TECH

iPhone stolen X was unlocked via device recovery message

It was a coincidence, but the new form of phishing was discovered by an employee of Kaspersky, an online security specialist, when she lost her iPhone X in Russia during a World Cup match. The victim had activated the feature to find the "Find My Phone" smartphone, as explained in the company's blog, to alert all users.After the Russia-Spain game, Kseniva Turova went to a bar with friends and quickly missed his iPhone X. The first impulse was to call his number, but got no response, having realized that this had been stolen and not lost . The equipment was secured by facial recognition and code, which would make it impossible for anyone to use, thus being destined to sell "to pieces."The "Find My Phone" application generates a "lost device" message providing instructions with the number so a person who finds it can return it. In addition, the device is visible on the map, which makes it easier for authorities to find it. She thought of the worst case scenario, which could be a victim of ramsomware.When you turned on the security option, an hour later you received a message in the phone number provided to be contacted. The text was in Russian and provided a link that was not official from Apple. In spite of being a technical analyst of the security company, in the scenario of affliction with which it was confronted, it ended up clicking on the link and was a victim of phishing. All your user data has fallen into the hands of cybercriminals, eventually unlocking your device to work again.



Only after a few attempts to access the fake link from the iCloud website, using his credentials, did he read the message again carefully, realizing that he had been a victim. "With my data, I immediately deactivated the search function of my smartphone and delete all the information contained in the device," reports the incident. In this way, the criminals cleaned the smartphone, which could be resold without any previous registration.
The official leaves the testimony as an alert and advises people to take additional security measures. First, never click on links without confirming if they are official, which was what "plotted" the employee. On the other hand, iCloud's two-step authentication could have prevented access, even with credentials from criminals, since they needed to receive confirmation from another device.



Sapo