Apple issues iCloud security alert


Published: Wednesday 22nd October 2014 by The News Editor

Comments (0)

Apple has posted a new security warning for users of its iCloud online storage service amid reports of a determined effort to steal passwords and other data from people who use the service in China.

“We’re aware of intermittent organised network attacks using insecure certificates to obtain user information and we take this very seriously,” the computer-maker said on its support website. The post said Apple’s own servers were not compromised.

Apple’s post did not mention China or provide any details on the attacks. But several news reports that some Chinese internet users have begun seeing warnings that indicate they had been diverted to an unauthorised website when they attempted to sign into their iCloud accounts.

That kind of diversion, known to computer security experts as a “man in the middle” attack, could allow a third party to copy and steal the passwords that users enter when they think they are signing into Apple’s service. Hackers could then use the passwords to collect other data from the users’ accounts.

Chinese activists blamed the attacks on the country’s government, according to reports and Chinese activist website, which suggested the campaign was spurred by the fact that Apple recently began selling its newest iPhone models, the iPhone 6 and 6 Plus, in China. The new smartphones have software with enhanced encryption features to protect Apple users’ data.

Apple, based in Cupertino, California, said the attacks had not affected users who signed into iCloud from their iPhones or iPads, or on Mac computers while using the latest Mac operating system and Apple’s Safari browser.

But the company suggested users should verify they were connecting to a legitimate iCloud server by using the security features built into Safari and other browsers such as Firefox and Google’s Chrome. The browsers will show a message that warns users when they are connecting to a site that does not have a digital certificate verifying that it is authentic.

“If users get an invalid certificate warning in their browser while visiting, they should pay attention to the warning and not proceed,” Apple said.

The attacks appear unrelated to an episode last month in which hackers stole nude photos from the iCloud accounts of several US celebrities. In that case, Apple said its investigation concluded the hackers had obtained the users’ passwords through so-called “phishing attacks” or by guessing at the answers to security questions that allowed access. The company said its servers were not breached in that case.

Published: Wednesday 22nd October 2014 by The News Editor

Comments (0)

Local business search