5 ms·
After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones. My phone was snatched from my hands in
by gojomo 3y ago
After a iPhone theft in Europe earlier this year, I don't quite trust Apple's assurances with regard to stolen iPhones.
My phone was snatched from my hands in the street. I was able to wipe it via 'Find Devices' within a few minutes; I was able to track its location for the rest of the day, until I requested that my carrier irrevocably disable its network service. There was no evidence of any accesses of my information or accounts linked on the phone, then or since.
In the following days, it was still visible in my Apple device lists as mine, with reference information like its model and serial number – as it should have remained, indefinitely, to prevent anyone else from associating it with their accounts. (Until recently, I still had an iPhone 4 listed there that hasn't been turned on for many years.)
But sometime since then, it was removed from my Apple account – without my permission, and with no notification to me. This step would also apparently allow someone else to use the device with Apple services.
Apple Support insists only a person who authenticated to them as me could have done that, and that they have no records of when/how that happened – a policy that seems designed to help criminals cover their tracks, with no help to customers other than: "you should change your password".
Further, even if I provide the serial-number/IMEI with a police report, Apple says they can't determine if they've activated Apple services to that stolen property for someone else or provide me with any further help.
I thus suspect theft networks have figured a way around Apple's breezy assurances about locking-out stolen devices, perhaps similar to how they've often deeply pierced major telecom providers in order to carry out SIM-swap attacks.
But: if anyone on HN knows more about how the smartphone theft/fencing (chop shop?) operations typically work, or how Apple's systems do or don't protect against post-theft hijacking of registered Apple devices, I'd love to hear perspectives that either flesh-out, or refute, my impressions that Apple's related systems involve some false bluster & "security theater".
- tamiral 3y agoim going to add to this, long time ago my macbook was stolen when i was on holiday, i did all the things you mentioned, once i got back home i called Apple Support and they said "your warranty with us is over (it was 2 days lapsing from my travel) and to help you, you're going to need to buy apple care again" disgusting.
- pingou 3y agoThat seems like a very big deal if true. Very interested too if someone has more information. I could imagine they may be able to reuse the phone by changing parts, but how would that remove it from your Apple account?
- gojomo 3y agoFrom the reports in this thread, it seems that front-line Apple employees presented with a reasonable-looking (even if forged) "proof of purchase" can re-enable a device registered to another person's account. Perhaps, that yanks it from the previously-registered account. That's my best guess as to what happened here. The alternative, that the thieves fully compromised my account via obtaining my Apple password and circumventing the various secondary checks via my other devices, seems very unlikely to me. There's been no evidence of unintended account accesses – like the confirmation challenges that pop-up on other devices. Unfortunately, Apple seems to lack the user-reviewable log of all authentication events that others like Google offer. The sorts of compromises that would have revealed my password – like a keylogger on one of my primary Apple devices – should've shown up as other attacks on targets of more value than a single street-snatched several-years-old iPhone.
- justinclift 3y ago> I thus suspect theft networks have figured a way around Apple's breezy assurances ... Also sounds like something doable by compromised Apple insiders. :/
- theonlybutlet 3y agoI'm unable to factory reset my own iPhone as it's linked to a friend's Apple account. I know the passcode. Apple are unwilling to do this for me unless I show proof of purchase (which I don't have as it was many years ago). Pretty high bar, so assuming must be inside job.
- zwily 3y agoIs the friend not a friend anymore?
- xp84 3y agoI haven’t spoken to that guy since he stole my iPhone.
- gojomo 3y agoPer another reply's report, you can just forge a plausible-looking plain-piece-of-paper "proof of purchase" – y'know, how crooks might have done so 100 years ago, with some predigital printing supplies. Show that to the right Apple employee, you should be good to go.
- baz00 3y agoAgainst their own advice, the moment it is stolen you should erase it from Find My as a priority. Until that is done it can be used to authenticate with your iCloud account as an MFA device and can then be removed anyway if they get past the device lock. In that window the security posture is somewhat unknown. I'm sure there is a good market of off the shelf exploits which can leverage that in some way, despite Apple's excellent general efforts on this front so far. The key thing is to protect your data first and that means wiping it remotely. Leave it attached to your iCloud account device list though because that'll leave the provisioning / device lock in place. I'm sure they have a way around that now but it'll make it more difficult and devalue it for the thief at least.
- gojomo 3y agoA good example of why I try to keep anything I consider really important out of iCloud entirely! (That's quite hard with Apple's various dark patterns to boost iCloud usage & lock-in.) But yes - it looks to me like dishonest actors managed to get the device out of my "iCloud account device list" without my permission, and thus evade the "provisioning / device lock".
- meindnoch 3y agoAccording to my friend at Apple, sometimes fairly low level employees have access to the internal system which can be used to dissociate devices from AppleIDs. I wouldn't be surprised if some of them were compromised, as the pay is not great. What's more surprising is if they have no audit logs that would let them discover the compromised employee in these cases.
- Waterluvian 3y agoYup. The argument for end-to-end.
- mtsr 3y agoOr they do have such logs, but don’t feel like taking the reputation hit of telling you what happened.
- no_wizard 3y agoI worked on these systems when I worked there. I can tell you they have audit logs, but they're restricted to certain groups within Apple to see them
- gojomo 3y agoThat sounds credible. The Apple Support person I spoke with denied such audit logs even exist, probably in some officially-coached language that they can bluff as being truthful when pressed.
- Zapped 3y agoWell I kind of did circumvent this hurdle. I got an iPhone from a relative, the relative had forgotten the passcode and the Apple ID password. I did a factory reset of it via iTunes and of course when it started up and I started with the setup it said it was locked to *@*.com. I contacted Apple support and they said I needed proof of purchase for them to unlock it. I did not have any proof of purchase and neither did my relative. But I refused to let that stop me. So I made a proof of purchase, printed it and went to an Apple store. I told the Apple Genius about the iPhone and that it was locked but factory reset and presented the "proof of purchase". The Apple Genius went to get a manager or something and the manager checked the "proof of purchase" and then connected the iPhone to the store Wi-Fi and did some stuff on their iPad and rebooted the iPhone. The iPhone did a reset and then it was unlocked and ready to be setup without any hurdles. So I am guessing some thieves have figured this out.
- brookst 3y agoMakes sense. No theft deterrence is perfect, and your solution required a lot of investment of time and would not scale to a substantially large theft ring.
- kotaKat 3y agoEh, fake receipts are fairly easy to knock out. When I managed a hospital's iPhone deployment I made it a point to always back up our receipts electronically because I have... had to make quite a few emails to AppleCare Security to release a few Activation Locked devices. It's not a terribly difficult process once you've done it a couple times, and I reasonably think I could release as many phones as I wanted these days with enough fake receipts.
- no_wizard 3y agowith an MDM and Apple's Device Enrollment Program you don't even need to worry about this anymore[0] [0]: https://www.apple.com/mx/business-docs/DEP_Guide.pdf https://www.apple.com/mx/business-docs/DEP_Guide.pdf