Icloud account just got hacked

etresoft, what in this thread has suggested that ANYONE has done ANYTHING to expose their iCloud accounts to uneccesary risks?

In my case there were no phising what so ever, I never use the iCloud account and it had a separate password form all other common accounts i use online.

Either a bug in the iOS software let someone steal my credentials or a bug on the iCloud servers enabled someone to bypass the authentication - those are my two theories.

Suggesting phishing would be logical after reading the first post - but if you could comprehend the explanations given by the following posters, sticking to that theory proves nothing but ignorance.

On a brighter side of things, though - its been 14 days and no more breaches (my account was broken into three times after changing the password).

See my earlier responses to etresoft. Trying to convince this person that you didn't type your credentials into anywhere but an apple site, didn't install malware / keyloggers, didn't share your credentials with 20 of your most shady friends / enemies is downright impossible.

From the beginning, etresoft has misread posts, ignored that the mail only shows up in iCloud and on IOS devices (Not in Outlook or Thunderbird. They also can't be searched from these clients). I've posted several times that the mail headers indicate the sending client was MobileMe. Only iCloud contacts were compromised.

In short, etresoft erroneously believes that any kind of compromise must involve millions of users.

yep, I know I just wasted my time by replying - but the annoyance level of his/hers ignorance just tipped the scales 🙂

either way, it seems as though the issue - whatever it was - has been handled and mitigated.

and in true Apple fashion, we'll never know what really happened 😟

tsnow20 wrote:

In short, etresoft erroneously believes that any kind of compromise must involve millions of users.

No one in this thread (other than me) ever suggested "any kind" of compromise. The only suggested cause was that Apple's iCloud servers were hacked. A compromise like that would involve millions of users. I suggested that only a few individual accounts were compromised and that such things take place constantly in a service with as many users as iCloud.

øivindfromoslo wrote:

in true Apple fashion, we'll never know what really happened 😟

Yes. Apple is so sneaky. Always getting hacked and always hushing it up. Apple is so good at hushing up security compromises like this that you never hear about it. Is there is any company that is a true master at hushing up negative press, it has to be Apple.

etresoft wrote:

No one in this thread (other than me) ever suggested "any kind" of compromise. The only suggested cause was that Apple's iCloud servers were hacked.

Once again, it was suggested multiple times that the compromise may have involved IOS devices (A theory I even offered myself) Your failure to comprehend the situation is clearly apparent. A compromise of a server could easily just involve a few accounts since one server can't be expected to hold every iCloud account. iCloud wouldn't scale very well if this was the case. A compromise of web services doesn't mean that the attacker was able to run a "select * from users.table" query and abuse every iCloud account.

Yes. Apple is so sneaky. Always getting hacked and always hushing it up. Apple is so good at hushing up security compromises like this that you never hear about it. Is there is any company that is a true master at hushing up negative press, it has to be Apple.

I'm not a lawyer, but I don't know that a company is necessarily required to disclose when there is a security breach if the breach doesn't include financially compromising information / large numbers of users. There was a huge discussion regarding this after the Sony debacle compromised 75 million accounts. The fact of the matter is, none of us knows what really happened, including you. Given the nature of the issue, I doubt it was a simple "phishing" scam like you continue to claim.

Apple saw something, else it wouldn't have been necessary for them to reset passwords without notification. It would be nice to know what exactly they saw.

tsnow20 wrote:

Apple saw something, else it wouldn't have been necessary for them to reset passwords without notification. It would be nice to know what exactly they saw.

I'm quite confident that Apple has a whole team for first-tier iCloud support technicians who do virtually nothing but reset passwords all day long.

etresoft wrote:

tsnow20 wrote:

Apple saw something, else it wouldn't have been necessary for them to reset passwords without notification. It would be nice to know what exactly they saw.

I'm quite confident that Apple has a whole team for first-tier iCloud support technicians who do virtually nothing but reset passwords all day long.

