veritylikestea
Level 1 (1 points)

Q: My devices have been hacked. What do I do?

i was using my ipad a short while ago when suddenly it locked itself, and was askiwhich I'd never previously set up. I went to check my phone and there was a message on the screen (it's still there) saying that my device(s) had been hacked by 'Oleg Pliss' and he/she/they demanded $100 USD/EUR (sent by paypal to lock404(at)hotmail.com) to return them to me.

 

I have no idea how this has happened. I am not aware of having been exposed to malware or anything else, although i did recently purchase some new apps - perhaps one of these has something to do with it? I don't know. I am not sure what avenue has been used to reach my devices - I'm about to use my husband's laptop to check through some of my accounts (gmail, etc) and see if there is any clue there.

 

Has this happened to anyone else? What can or should I do? Many thanks

iPhone 5

Posted on May 26, 2014 4:57 AM

by georz,Solvedanswer
georz georz
Level 1 (10 points)
A:

I had the same problem originally. This is what I was told to do (and did) over the phone with applecare support.

 

Turn off your phone.

Plug your cable into the computer and have itunes up (do not plug into the phone yet)

Press and hold the home key on your off phone (I did mine for about 10 seconds). If nothing happens, plug in the cable into your phone (keep holding the home key)

What you want to see come up is the picture of itunes and cable on the front of the phone

Your itunes should then recognise the phone as an unidentified phone

Select restore factory settings (it should down load some software) ~15 mins and automatically install

The phone should go through some of the standard reset screens (usually black screen with apple icon and loading bar)

You will be prompted to restore the phone.... do this from itunes not the phone

 

Throughout this process you must not let the phone or computer go into sleep mode.... and don't disconnect.

 

I had the same issue with the lock screen but it was related to sim card once I did the restore.

 

I had to set the erase from icloud website, but that didn't originally work as it requires connection to the internet for it to apply, hence plugging it into the computer.

 

I accidentally started setting up my phone via the phone and got stuck on the sim card lock screen so had to do it from scratch again and this time via itunes and all good. Hope that helps

Posted on May 26, 2014 6:37 PM

Close
veritylikestea

Q: My devices have been hacked. What do I do?

  • All replies
  • Helpful answers

first Previous Page 21 of 32 last Next

  • by Foaming Draught,

    Foaming Draught Foaming Draught May 27, 2014 6:15 PM in response to veritylikestea
    Level 1 (0 points)
    May 27, 2014 6:15 PM in response to veritylikestea

    Still wondering why I haven't been hacked.  The latest thing which I notice is that I have keychain turned ON on my iPhone, but OFF on my Air. So I have to enter passwords on each device when I change a password on either.

  • by Andrew J,

    Andrew J Andrew J May 27, 2014 6:35 PM in response to youchasing
    Level 3 (790 points)
    May 27, 2014 6:35 PM in response to youchasing

    I'm not sure what happened in your case, but this isn't related, all. The facts are, a hacker has accessed user iCloud accounts somehow. Not devices. It's impossible to ssh into an iPhone or iPad without jailbreaking.

     

    Yours is one massive conspiracy theory and even if were slightly true, more than spurious messages would have happened.

     

    Conspiracy theories aren't helpful in this case.

  • by marumurak,

    marumurak marumurak May 27, 2014 6:43 PM in response to veritylikestea
    Level 1 (0 points)
    May 27, 2014 6:43 PM in response to veritylikestea

    I just posted this on an Australian forum. This is the closest I have come to a possibility. Would be interested on peoples opinions especially those with kids with devices linked to their Apple ID.

     

    The Apple IDs compromised seem to have unblock-us.com as the common denominator. The few that didn't may have visited a WiFi network that had the unblock-us.com DNS set.

    People use this to access BBC iPlayer, Netflix and ABC iView outside the geoblock. Its in the perfect position to intercept the passwords.

    Exactly, hence nearly nobody from the USA got hit. And only a few from other countries most of which had visited here. No doubt they did not like Foxtel's stranglehold on content either.

    A lot of people say they don't let their kids have the Apple ID passwords so they can keep an eye on what they are doing but all it will take is for their kid to go to a friends place that has unblock-us and use their wifi and bang. next time you put in the password you are done.

    I think this is the key

     

    The original idea came from another person on the forum not myself.

     

    Any thoughts?

  • by Foaming Draught,

    Foaming Draught Foaming Draught May 27, 2014 6:56 PM in response to Andrew J
    Level 1 (0 points)
    May 27, 2014 6:56 PM in response to Andrew J

    You're quite right, Andrew J, we should stop thinking about devices. So far as iCloud is concerned, if it helps to rule things out (I have NOT been affected remember):

     

    1.  I have a strong, unique Apple ID password (albeit my ID is the same email address which I use for everything)

    2.  I have 2fa (2 factor authentication) turned on.

     

    I fear that the ABC chap who's just posted will come up with a story about Apple devices rather than looking at how people made their iCloud passwords available to our mate Oleg.

