Your iCloud Account Can Easily Be Hacked With a Little Info and a Call to Apple

Posted August 7, 2012 at 1:08am by iClarified | Please help us and submit a translation by clicking here | 48451 views

Wired's Mat Honan has posted a lengthy report on how his iCloud account was recently hacked by a simple, and easily duplicated, phone call to Apple.

It turns out that all you need is a billing address and the last four digits of a credit card to get Apple to reset an account password, and these details are easier to obtain than you might think.

Apple tech support confirmed to me twice over the weekend that all you need to access someone's AppleID is the associated e-mail address, a credit card number, the billing address, and the last four digits of a credit card on file. I was very clear about this. During my second tech support call to AppleCare, the representative confirmed this to me. "That's really all you have to have to verify something with us," he said.

Apple spokesperson Natalie Kerris told Wired, "Apple takes customer privacy seriously and requires multiple forms of verification before resetting an Apple ID password. In this particular case, the customer's data was compromised by a person who had acquired personal information about the customer. In addition, we found that our own internal policies were not followed completely. We are reviewing all of our processes for resetting account passwords to ensure our customers' data is protected."

Today, Wired tried to use the hacker's technique themselves. They were successful.

Briefly, here's how the hacker was successful in this case. At Honan's website he found his gmail address. Using gmail's password recovery page he was shown enough of his @me.com address to decipher the full username. Then Honan's billing address was found via a whois of his website's domain. The hacker then contacted Amazon and added a fake credit card to Honan's account. Next the hacker contacted Amazon again and added a new email address to the account using the fake credit card as authorization. Using the new email account he requested a password reset and gained access to see the last four digits of all cards on file. Finally, the hacker called Apple with the email address, billing address, and last four digits of the credit card to have Apple support reset the password.

While this may seem a bit lengthy of a procedure, a delivery person could do the same without going through any of those hoops.

You can find the full story at the link below...

Read More


Share
Add Comment
jerome moral - March 14, 2014 at 2:39pm
sir plss help me .. my iphone 4s needs to bypass to icloud activation.. i forgot my apple id and password.. i'm seconhand user sir.. GB.
Anna Groth - July 26, 2014 at 12:56pm
I bypass the iCloud activation screen lock on my iPhone 5c whit the hack tool from this page www.bypassicloudactivationlock.net . Good luck
Dicky - January 17, 2014 at 6:56am
i could made, it possibility to broke, that it not the purpose, to make moore perfect technology for any corporation who claimed them best one
James hoyland - August 22, 2012 at 5:25am
ALL THIS HACKING IS A LOAD OF BOLLOX AND THESE HACKERS ARE FAKE AS FUCK AND WEAK AS FUCK THEY THINK THEY KNOW EVERYBODY'S ACCOUNT PASSWORDS WHEN THEY DON'T PLUS THEY ASLO THINK THERE BIG AND HARD AND BETTER THAN EVERYBODY ELSE BUT THEIR NOT THIS FAKE HACKIN HAS GOT TO STOP AND IT STOPS RIGHT NOW BEFORE SOMEONE CALLS THE POLICE AND TRACKS DOWN WHO THE HACKERS ARE ABD THEY WILL ARREST THEM AND PUT THEM IN JAIL TILL THEY LEARN THEIR LESSON.
Russell - August 8, 2012 at 8:05pm
Sounds like it was Apple's fault for using the last 4 digits as verification. Everybody knows the last 4 are visible on nearly every receipt generated, brick & mortar and online.
Samsung=Shiite - August 7, 2012 at 2:46am
This is BS... He wasn't hacked -- more likely phished...
5 More Comments
Follow iClarified
LinkedIn App Gets Updated With Redesigned User Profiles
LinkedIn has updated its app for iPhone and i...
Ryan Petrich Releases Biggest Update to Activator in Over a Year
Ryan Petrich has released Activator 1.9, the ...
Apple Files Motion to Drop Cross-Appeal In Its First California Case Against Samsung
New NPR One App Offers Curated Stream of Public Radio News
NPR has released NPR One, a new app for iPhon...
Facebook is Removing Messenging From Its Main App, Forcing Users to Download Facebook Messenger