iPhone 'ransomware' hack: Apple owners faced with demands to hand over money to have phones unlocked

Find My iPhone software hijacked in Australia, say reports on Apple's forums

An iPhone feature designed to discourage theft by letting users shut down their smartphone remotely has reportedly being compromised by hackers using it to hold mobiles to ransom.

Posts from Apple’s official support forums describe how users’ Find My iPhone feature (also available for the iPad) has been hijacked by fraudsters who shut down the gadget before demanding money over PayPal.

“I was using my iPad a short while ago when suddenly it locked itself,” wrote a user from Melbourne. “I went to check my phone and there was a message on the screen (it's still there) saying that my device(s) had been hacked by 'Oleg Pliss' and he/she/they demanded $100 USD/EUR (sent by PayPal to lock404(at)hotmail.com) to return them to me.”

Other users responded with stories of similar hacks, some noting that troubleshooting tips suggested by Apple helped them regain control of their mobile, while others complained that these steps had only worked temporarily, with the hackers regaining control soon after.

A photo of the ransom message posted by an Apple suport forum user.

The first reports on the Apple forum were posted on 26 May with multiple individuals reporting identical hacks by someone identifying themselves as ‘Oleg Pliss’. One user noted that this is the name of a well-known San Francisco-based software engineer, suggesting perhaps that the hacker is familiar with professional computing circles.

The vast majority of complaints have come from Australia, but the problem might be spreading. One individual said they were based in New Zealand while another named Werewabbit said “I live in the UK and this has also happened to me yesterday. Very worrying. And not a peep from Apple yet.”

The hack doesn’t appear to be limited to a single network operator and with Apple declining to comment it’s not clear where the security breach might have occurred.

Speaking to Australian news site WAtoday, IT security expert Troy Hunt suggested that the hacks might be caused by individuals re-using passwords lost in previous data breaches for their iCloud account, the Apple log-in system that grants access to the Find My iPhone feature.

“Regardless of how difficult someone believes a password is to guess, if it's been compromised in another service and exposed in an unencrypted fashion, then it puts every other service where it has been reused at risk,” Mr Hunt told the paper.

We contacted Apple for comment but a spokesperson said the company has yet to issue a statement.