  • by Andrew J,

    Andrew J Andrew J May 27, 2014 7:12 PM in response to marumurak
    Level 3 (790 points)
    May 27, 2014 7:12 PM in response to marumurak

    If you had read back in the thread, you would see affected users saying they have had no relationship with unblock-us. It's been discounted, as has eBay hacked passwords, Telstra and other connections. So far we haven't been able to find a common thread between affected users. My theory is still on people who use the same ID details on other sites or shared Apple accounts between family & friends. So far it has been a small number, so the common denominator may not be obvious.

  • by Andrew J,

    Andrew J Andrew J May 27, 2014 7:16 PM in response to Foaming Draught
    Level 3 (790 points)
    May 27, 2014 7:16 PM in response to Foaming Draught

    I think you're right. Greg Mullers post has been deleted as, if he had read the terms of use, his touting for a media interview is a breach.

     

    To you Greg Muller, if you're trying to sensationalize this as a filler story, you've come to the wrong place. Keep reading though, we might get you a story when we track down the source.

  • by iBenjaminCrowley,

    iBenjaminCrowley iBenjaminCrowley May 27, 2014 7:18 PM in response to veritylikestea
    Level 2 (170 points)
    May 27, 2014 7:18 PM in response to veritylikestea

    Hi veritylikestea,

    This is an issue that has now spread though most  of Australian citizens.

    Here is a letter from the Australian Government:

    Ransom attack targeting Apple products - change your Apple IDpassword: SSO Alert Priority High

     

     

    27 May 2014

    Apple device and Mac users should be aware that they may be targeted by hackers who lock you out of your device before demanding payment of a ransom.

    In recent hours, a number of Australian Apple users have reported the ransom attack targeting their devices.

    The information available is limited and may be updated as more information emerges.

    With the possibility that this attack is linked to your ‘Apple ID’, affected users are advised to change your Apple ID password as soon as possible.

    Users not affected may also consider changing their Apple ID password as a precaution.

    Your Apple ID is your username for everything you do with Apple. It is used for identifying you as a user for most Apple products including iTunes, all your Apple devices, iCloud, the Apple Store and others.

    At present many users are reporting that their phones or systems lock unexpectedly, they receive an email from ‘Find My iPhone’ and a message on their screen stating that their device has been, ‘Hacked by Oleg Pliss’. The message said that to unlock their device they should pay a ransom via PayPal, emailing the payment code to lock404[a]hotmail.com.

    Currently there is only speculation about how the attacks have been carried out. Apple has not yet responded officially.

    Reports by affected users suggest that this attack is possibly the result of hackers compromising the device owner’s Apple ID and using this to access their iCloud account. From their iCloud account a hacker canactivate the device’s ‘Lost Mode’, and possibly reset the phone’s access code.

    It is not confirmed if or how these Apple IDs and passwords were accessed, but suggestions include that hackers may be simply reusing information they may have discovered during a breach of other online services. Unfortunately, many people still commonly reuse the same password for many of their online accounts.

    A hacker with access to your Apple ID can potentially lock any device associated with it remotely, they can see data you have stored in iCloud, access your Apple Store purchases and potentially set up two-step verification (also known as two-factor authentication) on your device, locking you out of your phone completely, and even remotely erase your device.

    It is reported that affected users did not previously have two-step verification enabled on their devices.

    Initial information also suggests that users who already have a passcode set on their device are still able to unlock it, but any users who do not have a passcode set may now encounter a lock code set by the hacker.

    What can you do?

    Do not pay the ransom.

    Change your password for your Apple ID. You can use your Apple ID to recover your device(s) if it has been locked by the hacker.

    You can switch off Lost Mode via iCloud.

    If the hacker has set a new passcode lock on your device, you may be able to bypass this by using one of themethods suggested by Apple, however you should note these involve either erasing, resetting, or restoring your device from back up (if you have one).

    Set up two-step verification for your Apple ID. Turning on two-step verification reduces the possibility of someone accessing or making unauthorised changes to your account information. Two-step verification requires both your password and a separate verification code sent to your phone (or other trusted device) in order to log in.

    Affected users should contact Apple directly for more information. Apple has been able to help affected users recover their devices.

    More specific advice may be provided by Apple shortly.

  • by marumurak,

    marumurak marumurak May 27, 2014 7:30 PM in response to Andrew J
    Level 1 (0 points)
    May 27, 2014 7:30 PM in response to Andrew J

    thats the thing Andrew, you dont have to have a relationship with Unblock-us. All you have to do is visit a friends house who does and use their wifi. You seem to have made yourself the resident expert in this thread yet you shoot possibilities down without thinking them through properly. How about you leave it to others who are more IT literate than yourself to comment.

  • by Andrew J,

    Andrew J Andrew J May 27, 2014 7:43 PM in response to marumurak
    Level 3 (790 points)
    May 27, 2014 7:43 PM in response to marumurak

    That's fine, shoot the messenger, I don't mind, but have YOU thought it through?

