factor authentication is everything it's cracked up to be!
Re: (Score:1)
Doesn't matter. 2-factor authentication is not needed to get to the Find My iPhone page, presumably because that second factor could very well be the lost iPhone. So if these criminals have account passwords (unlikely, sounds like bad bluffing), they'll be able to go into FMI and remote-wipe devices to their heart's content. Until they get blocked.
Re: (Score:2)
Let's see if all this 2-factor authentication is everything it's cracked up to be!
Since this is starting to sound like yet another case of people being lazy with passwords, it's unlikely anyone affected has two-factor authentication enabled.
Re: (Score:2)
Let's see if all this 2-factor authentication is everything it's cracked up to be!
Since this is starting to sound like yet another case of people being lazy with passwords, it's unlikely anyone affected has two-factor authentication enabled.
You don't get access to 300 million account by guessing passwords or phishing. You get it by hacking Apple directly and stealing the backend data. Either way, anyone with an iCloud account should change their password just to be sure.
one MILLION dollars! (Score:5, Funny)
Dont they know a true evil genius must ask for one MILLION dollars!
Amateurs
Re: (Score:2)
Re: (Score:2)
Actually it's clever (Score:2)
Austin Powers-references besides, that's actually a good idea:
- 75k USD is actually indeed a very small sum. So small that Apple's PR department can easily cough it up (there are probably rounding error on Apple's marketing budget that are bigger than that) without it even going noticed in Apple's finances.
i.e.: It's pretty cheap for Apple to hand the money just to make them shut up and get them out of mind.
- 75k USD can actually means a lot in Turkey (if the hacker group are truks, as they claim) given the
Re: (Score:2)
The hackers have even said that they would accept 75k in iTunes card. That's money that will eventually get spent on Apple goods and services anyway. Apple's tax evasion special...
1) They asked for 100,000 in iTunes cards, not 75,000
2) The "money" from these iTunes cards may get spent on Apple products, but since those cards were given away and not paid for, Apple is still losing money.
3) This is rather stupid, since once Apple gives them the cards, and confirms the data is cleared, Apple will invalidate the cards making them useless.
Re: (Score:2)
Stupid question (Score:5, Interesting)
Re: (Score:2)
If 300 million iCloud passwords suddenly stopped working you'd hear about it.
$75k? (Score:5, Funny)
Re: (Score:2)
Do they know its Apple they have by the balls?
Well, it's not like they are going to really delete it.
Re: (Score:2)
Do they know its Apple they have by the balls?
Well, it's not like they are going to really delete it.
And it's not like Apple doesn't have backups.
Re: (Score:1)
They are just negotiating the bug bounty reward.
Re: (Score:2)
Do they know its Apple they have by the balls?
They don't have anybody by the balls. There is a big, big difference between opening your big mouth and claiming you have access to 300 million iTunes accounts, and having access to 300 million iTunes accounts.
And one of the "hackers" will get his ass spanked by his grandma for deleting her account.
Publicising Blackmail? (Score:5, Informative)
Why would anyone publicise blackmail. Seriously, think about it, makes no sense at all. It publicly forces Apple into a corner where they are aiding and abetting crime by paying the ransom, so no ransom can be paid. So a mass invasion of privacy, why, no ransom? So who benefits by a publicised mass invasion or privacy, someone who already hugely and grossly invades privacy on a mass scale and wants to attack Apple to prove it can not provide privacy. Only one culprit really fits that bill and corporate espionage on all sorts of scale was inevitable and is happening. So which corporation most hates Apples ability to sell 'you' privacy, whilst that disgusting filthy vile company is selling 'your' privacy, M$. This really does stink of a corporate funded attack, maybe not from the top but most certainly from a major investor.
For Apple to prove itself it must act with an extreme corporate legal vengeance, can Apple buy privacy, in this case it most certainly, by offering ten times the blackmail demand with reward for the culprits and those who paid them. Most likely source of the hackers, corrupt intelligence services, contracts or ex-agents (Turkey recently conducted a purge).
Re:Publicising Blackmail? (Score:4, Informative)
Re: (Score:2)
Another possibility is these guys got hold of known-cracked account info (e.g. Yahoo accounts) and then script-kiddied their way through the list to find the ones which were using the same credentials on iCloud.com.
Re: (Score:2)
Alternatively, this is a bunch of script kiddies who managed to guess the password to a handful of accounts, and are now trying to make a name for themselves.
