Apple issues security warning for iCloud

Apple has posted a new security warning for users of its iCloud online storage service amid reports of a concerted effort to steal passwords and other data from people who use the popular service in China.

"We're aware of intermittent organized network using insecure certificates to obtain , and we take this very seriously," the computer-maker said in a post Tuesday on its support website. The post said Apple's own servers have not been compromised.

Apple's post did not mention China or provide any details on the attacks. But several news outlets reported Tuesday that some Chinese Internet users have begun seeing warnings that indicate they had been diverted to an unauthorized website when they attempted to sign into their iCloud accounts.

That kind of diversion, known to experts as a "man in the middle" attack, could allow a third party to copy and steal the passwords that users enter when they think they are signing into Apple's service. Hackers could then use the passwords to collect other data from the users' accounts.

Chinese activists blamed the attacks on that country's government, according to news reports and the Chinese activist website GreatFire.org, which suggested the campaign was spurred by the fact that Apple recently began selling its newest iPhone models, the iPhone 6 and 6 Plus, in China. The new smartphones have software with enhanced encryption features to protect Apple users' data.

Apple, which is based in Cupertino, California, said in its post that the attacks have not affected users who sign into iCloud from their iPhones or iPads, or on Mac computers while using the latest Mac operating system and Apple's Safari browser. But the company suggested users should verify they are connecting to a legitimate iCloud server by using the security features built into Safari and other browsers such as Firefox and Google's Chrome. The browsers will show a message that warns users when they are connecting to a site that doesn't have a digital certificate verifying that it is authentic.

"If users get an invalid certificate warning in their browser while visiting www.icloud.com , they should pay attention to the warning and not proceed," Apple said in the post.

The attacks appear unrelated to an episode last month in which hackers stole nude photos from the iCloud accounts of several U.S. celebrities. In that case, Apple said its investigation concluded the hackers had obtained the users' passwords through so-called "phishing attacks" or by guessing at the answers to security questions that allowed access. The company said its servers were not breached in that case.


Explore further

Apple sees iCloud attacks; China hack reported

More information: Apple post: support.apple.com/kb/HT6550

© 2014 The Associated Press. All rights reserved.

Citation: Apple issues security warning for iCloud (2014, October 22) retrieved 19 August 2019 from https://phys.org/news/2014-10-apple-issues-icloud.html
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.
0 shares

Feedback to editors

User comments

Oct 22, 2014
It could be the Chinese government or it might just be the usual criminals. Governments around the world have shown a willingness to allow their security services to do whatever they want, ignoring any theoretical legal or constitutional nonsense that gets in the way.

China is a more locked down society that some but that distinction is becoming less obvious, as the Chinese gain freedoms and the others lose some.

No online service is immune from compromise when there are so many stages between the user and the service to attack. Keyloggers on the user's PC, unknown holes in Windows, buggy Internet standards, broken key authentication or just asking the user forcefully to disclose the logon credentials are some of the many weak points.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more