My devices have been hacked. What do I do?

I am in Aus, and I too was hacked. Nothing that anyone here has noted as 'causes' is relevant to me - totally different ebay password, didn't click on the email link etc. I have 2 ipads and 1 x phone - have reset the phone and 1 x ipad, but am holding off on the second as there is some info on there that I really don't want to loose if possible. Has anyone anywhere come up with a 'fix' yet so that I con't have to restore?

geez, thinking that should just turn off Find My iPhone for now. and also change your password, make sure you have two-factor authentication turned on. make sure you have a passcode on your lockscreen, and delete your credit cards from itunes. then wait until the coast is clear when apple comes out with an explanation and a resolution. scary.

This happened to me 2 months ago on my MacBook Air I have had for almost a year now. The only backups of my iPhone 5s and all pics and messages are on that computer. It was locked randomly using the find my iPhone as I did not have a pass code set for the macbook (didn't think you could) so like the phones and iPad when whoever has access to the findmymac account logs in and marks your device as stolen or lost and creates a new passcode, THERE IS NO WAY TO REMOVE THE LOCK WITHOUT APPLE's HELP (to all those posts where people thought the old reset would get rid of it). I believe that pin stays until you get rid of it which you can't cos your account or device was hijacked like mine.

Problem is apple didn't offer me any info, support or advice at the store. I even had the logs from console just before the lock which showed a duplicate keyboard was loaded, and some other hacks to do with dictionary, language, and remote access!

In my case the hack was done using the original owners account (who was out of the picture nearly 1 year ago now but didn't disassociate the serial number of the MacBook Air from his findmymac account.... Just like I never have not once when I sold half a dozen iPhones and another stack of MacBooks and desktop macs (cos no one even knew about that whole thing Apple!!!!). Grrr :@. So the old owner gets an email saying if he wants his computer then he has to pay. But I already paid him. And he won't get his computer access back from the hacker cos he doesn't own it any more! And so surprise surprise he's not getting it unlocked for me. And Apple did not even bother IN THE SLIGHTEST to advise me or to work around with another solution so I can't unlock it. So it sits here and no one gets to use this amazing laptop for months now, while my most valuable data I need for evidence in court soon sits on it waiting for Apple to come back down to earth. :(

Of course same goes with all" find my" devices with multiple account SN registrations /previous owners. In any event you will need apple to help you. And if you aren't as unlucky as me, they might actually give a toss and do something for you.

Good luck everyone.

Sorry I am from Melbourne Australia, btw.

The source of the hack is varied but I believe from my investigations given my head start as a victim some weeks ago, that the offenders are very very local.

Some of you might also notice now that you are prone to checking, that your devices have been root accessed remotely by unauthenticated shell log in (jailbreak not required contrary to false and wrong assurances). If you read the reasons released by Apple for iOS 7.1.1 update you will see it right there thus the reason for those patches. As a result your key chains like mine would have been accessed along with your account passwords for everything! If they didn't do this, then the reverse happened via heart bleed.

Nonetheless your devices and data are in jeopardy while they remain locked by someone else and powered on. I would put the iOS devices in DFU mode immediately, remove the SIM card and contact apple for further reset assistance. As for MacBooks etc you must shutdown using terminal so that it actually forces any hackers to be logged off at the same time. I also disconnected the power if possible as not taking any chances.

In the mean time, an internet security specialist (not Apple. They didn't help me still!) said I have to reset EVERY password, username if possible and banking detail that I can, BUT MUST BE DONE ALL IN ONE SESSION, ON INTERNET AND DEVICES THAT ARE NOT YOUR OWN OR LINKED WITH THE BREACHED DEVICE IN ANY WAY, and that I am not to use any device with these new account details until the problem has been solved. So I say it's a good time to head over to the demo computers and free internet at Apple and "stand" there and change all your keychain entries, iCloud's, emails, netbanks, Dropbox, etc etc etc. I wish everyone the best of luck!

P.s. I firmly believe that once the imei, serial and mac addresses have been compromised that Apple must swap the devices over or issue new numbers as the hackers have used these details in my case to just keep going back into my iPhone and iPad and macs which are not still locked (still waiting on my air). So all my new accounts and passwords and all that effort is in vain cos I keep doing all the work changing everyone only for similar breaches to occur, even if the passcode issue is specifically avoidable a second time by assigning your own passcode first. Needless to say apple won't swap a single device of my 2 x iPhone 5s, 2 x iPads, 2 x airports, 2 x macbook pros, MacBook Air (still locked), 3 x iPhone 4s and the list keeps increasing. *Sigh*

Hi,

For what its worth, just wanted to add my story.

iPhone 5 was locked yesterday at 4.24am via FindMyiPhone.

