iCloud hacked, macbook locked ransomware

Question

iCloud hacked, macbook locked ransomware

Hello, I have a MacBook Pro mid-2014. 2 Months ago, someone got into my iCloud account which didn't have two-factor authentication enabled. They locked my MacBook Pro and attempted to lock my iPhone. That never happened to me and I thought it was going to be as easy as recovering my iCloud account and disabling the lost mode but it turns out that I can not disable the lost mode even though I recovered my iCloud account that locked it and I have the MacBook. When I try to boot up the computer I must enter a 6-digit passcode that has been set when my iCloud got compromised. The hacker who did this left a message saying: “write to email: help.apple.us@gmail.com” after contacting that email it responds asking for 50$ in bitcoins. I went to my local apple store and they told me that I can’t unlock it because I don’t have the original receipt. I tried contacting the person who sold it to me 3 years ago but they are unreachable. I had multiple calls with apple care but they seem to be stuck on a piece of paper. Is there anything I can do to prove that I am the owner of my MacBook? I am desperate at this point I can’t believe that I can’t unlock my own MacBook and that apple only cares about the receipt. I understand the concern about the security but it doesn’t make sense in this case because they know that my iCloud got compromised they sent me an email about an unusual login 2 minutes before my password gets changed and my devices get locked and clearly this isn’t a message from the previous owner because when you google the email that’s been left in the message it’s a ransom email that’s used against multiple other users in different countries. It’s really messed up that a security feature that’s supposed to protect me is used against me and apple doesn’t help me with this issue.

MacBook Pro, macOS Sierra (10.12)

Posted on Aug 12, 2017 9:19 PM

Reply

Answer 1

JelenaI

Level 1

32 points

Aug 13, 2017 6:14 PM in response to LACAllen

And you think it is ok? APPLE made us to use those Icloud accounts and everything else, if we had an pc we would never have this problems.And what about so many countries where you can buy officially from your mobile provider apple divice and at the same time you dont have official apple store ( serbia in europe is perfect example)?

It is not fair, it is not logical and it is just crazy

If i can log into my icloud, see my device but I can not actually use my device what is it?

apple id hacked, Imac locked, ransom

Reply

Answer 2

Aug 13, 2017 9:33 AM in response to zinacef

I understand that but the thing is to lock my macbook with my icloud account you didnt need that receipt but to unlock it you need it. I dont want them to unlock the computer and give me access to everything just remove the firmware lock that has been set with my own icloud account. I know my computers password but i can't even enter it because of the icloud lock. The original receipt protocole is a security measure but at some point you need to use common sense.

Reply

Answer 3

LACAllen

Level 8

43,500 points

Aug 13, 2017 12:25 PM in response to Community User

I dont want them to unlock the computer and give me access to everything just remove the firmware lock that has been set with my own icloud account.

That's exactly what you're asking Apple to do. The firmware password prevents access to the boot process.

To have done this, you had Find My Mac enabled on the Mac, did not have your own firmware password in place, plus they knew your Apple ID and password.

There was no iCloud account compromise. You still have full control over your iCloud account, correct?

You call it a piece of paper, but it serves to establish the rightful owner.

Reply

Answer 4

Aug 13, 2017 3:41 PM in response to Eric Root

Thats not an option i got pictures, school projects on it i need my computer. I just need to be able to disable the lost mode so that i can login into my computer. I Have my user password, my icloud account that set it to lost mode, the physical macbook what else do i need to prove that its mine.

Reply

Answer 5

LACAllen

Level 8

43,500 points

Aug 13, 2017 5:05 PM in response to Community User

I'm afraid the reality is my friend...

you will not be able to access that hard drive until you either give it the firmware password, or Apple unlocks it for you.

You originally said you did not have 2FA on the account. That can't be accurate, as this exploit only happens when your password is known, Find My Mac is enabled in the iCloud settings for your Mac, you have 2FA on the Apple ID and you don't already have a firmware password in place.

This combination of events is what allowed them to lock your Mac.