Why not? They certainly have teams of forum users who take offense at any suggestion that there may be an issue of security that needs to be looked into. Small teams, granted.

If your post means to imply that it was an automated process (I can't tell if you're being sarcastic or not), there was still something that triggered that automated process. Several people had their passwords reset multiple times.

tsnow20 wrote:

Why not? They certainly have teams of forum users who take offense at any suggestion that there may be an issue of security that needs to be looked into. Small teams, granted.

Ah yes. I disagree with you. Ergo, I must be an Apple employee. That makes perfect sense because Apple is just the kind of sneaky company that would fill a forum full of shills who don't post with a little purple Apple logos under their names. You aren't the first to figure that one out.

If your post means to imply that it was an automated process (I can't tell if you're being sarcastic or not), there was still something that triggered that automated process. Several people had their passwords reset multiple times.

I've lost interest in this topic. There were a handful of posts that looked curious but then it went swiftly downhill. Now, if anyone sees this topic and is worried about iCloud security, they won't find much but us two bickering. I'm cool with that.

Ah yes. I disagree with you. Ergo, I must be an Apple employee. That makes perfect sense because Apple is just the kind of sneaky company that would fill a forum full of shills who don't post with a little purple Apple logos under their names. You aren't the first to figure that one out

Wasn't calling you an Apple employee. Over-protective Apple user, more like.

I've lost interest in this topic. There were a handful of posts that looked curious but then it went swiftly downhill. Now, if anyone sees this topic and is worried about iCloud security, they won't find much but us two bickering. I'm cool with that.

Your interest in the topic thus far has proven to be little if any.

Something productive is this response I finally received from Apple:

"Thank you for your reply.

It appears that other customers are experiencing this same issue, therefore, Apple is currently working toward a resolution for the issue you have reported.

You will receive an email after the matter has been investigated and further information is available.

Thank you for your patience. Apple wants your iTunes experience to be as enjoyable as possible.

Sincerely,

iTunes Store/Mac App Store Customer Support"

tsnow20 wrote:

Wasn't calling you an Apple employee. Over-protective Apple user, more like.

Flattery will get you nowhere 🙂

I think perhaps I might've been hacked this morning. I don't have anything in my sent folder, but I received a spate of "Delivery has Failed" emails in my iCloud inbox this morning. Looks like sets of three from my contacts were emailed from my 'me.com' address with a link to a site in Europe. I don't see evidence of the emails in my Sent box, so I'm not sure if my email was actually compromised or just spoofed. (Is there any way to know?) As people here referenced, I checked the headers for the originating IP address on the spam emails, and it appears to be a cable company in Thailand. I also received a text on my iphone after the emails, apparently from my me.com account, addressed TO my me.com account along with two other contacts (from my address book). It contains a similar looking (but different) web link. I changed my password, but am not sure what else to do. I'm not very familiar with these kinds of issues. Do I email apple to let them know? (I can't call.) What's the proper email address for directing reports of this kind ? Thanks all!

Velcr0 wrote:

I don't see evidence of the emails in my Sent box, so I'm not sure if my email was actually compromised or just spoofed. (Is there any way to know?) As people here referenced, I checked the headers for the originating IP address on the spam emails, and it appears to be a cable company in Thailand.

That's how you know. That is spoofing. Just ignore it.

Thank you : )

This is what I get when I go to the "Bug Report" :

You must be a registered Apple Developer to file bugs via Bug Reporter.
Register at http://developer.apple.com/programs/register/ devbugs@apple.com.

Is there otherway to report an iCloud issue to Apple ? All I have tried lead nowhere... it's a 'let the customer be lost' labyrinth...

Have been hacked this Saturday 06/02/2012

Why Apple try to cover the fire instead of letting its customers know about the issues so they can protect themselves ?! As obviously those problems occurs from the beginning of the year !

Or at least tell their customer iCloud is not securised, use it at your own risk !