A complicated yet troubling method to take control of a user’s iPhone and permanently lock it from the device seems to be on the rise.
Some iPhone “attackers” are exploiting a security setting called a recovery key that makes it nearly impossible for owners to access their photos, messages, data, and more, according to a recent report by The Wall Street Journal. Some of the victims also told the newspaper that their bank accounts were “cleaned” after the thieves gained access to their financial requests.
It is important to note, however, that this type of control is difficult to achieve. Essentially, it requires the criminal to watch the iPhone user enter the device’s passcode — say, looking over their shoulder at a bar or sporting event — or by manipulating the device’s owner into sharing their passcode. And that’s enough, before they actually steal the device.
From there, the thief can use the password to change the device’s Apple ID, turn off “Find my iPhone” so its location can’t be tracked, and then reset the Recovery Key, a complex 28-digit code. The owners are hackers.
Apple requires this key to help reset or regain access to the Apple ID in an effort to enhance user security, but if the thief changes it, the original owner will not have the new code and will be locked out of the account.
“We sympathize with the people who have gone through this experience and take all attacks against our users seriously, however rare they may be,” an Apple spokesperson said in a statement to CNN. “We work tirelessly every day to protect our users’ accounts and data, and we’re always investigating additional protections against emerging threats like this.”
On its website, Apple warns that the user is “responsible for maintaining access to their trusted device and recovery key. If you lose both items, you may be permanently locked out of your account.”
Jeff Pollard, vice president and principal analyst at Forrester Research, said the company should offer more customer support options and “ways to authenticate Apple users so they can reset these settings.”
However, for now, there are a few steps users can take to protect themselves from this happening to them.
Passcode protection
The first step is passcode protection.
An Apple spokesperson told CNN that people can use Face ID or Haptic ID when unlocking their phones in public places to avoid revealing their password to anyone who might view it.
Users can also create a longer and harder alphanumeric password. Device owners should also change the password immediately if they think someone has seen it.
Screen time settings
Within the iPhone Screen Time setting, which allows guardians to set limits on how children can use the device, there is an option to set up a secondary password that will be required for any user before they can successfully change their Apple ID.
By enabling this, the thief has to give out this secondary password before changing the Apple ID password.
Back up regularly
Finally, users can protect themselves by regularly backing up their iPhone — via iCloud or iTunes — so that data can be recovered if the iPhone is stolen. At the same time, users may want to consider storing important photos or other sensitive files and data on another cloud service such as Google Photos, Microsoft OneDrive, Amazon Photos, or Dropbox.
This won’t prevent a criminal from gaining access to the device, but it should limit some consequences if that happens.
“Friendly zombie fanatic. Analyst. Coffee buff. Professional music specialist. Communicator.”
