MENU

China hit up Apple iCloud but not for data storage, claims censorship monitor

21 October 2014, 6:10 pm EDT By Quinten Plummer Tech Times
Close
US Navy test 4,500mph railgun with 110 mile range
While Apple's iCloud may not have been hit, users attempting to contact the service's Chinese servers may have had their information siphoned off by middle men. A censorship monitor accuses the Chinese government of the attacks.  ( Omar Jordan Fawahl | Creative Commons )

China is being accused of playing a role in a hack on Apple's Chinese iCloud service that featured an attack to obtain user credentials, photos, messages, contacts and other sensitive information.

Censorship monitor GreatFire blew the whistle on the "man in the middle" (MITM) attack launched on Apple's Chinese servers.

As the term implies, an MITM attack spoofs a private connection and siphons off information from users unwittingly transmitting data through a third party en route to a secure site. Perpetrators of MITM attacks spoof digital certificates, which can mislead users into thinking a connection to a server is secure.

"If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities," states GreatFire.

GreatFire speculates the iCloud attacks were a response to the release of the new iPhone 6 handset in mainland China. The iPhone 6's almost impenetrable encryption may have prompted the Chinese government to take another approach to monitoring users of the smartphones, states GreatFire.

"When details of the new iPhone were announced, we felt that perhaps that the Chinese authorities would not allow the phone to be sold on the mainland," says GreatFire. "Ironically, Apple increased the encryption aspects on the phone allegedly to prevent snooping from the NSA. However, this increased encryption would also prevent the Chinese authorities from snooping on Apple user data."

China is "resolutely opposed to hacking," said the country's foreign ministry spokesperson at a news briefing, while a China Telekom spokesperson called GreatFire's allegations "untrue and unfounded."

Apple acknowledge the attack launched against its Chinese servers and restated its commitment to the security of customer's data but maintains the hacks didn't compromise any data.

"We're aware of intermittent organized network attacks using insecure certificates to obtain user information, and we take this very seriously," states Apple. "These attacks don't compromise iCloud servers, and they don't impact iCloud sign-in on iOS devices or Macs running OS X Yosemite using the Safari browser."

The attack on iOS users in China comes just weeks after a piece of malicious code made the rare move from Android to Apple's mobile devices. The mobile remote access Trojan was said to have initially targeted Hong Kong protesters, though the security firm that spotted the malware says the perpetrators behind the software could have bigger plans.

"Although it shows initial signs of being a targeted attack on Chinese protesters, the full extent of how Xsser mRAT is being used is anyone's guess," says Lacoon Mobile Security. "It can cross borders easily, and is possibly being operated by a Chinese-speaking entity to spy on individuals, foreign companies, or even entire governments."

© 2017 Tech Times, All rights reserved. Do not reproduce without permission.

From Our Sponsor

How To Shop Smart: 5 Characteristics Of A Smart Shopper

You may love shopping, you may be a bargain hunter....but are you a smart shopper?
Real Time Analytics