A gang of thieves caught stealing iPhones in Brazil was able to access user accounts and iCloud Keychain data simply by swapping the SIM card from a stolen, unlocked device to another phone and looking up the user's email address online, a new report has revealed.
Folha De S.Paulo reports on a recently-caught gang who specialized in "hacking bank accounts after the theft of mobile phones" in late 2020. The report says that one of the criminals boasted to police they could unlock "all models of iPhone" from the iPhone 5 right up to the iPhone 11. (The iPhone 12 hadn't been released in Brazil at the time)
Whilst it had been postulated the gang was using some crazy hacking tool or system to access devices, it had actually found a very simple way to bypass iCloud security with worrying ease:
According to Barber, to get the devices unlocked, he removed the chip from the stolen device and insert it into another unlocked device. Then, he started doing searches on social networks (especially Facebook and Instagram) to find out which account was linked to that line number. Then, he went to search for the email address that the victim used to back up the contents of the device, especially in clouds iCloud and Google Drive, first searched for extensions @gmail.com.
- Translated
The report says the criminals were seemingly able to restore new phones from an iCloud backup, using the phone number attached to the SIM card to reset the Apple ID, and would then scour the device for password information stored in an app likes Notes, or within iCloud Keychain for something like credentials for a banking app.
The report says 12 people were arrested last year as part of the scheme, with another 28 identified as members, it describes how "young men on bicycles" would steal phones from pedestrians, switching the phone to camera mode to stop the iPhone from locking and turning on airplane mode to stop the device being tracked.
This explains how the criminals were able to also bypass basic iOS security measures like Touch ID and Face ID, as well as the alphanumeric password protection usually required to unlock a device for use, and is a key reminder as to how important it is to use the password protection built into iOS to secure your device physically:
Whilst the exploit requires physical access to an unlocked iPhone, snatching the phones from the hands of unsuspecting pedestrians using them at the time meant this was fairly easy to achieve for the gang. It is also a reminder as to why many recommend using some of the best password manager apps to further secure information held on devices like the iPhone.
You can read the full report here.
England reached the Euro 2020 final but Apple TV users didn't see it happen
Yesterday saw England reach the final of Euro 2020 and while many were cheering along in front of their TVs, others were left exasperated after an ITV Hub technical issue meant they couldn't watch the action. Chunks of the second half were missed by those watching on Apple TV boxes — and they were not happy about it.
https://ift.tt/3wqZaiQ
Tidak ada komentar:
Posting Komentar