iPhone and iPad 'ransom' attack was not caused by iCloud hack, says Apple

An iPhone: some users in Australia and elsewhere have had 'ransom' demands after their phones were remotely locked by a hacker. Photograph: Steve Parsons/PA

Apple says iPhone and iPad users whose devices were remotely locked with a ransom demand were victims of a phishing attack, not a hack of its iCloud servers.

A number of iPhone and iPad owners in Australia and the UK said on Tuesday that they had woken up to find their phones or tablets displaying a message saying that it had been hacked and that they should send AU$100 (£55) via PayPal to a Hotmail address, lock404@hotmail.com, to have it unlocked.

But affected users were warned not to pay the ransom. PayPal said that there was no account connected to the account, but that it would refund anyone who had sent money.

The hacker gained access to the owners' iCloud accounts - which are linked to every iPhone and iPad - and turned on the 'Find my iPhone' setting, which can be configured to remotely lock the device with a passcode if the owner hasn't already set it.

David Emm, from the global research and analysis team at digital security firm Kaspersky Lab, said: 'It seems likely that cybercriminals gained access to Apple ID credentials, for example by using phishing emails targeting Apple IDs.

'Such scams have been around for years,' Emm said. 'By using the credentials to access an Apple iCloud account, the attackers can enable the 'Find My iPhone' service - this is not only able to locate a lost or stolen device, but also to set a passcode preventing third parties from accessing the personal data stored on the smartphone.

'This is clearly a form of ransomware, previously only seen on PC and, recently, on Android devices - although in those cases malware was used to trigger this behaviour. This campaign is further proof that cybercriminals are adopting criminal business models developed for the PC, applying them to new areas and fine-tuning their methods.'

But while the hacker was able to lock the devices via the iCloud interface, anyone who had already set a security passcode to prevent access to it was able to unlock it using that passcode. Those who had not set a passcode could reset their device by connecting it to a computer and restoring it from an iCloud backup.

Nor could the hacker change their iCloud passwords, which requires answering a number of security questions that only the user would know.

Apple said in a statement: 'Apple takes security very seriously and iCloud was not compromised during this incident. Impacted users should change their Apple ID password as soon as possible and avoid using the same user name and password for multiple services. Any users who need additional help can contact AppleCare or visit their local Apple Retail Store.'

The company did not say how many people were thought to be affected.

The fact that almost all of the affected users were in Australia - with only a handful reported outside it - points to a phishing scam, in which people are led to a fake site by an email or web link, and encouraged to enter their details in the belief that they are logging in to the real site.

A discussion thread on Apple's support forums about the attack found no obvious common source of the attack between affected users. Not all had eBay accounts - ruling out the possibility that the attack on the auction site earlier this year had somehow been used for the exploit.

* Apple plans to ramp up smart home competition with Google