I'm betting its a PR stunt for Ethereum
Re: (Score:1)
It publicly forces Apple into a corner where they are aiding and abetting crime by paying the ransom, so no ransom can be paid.
That's not how ransom works. Any time there is a ransom request, the victim is allowed to pay it if the outcome is likely to be more desirable than not paying it. Where did you get the idea that paying a ransom was illegal? Happens all the time.
Re: (Score:2)
Other people would disagree with you http://www.aph.gov.au/Parliame... [aph.gov.au]. Want kidnappers et at pay for them and you will have all you want.
Re: (Score:1)
1. You are assuming they are telling the truth.
2. All 300 million people don't live in the same town. That's going to raise a red flag with the login process.
3. They can't delete all 300 million at once. They can't delete a significant fraction of 300 million at once. You block IPs once you see them appear.
4. Turning the honeypot on when it hits April 7 is pretty easy.
5. You are assuming they are telling the truth.
Re: (Score:1)
They would sell such gift cards for cash at 75-100% of face value.
Re:$75k? (Score:5, Insightful)
Yeah, they're realy under-pricing their hoard, assuming they really have it.
I wonder if they just compromised enough accounts via other means in the hopes of passing light scrutiny and $75,000 was the most they thought they might possibly get away with asking for without anyone bothering to take a closer look.
Re: (Score:2)
I wonder if they just compromised enough accounts via other means in the hopes of passing light scrutiny and $75,000 was the most they thought they might possibly get away with asking for without anyone bothering to take a closer look.
Or they request 75k for starters, then after being paid, they do make another request, of 10 times that amount.
Re: (Score:2)
At around 78K and above the FBI sends out two agents.
Re: (Score:2)
heart cloud (Score:5, Funny)
Re:heart cloud (Score:5, Informative)
Love the cloud
There is no cloud. It's just someone else's computer.
Just don't pay - simple (Score:1)
A hacker or group of hackers calling themselves the "Turkish Crime Family" claim they have access to at least 300 million iCloud accounts, and will delete the alleged cache of data if Apple pays a ransom by early next month. Motherboard is reporting that the hackers are demanding "$75,000 in Bitcoin or Ethereum, another increasingly popular crypto-currency, or $100,000 worth of iTunes gift cards in exchange for deleting the alleged cache of data." From the report:
If Apple pays the data gets deleted - simple solution is to not pay. A far more complex solution is editing summaries at a 5th grade level or above.
Re: (Score:3)
lol dumbasses don't realize that apple can issue and cancel itunes gift cards however they wish.
Re: (Score:2)
Re: (Score:2)
Apparently it's a problem. Apple has an article on it on the front of their support page.
You don't even understand what "it" is.
Re: (Score:2)
When people are dumb enough to rely on the cloud.. (Score:4, Insightful)
I had a client a few years back that accidentally deleted 10 years worth of personal photos because they thought they were only deleting them from iCloud, not knowing it would delete it from their computer as well.
I say, if people are fucking stupid enough to entrust a third party with their data and not back it up independently, they get what they deserve.
Back up your shit, and back it up to YOUR OWN MEDIA.
Re:When people are dumb enough to rely on the clou (Score:5, Insightful)
I can't believe shit like this gets modded up. People like you - the ones who blame the user - give people like me a bad name.
They put it on iCloud - as far as they know, THAT IS A FUCKING BACKUP. They have independently set up an iCloud backup, as far as they are aware. Calling them stupid does nothing to address the cause, which in your example, is a shitty user interface provided by Apple that did not adequately inform the user of the effects of the action in question.
No, they do not "deserve" this. They made a simple mistake. We all do. Believing an iCloud copy is a reliable backup is a perfectly reasonable assumption to a layperson. They have a copy on their iPhone, and a backup copy in an iCloud account. Or conversely, they have a copy in an iCloud account, and a backup stored on their iPhone - THEIR OWN FUCKING MEDIA.
You seem to not understand that not everyone should be expected to maintain the level of knowledge you have on this matter. They don't understand it - so they place their trust in Apple - who, by all accounts, should know a hell of a lot more about this matter than they do.
Re: (Score:1)
What a rubbish comment 'Believing an iCloud copy is a reliable backup is a perfectly reasonable assumption to a layperson'' you should never make an assumption, it takes 5 mins to run a quick google search to confirm. I hate hearing people who are always looking to point the finger and blame someone else for their mistakes.