I didn't have a lock on my phone so the hacker set one. Woke up to the same message as everyone else.

I was able to access iCloud and unlocked FindMyiPhone then changed my Apple password.

Tried to reset my phone via iTunes but it buggered up halfway through and froze.

Went to Apple store in Canberra yesterday and reported the problem - staff member couldn't have cared less and acted like she didn't believe me! After she re-set my phone it was fine.

My iPad mini was okay and still seems to be.

Apple disabled my account last night so I had to re-set the password again.

My daugher who lives with me has an iPhone4 and iPad and she wasn't hacked.

However, a collegue of mine was.

I own my phone outright. I don't have an ebay account and my password wasn't used anywhere else except for Apple.

Fantastic update of your situation nessmonz, thank you for contributing that.

Was your Apple ID and Alternate Apple ID with Apple itself, that is, do you sign in to your iCloud account with @mac.com or @me.com or @icloud.com, or, do you use another email service as your AppleID/Alternate (note that Apple provides both of these, a primary and alternate, as managed in appleid.apple.com, but a lot of people overlook this.)

Interesting that the attacker isn't changing iCloud passwords - several people have reported being able to enter iCloud and unlock their device and update passwords.

Thanks 🙂

I'm not a very techy person but I sign into iCloud using my Apple ID. Obvs I have subsequently changed that password too as well as everything else I have a password for and made them all unique with two-step verification. So paranoid now.

Still wondering why I haven't been hacked. The latest thing which I notice is that I have keychain turned ON on my iPhone, but OFF on my Air. So I have to enter passwords on each device when I change a password on either.

I'm not sure what happened in your case, but this isn't related, all. The facts are, a hacker has accessed user iCloud accounts somehow. Not devices. It's impossible to ssh into an iPhone or iPad without jailbreaking.

Yours is one massive conspiracy theory and even if were slightly true, more than spurious messages would have happened.

Conspiracy theories aren't helpful in this case.

I just posted this on an Australian forum. This is the closest I have come to a possibility. Would be interested on peoples opinions especially those with kids with devices linked to their Apple ID.

The Apple IDs compromised seem to have unblock-us.com as the common denominator. The few that didn't may have visited a WiFi network that had the unblock-us.com DNS set.

People use this to access BBC iPlayer, Netflix and ABC iView outside the geoblock. Its in the perfect position to intercept the passwords.

Exactly, hence nearly nobody from the USA got hit. And only a few from other countries most of which had visited here. No doubt they did not like Foxtel's stranglehold on content either.

A lot of people say they don't let their kids have the Apple ID passwords so they can keep an eye on what they are doing but all it will take is for their kid to go to a friends place that has unblock-us and use their wifi and bang. next time you put in the password you are done.

I think this is the key

The original idea came from another person on the forum not myself.

Any thoughts?

You're quite right, Andrew J, we should stop thinking about devices. So far as iCloud is concerned, if it helps to rule things out (I have NOT been affected remember):

1. I have a strong, unique Apple ID password (albeit my ID is the same email address which I use for everything)

2. I have 2fa (2 factor authentication) turned on.

I fear that the ABC chap who's just posted will come up with a story about Apple devices rather than looking at how people made their iCloud passwords available to our mate Oleg.

If you had read back in the thread, you would see affected users saying they have had no relationship with unblock-us. It's been discounted, as has eBay hacked passwords, Telstra and other connections. So far we haven't been able to find a common thread between affected users. My theory is still on people who use the same ID details on other sites or shared Apple accounts between family & friends. So far it has been a small number, so the common denominator may not be obvious.

I think you're right. Greg Mullers post has been deleted as, if he had read the terms of use, his touting for a media interview is a breach.

To you Greg Muller, if you're trying to sensationalize this as a filler story, you've come to the wrong place. Keep reading though, we might get you a story when we track down the source.

thats the thing Andrew, you dont have to have a relationship with Unblock-us. All you have to do is visit a friends house who does and use their wifi. You seem to have made yourself the resident expert in this thread yet you shoot possibilities down without thinking them through properly. How about you leave it to others who are more IT literate than yourself to comment.

That's fine, shoot the messenger, I don't mind, but have YOU thought it through?

IF. Unblock us is the cause, then each and every user would have had to type in their Apple IDs & passwords whilst being connected to the VPN service. Btw, unblock us use an IP routing service as well as a VPN service.

Now, given these things, Apple data between device and server is encrypted. How then is that encryption broken?

Apple devices have all data sandboxed from third party systems, so how then has an VPN service been able to bypass the sandbox?

I have thought it through. Yours the one who hasn't.