A spate of high-profile hacks of consumer brands like eBay and, most recently, Apple is bringing security concerns to the attention of even non-technical Australians, a senior security researcher has argued.
The latest revelations come as many Australians reported that their Apple IDs had been hacked, allowing malicious and unknown outsiders to use the device's remote-locking features to prevent them from being able to access their iPhones.
Reports on Apple's support forum shared users' experiences of being presented with a lock screen telling them they had been hacked by someone named 'Oleg Pliss' and demanding a $US100 ($A108) ransom to unlock the device. Efforts to log into Apple's iCloud.com service to reset their devices had been unsuccessful.
Advising that those affected should not pay the ransom because there is “no guarantee that the criminals responsible will unlock your device,” Symantec security response manager Satnam Narang wrote in a blog post that those affected needed to log into their Apple ID accounts to ensure their password haven't been changed – and then change the password.
Users should also log out of all Web browsers to ensure there are no active iCloud sessions opened using the previous password.
The issue and its solution reflect a similar high-profile attack that recently hit auction site eBay, compromising over 120 million users' accounts and highlighting the ongoing challenges that the company faces in its efforts to grow its data collection and analytics platform while maintaining adequate levels of security for that data.
eBay Marketplaces president Devin Wenig has been progressively writing to users, acknowledging the attack on a database containing customers' names, encrypted password, email address, physical address, phone number and date of birth.
Wenig requested that users change their passwords on eBay and any other site where they used the same password – despite there being “no evidence that any customer financial or credit card information was involved” and that there had been “no indication of a significant spike in fraudulent activity on our site”.
The latest Apple hack has intensified pressure on users to improve their password and lock code security.
Those that had previously set a passcode on their devices should be able to unlock them using that passcode, Symantec's Narang wrote, but those that had left their devices unsecured may find that the hacker had changed their password using the features of Find My iPhone's iPhone 'lost mode'.
“Although it may be annoying to have to input a passcode to unlock your device, it is a basic security measure to prevent unauthorized physical access to your device,” Narang wrote. “In this case, it could save you the trouble of having to perform a factory reset on your device.”
Narang suggested other protections for Apple ID users include using a strong, unique password including one produced by a password manager like LastPass or 1Password; setting up two-step verification for users' Apple IDs; and regularly backing up devices to ensure that data isn't lost in the event a factory reset is required.
Follow @CSO_Australia and sign up to the CSO Australia newsletter.