Re: (Score:2)
You should never make an assumption
The problem with that comment is that you have to know a certain amount of what you are doing in order to realize whether you are making an assumption or not. You might say a person should know at least that much about computers before using one, but that has never been who Apple sells to. Apple is supposed to 'just work'. These people probably don't know the difference between an email attachment and a file in the finder, so now their thinking they can't delete email attachment because it will affect th
Re: (Score:2)
Careful not to cut yourself on all that edge.
Edge? What edge are you even talking about? Did you just see someone else use that response and copy it without understanding what it means?
Re: (Score:2)
Meh.
Thinking of iCloud as a "backup" is akin to thinking that having 2 broadband modems will help when your ISP goes down.
Re: (Score:2)
Apple sure do a good job of marketing it as a backup... http://www.apple.com/icloud/ [apple.com] https://support.apple.com/en-u... [apple.com]
Yeah, they market it as a means of backup for iOS devices, if you can't do local backups (or really, really hate iTunes) https://support.apple.com/en-us/HT203977 [apple.com]. What does that have to do with the iCloud backup of a Mac the OP pretends exists?
Re: (Score:2)
-1 uninsightful and -1 overrated
Deleting all of your copies of data means you have no more copies, regardless of where those copies used to be.
Re:When people are dumb enough to rely on the clou (Score:4, Informative)
I call total BULLSHIT on this story:
1) when you delete a picture there is a pop up warning you that the picture will be delete from ALL devices.
2) deleted pictures are not deleted, they are moved to the trash album, in which they reside for 30 days, then and only then they are truly deleted. You just go to the trash album, select the pics and tap the recover button.
Re: (Score:3)
Deleting them from iCloud? (Score:1)
ARE you afraid that AFTER waiting for 10 years, you will be TOO tempted to hit the DEL key on your macbook and WIPING everything you unknowingly uploaded to the Cloud?
FEAR NOT. Introducing the keyboard exercise! By doing a daily keyboard exercise per week, you can ensure your key-smashing excitement is well satisfied. It will also enhance your bodily excitement for a health life.
WHAT are you waiting for? Complete your daily keyboard exercise TODAY.
Disclaimers: May cause pain, numbness and soreness on head,
Re: (Score:2)
Re: (Score:2)
Who said anything about keeping backups on site?
Re: (Score:2)
Or quality medication for one person thats a cure?
They're probably full of shit (Score:2)
or they'd be asking for a lot more money. But I hope they do it. Apple fan boy tears are the best tears. Burn that walled garden :)
How did they get in? (Score:2)
Probably got passwords by phishing. (Score:2)
I got 3 dozen spam emails the past couple of years urgung me to click on a URL, and "verify my Apple Icloud account". They probably got a bunch that way. Wonder if John Podesta got his account "hacked".
Are you sure? (Score:1)
Are you sure they're Turkish hackers? Didn't you really mean Russian hackers? There's only two kinds of hackers in the world: Russian hackers, and the hacker known as 4chan.
Some prudent tips I have shared with friends (Score:5, Informative)
As a precaution, here are some prudent tips:
1. Log into your Apple Account at https://appleid.apple.com/ [apple.com] and enable two-factor authentication if you haven't already (see https://support.apple.com/en-a... [apple.com])
2. While you are there, if you have not changed your password in a while, consider doing that too (https://support.apple.com/en-au/HT201355).
3. As the threats include the threat of remotely wiping devices, you can disable this on each of your iCloud connected devices. See Macworld's good article on how to do this for each device type: http://www.macworld.co.uk/how-... [macworld.co.uk] . Note that if you do this, you will also be unable to use the Find my iPhone/iPad/Mac feature. Until more details come out, personally I feel this is acceptable given the risk.
4. When you are logged in at https://appleid.apple.com/acco... [apple.com], check to ensure there are no devices you do not recognise under 'Devices'.
5. For the next few weeks, periodically do a local backup using iTunes of your iDevices. See https://support.apple.com/en-a... [apple.com] and click on 'Use iTunes'. I recommend you also set a backup password, this encrypts the backup and stores additional information making a future restore easier.
6. As always, BACKUP BACKUP BACKUP. For your Mac, I would already hope you have backups in place. If not, my favourite is CrashPlan http://crashplan.com/ [crashplan.com] and I have used it for years/put many friends onto it also.
Time will tell what will happen with these accounts, it never hurts to take a few prudent steps until the community at large knows more.
I would be suspicious (Score:2)
the iTunes gift cards are probably marked.
Re: (Score:2)
the iTunes gift cards are probably marked.
They contain explosive dye packets which trigger once the card gets too far away from any hipsters.