Anonymous Hacker Exploits Security Flaw In Apple's iCloud

On Wednesday an anonymous hacker was reportedly able to exploit an iCloud security flaw. The hacker, who reportedly goes by the handle AquaXetine, told Cult of Mac via email that Apple had contacted him after he discovered the security flaw.

'They have asked me to contact [them] as quickly as possible, but why now?' AquaXetine said in the email. 'I've already warned Apple couple months ago.' Cult of Mac has reportedly confirmed that the email did in fact come from Apple.

The site also reported that this hack is the first of its kind as it is able to bypass iCloud security systems on locked iOS devices. By utilizing the free DoulCi site, which Cult of Mac reported was down on Wednesday but back up on Thursday morning, a locked iOS device's Activation Lock could be tricked into thinking that it is 'talking to Apple's iCloud servers when connected to a computer.'

Activation Lock is a mechanism that can prevent a thief from resetting and wiping a stolen iOS device without entering the actual owner's Apple ID and password. This is meant to be a form of anti-theft to discourage thieves from stealing and resetting iPhones.

Ubergizmo noted, 'So far the feature has been met with praise, with government officials and lawmakers commending Apple on their efforts. However it seems that no system is without its flaws.'

AquaXetine along with another hacker who goes by the name MerruckTechnolog have denied that they exploited an SSL bug.

MacRumors.com had tweeted 'Hacker Team Claims Compromise of Apple's iCloud and Activation Lock, Possibly via SSL Bug.' AquaXetine responded, '@MacRumors @kellyhodgkins lol ssl bug ? No xD.'

The hackers had reportedly reached out to Apple in March, but received no word, and this prompted them to go public with their findings. They used a dummy computer and were able to trick an iPhone into thinking it was Apple's servers, which reversed the effects of the Activation Lock.

Apple has not commented on the issue.

'The Apple iPhone/iCloud exploit looks pretty serious in that it undermines a key Apple feature that allows customers to lock down iPhones that have been lost or stolen,' Charles King, principal analyst at Pund-IT, told redOrbit. 'Unless it's addressed/repaired quickly, the flaw will probably make iPhones more attractive to thieves which is not a rep any handset maker wants in current circumstances.

'It does shed light on the overall security of cloud-enabled services and processes, especially since many people are arguing that a similar anti-theft function be required for all phones,' added King. 'Ironically, Apple's woes could serve to bolster anti-theft legislation since proponents could argue that it proves individual vendor efforts are too easily circumvented.'

Meanwhile, according to security researcher Mark Loman of SurfRight, who reportedly spoke to Apple Insider, an attack on iCloud was made possible because the Windows version of iTunes did not properly verify security certificates.

This particular hack was disclosed on the Dutch technology website Tweakers.net. It also suggests that the cloud be an all too easy target for hackers.

'The cloud offers a contemporary variation on Willie Sutton's famous quip that he robbed banks 'because that's where the money is,'' said Pund-IT's King. 'What's different today, of course, is that cyber thieves can orchestrate their schemes without ever stepping into a bank. As more and more financial transactions move to the web, the cloud is becoming the new branch office for consumers, businesses and criminals alike.'

For its part, Apple had recently patched a similar vulnerability in OS X and iOS, but Apple Insider reported that iTunes on Windows remained susceptible and Loman called this issue, 'either a beginner's mistake, or it was done on purpose.' He alleged that it could have even been designed to allow intelligence agencies to access iCloud.

Until Apple addresses these issues users are advised not to use Apple's iCloud services via public Wi-Fi networks, and those with older iOS devices - which may not receive software updates and could include the iPhone 3GS or the first generation iPad - are also advised to exercise particular caution as this vulnerability cannot be patched in those devices.

Perhaps it is a sly way of Apple saying it's time for an update!

Source: Peter Suciu for redOrbit.com - Your Universe Online