2

Update: Called Apple today and according to them they could not get an IP-address from user logins or was not allowed to give that out. They also said that I would be able to see any message that had been sent from iMessage on any other logged in device. Since I did not see anything the attacker did not send any messages.

Original: First of all I hope this question fits the scope of "can be answered, not just discussed" and I don't want this to be closed as too broad so this is strictly Apple ID even if it in most cases can be the same for other online accounts.

Background story is I was using the iPhone (4) five years ago but has since been using Android. Two weeks ago I decided to go back and try out the new iPhone 7+ since Samsungs recent phones have been burning up.

I then received an email containing the following information earlier this evening. It was in Swedish but it should look like this in English:

Subject:

Your Apple ID was used to sign in to iMessage on an iPhone 6

Message:

Your Apple ID () was used to sign in to iMessage on an iPhone 6 named "iPhone".

Date and Time: November 12, 2016, 13.44 PST

Operating System: iOS 9.2.1

If the information above looks familiar, you can disregard this email.

If you have not recently signed in to an iPhone 6 with your Apple ID and believe someone may have accessed your account, go to Apple ID (https://appleid.apple.com) and change your password as soon as possible.

Apple Support

If anyone thinks this is a phishing email like this, all URL links led to apple.com or a sub domain of apple.com. I think this was real. I acted on it 10 minutes after receiving it, immediately after reading.

My first actions were the following:

  • Login to my account and reset the current password. This required answering my security questions which should have slowed a hacker down.
  • Check the Account tab so that no other email address or phone number was added as back up email or rescue email. This was not the case.
  • Check the Devices tab for signed in devices at: https://appleid.apple.com/account/manage. I could only see my device there and not an iPhone 6.
  • Check credit card for any transaction, nothing here. Turned out my account had an expired credit card anyway but It could have been an active one.
  • Check order information to see that nothing has been ordered in my name. Nothing here either.
  • Check iMessage if anything had been written, nothing.
  • Check iCloud for back up of attackers iPhone, nope.
  • Check Find My iPhone on icloud.com for attackers iPhone, no luck.
  • Looked for an email to contact Apple but it seems phone was the only alternative. Since nothing has happened on the account I decided not to call.
  • Tried to set up two-step verification but since my password had been changed I was not allowed to do that. Will do as soon as it is possible:

"You must wait 3 days before enabling two-step verification. For security reasons, you cannot set up two-step verification immediately after significant changes have been made to your account. This helps ensure that only the owner of this Apple ID can set up two-step verification.

A notification email will be sent to all addresses on file in your account."

Luckily I had a unique password for my Apple ID so no other service should be compromised. I normally use a complex generated password in a password manager but I had not started using that five years ago when the account was created and I did not update the password since it was unique anyway. I'm also using two step verification wherever I can normally but I had not yet implemented it here.

Have I forgotten anything to do and can I do anything more to track this down?

  • Note that the devices view on the My Apple ID page only shows devices where you logged into iTunes and/or iCloud. Logging into iMessage alone won't update that list. – André Borie Nov 13 '16 at 1:07
2

I received a near identical email and at first thought it was legit from Apple too. The use of genuine Apple links in the footer and the genuine Apple ID URL (https://appleid.apple.com) are very convincing.

However, if you hover your mouse over that URL in the message (on a Mac or Windows - can't do it in iOS), you will find that the hyperlink hiding behind it is actually to a phishing site, not the the Apple ID URL.

The three day delay for two-factor authentication doesn't sound right to me also. I suspect that you have been phished and that the phisher has included that to stop people immediately blocking use of the Apple ID/password combination.

  • In iOS you can press and hold on a link to open a context menu displaying the target URL of the link to check if it's phishing or not. – André Borie Apr 16 '17 at 0:24
1

You should get in touch with Apple, they have a record of all IP addresses used to log into your account. You should really call them. Most likely it was used to send out spam since they only bothered to log into iMessage and nothing else.

Just in case, log into iCloud on an iPhone and check the iCloud storage page to see if there are any backups. I doubt a device was actually backed up otherwise it would've been listed on the My Apple ID page, but nevertheless if you see a backup you don't recognize it may be a good idea to download it (there are tools for this, Google them) and take a look. It could be the jackpot - an entire backup of the attacker's phone including contacts, pictures, etc.

If your password was unique you should suspect one of your devices being compromised. It may be good to reinstall all devices that couldn've been in contact with that password just in case, and consider all data they held compromised as well.

Check iMessage if anything had been written, nothing.

Note that you may not see messages sent from the attacker's device on your own device, so this doesn't prove that no messages have been sent.

  • Called Apple today and according to them they could not get an IP-address from user logins or was not allowed to give that out. They also said that I would be able to see any message that had been sent from iMessage on any other logged in device. Since I did not see anything the attacker did not send any messages. They do not have a special special support for these cases either, only if the user was not able to take the account back. Checked iCloud for back ups but unfortunately nothing was there, will add this to the list. @AndréBorie – Ogglas Nov 13 '16 at 14:08
0

I think the mail you got is legit, based on what you wrote here. I would also check the details in the email, to make sure it's real.
Apple.com have a "Walkthrough - guide" with steps to determine if your account have been compromised, and how to regain control of it: If you think your Apple ID has been compromised.
If your Apple ID was compromised i think you did a lot of the right things and acted fast with changing your password. I would also report the matter via Apple support. They also might have some more information and advice.
It can also be a good idea to look into why your Apple ID was compromised.

0

You should look at your keychain and change all of your passwords.

Similar to what happens if someone takes your Google password, Apple stores all your passwords in the keychain. Under some conditions (OSX) all these passwords can be read by a motivated attacker.

  • Thanks but I don't use keychain to store passwords, I use another service for that. – Ogglas Feb 11 '17 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.