Wednesday, May 21, 2014, 03:36 pm PT (06:36 pm ET)
Hackers claim to have exploit for iCloud, use vulnerability to disable Activation LockA group of hackers calling themselves "Team DoulCi" say that they have figured out a way to execute a man-in-the-middle attack that gives them the ability to intercept users' Apple ID credentials as well as unlock iOS devices that have been made unusable by Activation Lock.
The attack is made possible because the Windows version of iTunes does not properly verify security certificates, according to security researcher Mark Loman of SurfRight. The disclosure was first made on Dutch technology website Tweakers.net.
The hackers, who are not affiliated with Loman, have demonstrated the attack's efficacy by sharing screenshots of what they say are calls to Apple's iCloud activation service. A number of others have chimed in on social media with similar success stories.
Apple recently patched a similar vulnerability in OS X and iOS, but iTunes on Windows remains susceptible. Loman believes that the issue is "either a beginner's mistake, or it was done on purpose" and alleges that it may have been designed to allow intelligence agencies access to iCloud.
Until Apple issues a fix, users are advised not to use iCloud services over public Wi-Fi networks. Users of older iOS devices that no longer receive software updates, such as the first-generation iPad and iPhone 3GS, should exercise particular caution as the vulnerability cannot be patched in those devices.
On Topic: iPhone
- Reservations for Apple's iPhone 6, 6 Plus in China reportedly hit 2 million in first 6 hours
- Verizon will not throttle unlimited 4G LTE data users, to double data plans in promotion
- Horsepower of Apple's A8 & iPhone 6 extend iOS's gaming lead over Android's Google Play
- Despite faster A8, higher pixel count of iPhone 6 Plus drives lower FPS benchmarks
- Apple's iPhone 6 to arrive in China on Oct. 17 after receiving regulatory license [u]