     

    IF. Unblock us is the cause, then each and every user would have had to type in their Apple IDs & passwords whilst being connected to the VPN service. Btw, unblock us use an IP routing service as well as a VPN service.

     

    Now, given these things, Apple data between device and server is encrypted. How then is that encryption broken?

     

    Apple devices have all data sandboxed from third party systems, so how then has an VPN service been able to bypass the sandbox?

     

    I have thought it through. Yours the one who hasn't.

  • by rvolkov,

    rvolkov rvolkov May 27, 2014 8:23 PM in response to veritylikestea
    Level 1 (0 points)
    May 27, 2014 8:23 PM in response to veritylikestea

    Let collect somewhere information together to understand trends.

    My information:

    4 Apple devices on one Apple ID account (macbook, iphone #1, iphone #2, ipad). Find My Phone enabled.

     

    iphone #1 was bought into UK 4 years ago and activated overseas - no attempts to lock it

    iphone #2 was bought in Sydney and activated in Australia  1.5 years ago and was hacked and locked

    ipad was bought in the USA and activated overseas (5 years ago) - no attempts to hack it

    macbook was bought in USA and activated in Australia less than year ago - was attempt to lock it

     

    So I clearly see that devices which were hacked are not connected to Apple ID and password. Even if hacker had access to my Apple ID, he locked only devices which were activated in Australia. Devices on this Apple account which were activated overseas were not locked.

     

    Becase it was a massive attack, they couldn't use manual access... Looks like they use some script and used list of devices to do it.

    My personal opinion - may be Apple API was hacked and hacker didn't actually had passwords?

  • by 007Aston,

    007Aston 007Aston May 27, 2014 8:20 PM in response to veritylikestea
    Level 1 (0 points)
    May 27, 2014 8:20 PM in response to veritylikestea

    For what it's worth, this article

    Apple iCloud and Activation Lock Hacked; Allows Hackers to Unlock Stolen Devices,  dated 21 May 2014

    claims

    "This is the first time when any hacker group has managed to compromise the highly secured Apple’s iCloud service."

    http://thehackernews.com/2014/05/apple-icloud-and-activation-lock-hacked.html

  • by marumurak,

    marumurak marumurak May 27, 2014 8:32 PM in response to veritylikestea
    Level 1 (0 points)
    May 27, 2014 8:32 PM in response to veritylikestea

    Ok RVolkov, thats good information. The Macbook and Iphone that were hacked, were they activated on the same network? If so did that network use geoblocking? Did you go anywhere with a wifi network you hooked onto with geoblocking such as Unblock-us? Have you used the other devices that were not hacked on the same networks in Australia (wifi or ethernet)?

  • by Andrew J,

    Andrew J Andrew J May 27, 2014 8:33 PM in response to 007Aston
    Level 3 (790 points)
    May 27, 2014 8:33 PM in response to 007Aston

    This is a bypass hack for stolen devices, where they can be restored and activated without going through the iCloud activation setup.

     

    It's totally different to this particular situation.

  • by rvolkov,

    rvolkov rvolkov May 27, 2014 8:42 PM in response to marumurak
    Level 1 (0 points)
    May 27, 2014 8:42 PM in response to marumurak

    To marumurak:

    no, iphone was activated into home network, but macbook was activated in work network (our corporate network doesn't have connection to internet in Australia, it connected to USA via VPN and has Internet gateway there).

    All my devices are working in my home wifi and in work network both, so devices which were not hacked also work in both these networks.

    Also I travelled a lot in different countries during last several years and used there 2 my devices in different places - hotel wifi, restaurant wifi and so on. I used both devices - iphone which was not hacked and macbook which had lock attempt.

    Never used something like unblock or other strange things - very common list of software, mostly for office/email work.

  • by veritylikestea,

    veritylikestea veritylikestea May 27, 2014 8:37 PM in response to iBenjaminCrowley
    Level 1 (1 points)
    May 27, 2014 8:37 PM in response to iBenjaminCrowley

    Thank you for that Benjamin - glad to see there's something like that out there.

     

    I only just got around to resetting my appleID after it was disabled by Apple... Very tedious...

     

    I've gone through all my passwords - thank god for eWallet is all I can say - and although I have been a bit lax with some security I had recently changed a bunch of stuff thanks to heartbleed my appleID was not unique and also a very old password. That's been remedied now.

     

    Re common denominators: eBay is definitely not a factor for me; I occasionally watch things on ABC iView on my iPad/phone but have never streamed anything via unblock.us or used a VPN to the best of my knowledge (but I don't really understand the layers of servers and things so I don't think I can really say?). Generally I only make use of our private wifi at home, very rarely at my local library, although I think over the weekend I was connected to a public wifi while I was out somewhere - at fed square maybe? I can't quite remember.

     

    All our devices are acquired new, purchased either directly from Apple (iPad) or under contract from a carrier (Telstra, Vodafone). I have never shared my AppleID with anyone.

     

    It all seems rather confusing.

first Previous Page 21 of 32 last Next