Reply

Answer 6

Aug 13, 2017 5:13 PM in response to LACAllen

When the hacker got into my iCloud account, it was connected to my MacBook through find my iPhone that's how they put it in lost mode and set a passcode on it. The code that I need to enter and that I referred to as firmware passcode is the code that you set when you put a device into lost mode. My device was set it into lost mode with my own iCloud account but there is no way to put it out of lost mode. That's my problem. When contacting Apple they requested the original receipt as I said in my first post I bought this MacBook second hand from someone 3 years ago. When you open the MacBook you are welcomed with a gray screen that has an input for 6 numbers and a message saying to contact the fake apple email ("help.apple.us@gmail"). All I'm asking is that someone with common sense at apple sees this thread and realizes that their own security feature designed to protect their customers are being used against them for a ransom. If it's not possible to unlock the mac, at least give me the option to disable lost mode with the SAME iCloud Account that locked it.

Reply

Answer 7

LACAllen

Level 8

43,500 points

Aug 13, 2017 5:36 PM in response to Community User

I understand exactly what happened. I've explained it to you twice.

Common sense does not apply to establishing ownership.

The security feature works as designed. They compromised your password. That's why you lost access to your MacBook.

What you seem to not accept is that your account and your device are 2 separate things.

Proving ownership of one does not in any way prove ownership of the other.

You have not lost control of your iCloud account, correct? You did not answer the last time I asked.

Reply

Answer 8

Aug 13, 2017 5:48 PM in response to LACAllen

I received an email saying that my apple id was used to sign in to iCloud via web browser, then lost mode has been enabled and my MacBook pro has been locked. I then immediately changed the password and added two step verification on the iCloud account. I have emails from apple to prove this.

Reply

Answer 9

LACAllen

Level 8

43,500 points

Aug 13, 2017 5:58 PM in response to Community User

I received an email saying that my apple id was used to sign in to iCloud via web browser,

Proving that they knew your password.

then lost mode has been enabled and my MacBook pro has been locked.

Proving that they knew your password.

Also proving that Find My Mac was enabled on the MacBook and you didn't already have a firmware password in place.

I have emails from apple to prove this.

I'm sure you do. And again... this proves ownership of the account signed in to a device, not the device itself. Not my rule, Apple's.

What would you like to be told from us here? We can't help you.

Your *only* option is for Apple to unlock your hard drive. Nobody has disputed with you what caused this. It is very clear. Someone, using your Apple ID and password did this.

Coming back here to make your point over and over does you no good.

It is absolutely unfair that this happened to you. But it did happen.

Reply

Answer 10

Aug 21, 2017 11:17 AM in response to Community User

Did you already try to completely drain your Macbook's battery? I've had the same issue yesterday and just pulled out the power plug, left the screen open and waited untill the battery was completely empty. After that your Mac shuts down itself. Just wait a little bit more to be sure. Then plug in the power cable and restart your Mac. This did the trick for me.

Reply

Answer 11

chuesei

Level 1

4 points

Aug 31, 2017 11:13 AM in response to ronniedege

Recently I had the same problem, but they were able to lock almost all my apple devices, the iMac, a couple of iPad and the Macbook. when I tried to restart the Mac I ,ve got a message asking me to type an unknown password. I went to my apple support point with the receipt and they were able to recover my iMac, fortunately I've got time machine on before and I didn't loose any data. The only "but" was that I have to pay an extra to apple for unlocking the firmware password. If I prove that I'm the right owner Why should I have paid an extra for unlocking the machine??

the apple reseller told me that they have to send this petition to apple (US) and it has a cost and that apple (US) attend this petition just once

Unbelieveable!!!

Reply

Answer 12

zinacef

Level 10

88,473 points

Aug 13, 2017 9:28 AM in response to Community User

If you don't have the original purchase receipt, then you will not be able to proceed further with Apple Support help at the store.

Reply

Answer 13

Aug 13, 2017 1:12 PM in response to LACAllen

With this firmware lock i can't even enter my user password, and with my icloud account i cant turn off the lost mode what am i supposed to do throw my acbook pro away?

Reply