New iCloud Threat Revealed

Following the reports of a concerted effort to steal passwords and other sensitive information from people using iCloud in China, Apple has recently issued a new security warning for users of its popular online storage service.

Apple posted an announcement a few days ago on its support website, saying that the company is aware of intermittent organized network attacks that uses insecure certificates to obtain user data. Apple specialists claim to take it very seriously and assure that Apple’s own servers had not been compromised. In the meantime, this particular announcement didn’t mention China or give any details on the recent attacks. At the same time, the reports were that some Chinese Internet users saw warnings saying they had been diverted to an unauthorized website when they tried to sign into their own iCloud accounts.

Such attack, normally referred to as a “man in the middle”, may enable a 3rd party to copy and steal the passwords entered by the users when they believe they are signing into Apple’s service. The intruders could then use the data received to steal other information from the users’ accounts.

In respond, Chinese activists blamed the attacks on that country’s government. Local media reports suggested the campaign was spurred by the fact that the tech giant recently began selling its newest iPhone models in China, which have software with enhanced encryption features to protect users’ information.

According to security specialists, the attacks hadn’t affected those users who signed into iCloud from their iPhones or iPads, or on Mac computers while using the latest Mac OS and Safari browser. However, Apple suggested that users should make sure they were connecting to a legitimate iCloud server. This can be done using the security features built into Safari and other browsers like Firefox and Chrome. Those browsers will display a message warning people they are connecting to the website lacking a digital certificate that verifies that it is authentic. In other words, if users visit www.icloud.com and get an invalid certificate warning in their browser, they are recommended to pay attention to the warning and not proceed.

Apple also pointed out that the attacks appear unrelated to a September incident, where hackers stole nude photos of a number of American female celebrities from the iCloud accounts. At the time, the company claimed that the hackers had obtained the users’ passwords via so-called “phishing attacks” or by guessing at the answers to security questions which allowed access. Apple maintained that its servers were not breached in that case.

Source: Extratorrent