A number of iOS devices are being held ransom by the Russian “Oleg Pliss,” who is demanding a payment of $100 to unlock the device
Stolen iCloud passwords reportedly are the basis for the hack, which also uses the “locate device” feature to lock the device and display a message to the affected user.
According to Apple, the latest LinkedIn data leak and/or possibly users affected by phishing attacks are responsible for the passwords breach. Beyond all the finger pointing and “he started it!” accusations, estimates are that perhaps 40 million devices in the United States, Europe and Australia have been affected. But sources also suggest that these numbers may be blown out of proportion. However, for this kind of attack to appear the radar, a good hundred thousand victims would have to have been affected.
This not a new type of scam; since February, similar scams reportedly have been affecting Apple’s line of devices.
In May 2014, cybercriminals targeted a large number of Australian Apple’s iCloud users with a similar attack. The attackers allegedly hijacked Apple’s Find My iPhone feature, remotely locking iOS and Mac devices and sending messages demanding ransom money.
The attack normally happens when the actor uses an iCloud password to locate and trigger the “locate device” feature and then can display a message and cause the device to make sounds to grab the users attention. The message normally tells the victim to order the password by mailing to the given e-mail address.
Most of the passwords come from numerous data breaches that occurred over the time, including iMesh , VK.comMySpace, , Badoo.com, HotScripts.com, Mac-Forums.com and phishing attacks.
The Mac-Forums leaked database is reportedly available for approximately $755, while HotScripts has a database allegedly selling for $1900.
Apple has issued support for users, and experts suggest using a unique password only for the Apple ID as well as two-factor authentication and two-step verification process.
About the Author: Joshua Bahirvani
Cyber Security Enthusiast and believer of Privacy in this Digital Age.
LinkedIn : https://in.linkedin.com/in/jbahirvani15
Peerlyst: https://www.peerlyst.com/users/joshua-bahirvani
Twitter : @B15joshua
Edited by Pierluigi Paganini
(Security Affairs – ios-devices, scam)
Share On
