Apple & # 39; Family Sharing & # 39; feature used by crooks to make purchases with hacked Apple IDs

When David recently tried to download apps on his iPhone and iPad, he found that he could not do it because his account was linked to something called "Family Sharing".

This is a feature that Apple introduced in 2014 to make it easier to share apps, iCloud storage and iTunes content, such as music and movies, with up to five family members. .

But it was news for David, who said he did not remember having activated family sharing. After digging into his account settings, he received a pop-up window that allowed him to withdraw from the family-sharing account he needed to contact a name that was in Chinese – and he had no way of communicate with him.

David called Apple's line of support, and they managed to fix the problem for him, but were not able to tell him exactly why this happened or anything that happened. he can do to protect his account in the future. The problem was solved, but the test "seemed strange to me," he told Business Insider in an e-mail.

Not the only instance

It is difficult to quantify the extent of misappropriation involving family sharing, but David is not the only person to have met him.

There are a handful of posts on the Apple and Reddit support forums that detail similar stories from accounts that were unable to purchase in-app apps or apps. because of problems involving the feature.

An account, from April, is particularly detailed, and even suggests why hackers might try this attack.

It starts when the author, Emmerage, receives an email from Apple saying that someone has bought an application on his account.

Although he was "wary of phishing scams," he writes that after logging into his account independently, he discovered that someone had changed his name to Chinese characters, and a second account connected to the Apple ID had bought a bunch of in-app apps. purchases for Youku application, a Chinese video application, using the credit card of someone else and a fake Australian billing address.

Since the post of April on the Apple Support Forums:

"I have a hard time believing that someone is going to have so many problems to spend $ 100 on the credit card of someone else to buy games and get them." other crap on Youku, but I also do not see how they could intercept the confirmations and so using a compromised email – there is nothing in the trash, and I receive my email notifications on my phone , surely I 'd have seen something? Surely they would have intercepted the email that I' ve seen that made me change all the pbadwords? suspicious activity regarding my email address, or the Apple ID until now, nor any connection from new devices or anything else that I expected to receive if someone abroad was accessing one of my accounts.

Publicity

Other articles suggest that hackers were interested in buying iTunes gift cards with the balance or the credit card of the account.

"The most obvious way that could happen is if a hacker took control of the victim's Apple ID," said Thomas Reed, a researcher specializing in MalwareBytes security firm, at Business Insider. "This could provide a simple way to monetize a hacked Apple ID, and I noticed that one person reporting this type of problem specifically mentioned that he had not activated the ### ### ################################################################### 39, two-factor authentication. "

"Thus, unauthorized access to the victim's Apple ID account could explain it: in this case, activating two-factor authentication should prevent this type of unauthorized access." "he continued.

Apple ID user names and pbadwords can be an attractive target for crooks, who sometimes use Apple's security features to lock data on an attacked device and demand ransom.

In addition, in 2017, police in China reportedly arrested 22 people who resold information about Apple ID accounts between 10 and 180 yuan per account, or between $ 1.50 and $ 27.

What you can do

There are several possible reasons why this could happen.

When setting up the family share, the added user receives an e-mail or text with an opt-in or opt-out option, according to Apple. It is possible that many of these people who reported the problem have received the notification and mistakenly approved it, although most online reports indicate that they think it did not happen. been the case.

There is another way to add an account to Family Sharing: if the family admin has your pbadword. This is useful for parents and other legitimate users of family sharing.

But that also means that an attacker could get someone's pbadword, maybe via a phishing phishing email or one of the databases disclosed, and then use that pbadword to take control of the Apple ID account.

But if an attacker had your Apple ID and pbadword, this means that you could access your account directly if two factors are not enabled. So we still do not know why the Family Sharing feature comes into this phenomenon – why would a scammer make purchases with a linked account instead of the original?

There is an effective way to secure your Apple ID: by enabling two-factor authentication. This means that to login, a pbadword and a user ID would not be enough – they would need a 6-digit code from your phone or another trusted device.

Regardless, it's a reminder that you should practice good account security, especially with large accounts. Do not reuse pbadwords, do not use incorrect pbadwords as "pbadword", and enable two-factor authentication whenever possible.

Publicity

Have you noticed the strangeness badociated with family sharing on your Apple ID? Do you know what's going on here? Send an email to the author at [email protected].