Is Apple doing anything about iCloud breach?!

Unfortunately, Apple has not acknowledged the supposed hack into the iCloud systems, and rarely comments publicly on such matters, so we’ll just have to hope they are working towards protecting users’ accounts. The incursion was claimed by two hackers going by the handles AquaXetine and MerrukTechnolog, who form Team DoulCi (derived by spelling “iCloud” backwards-ish). The hack exploits an iCloud security flaw that allows someone to bypass Apple’s Activation Lock system to unlock a lost or stolen iPhone. By utilizing the DoulCi web site, and making a simple change to a file on your computer, the iPhone can be fooled into thinking DoulCi’s site is actually Apple’s iCloud servers.

The procedure isn’t ‘perfect’, however, as bypassing the Activation Lock leaves the phone’s SIM card unreadable. Presumably, if you were just going to put a new SIM in, it would be fine, although I didn’t find any confirmation of that. Regardless, the DoulCi team says they have a fix for the SIM card issue, unless Apple fixes the problem, which may require an iOS update. According to comments on Cult of Mac by security researcher and iOS hacker Steven De Franco;

“[He] described the bypass as a “man-in-the-middle attack,” which means that it intercepts traffic going between a device and Apple’s servers. “It seems like it’s a firmware-related bug,” said De Franco in an interview with Cult of Mac. “So it would require a new update [from Apple] to patch it.””

The DoulCi team reported the exploit to Apple in March, but only recently reached out to AquaXetine about the matter which he seems to have ignored. The hacking team claims that this is not about personal gain, but as a notice to Apple to fix the problem.

As reported by the site ValueWalk, which translated the original Dutch article about the hack;

“Chinese traders buy locked Apple devices on eBay for $50 to $150 each. The hackers are then able to unlock the devices even though Apple has “locked [them] because they are modified by the owner against his rules and are now easy to get rid of.” The phones can then be sold for a hefty profit.”

“Security experts are concerned that the hackers can do much more than just activate locked, stolen devices. They believe it might be possible that the hackers can also read iMessages and much more.”

Without a fix for these sorts of exploits, and confidence that these issues will be dealt with immediately, it might hinder attempts to push forward legislation to force smartphone makers to incorporate a security “kill switch” to disable lost or stolen phones, something Apple thought it had covered with the Activation Lock feature. Do you think Apple should have addressed this right away? Should Apple have publically announced they were aware of the problem and working on it, rather than waiting 3 months to contact the hackers about it and leaving people’s accounts vulnerable? How do you think it should have been handled? Let us know in the comments or on the Facebook page.