Warning: your Apple ID is NOT due to expire

Lauren, this is simply a continuation of another topic on phishing. I’m not at all sure why you want to know ‘what the company is doing about it’. There are millions of these scams, all very similar, all asking you to follow dubious links and give away all your secrets. It’s not Apple doing it; it’s thieves, rogues, vagabonds, miscreants, ne’er-do-wells, looters, pillagers. It’s also somewhat misleading that the topic header starts by aiming at Apple, even hinting at potential insecurity in Apple itself (they have a reputation for being pretty secure – but are they really?) but ends by calling on ‘all companies’ to take action.

As an analogy someone knocks at your door and claims to be from the Council. They come in and ask you for all your papers, money and valuables. They don’t show you any ID, don’t wear any uniform but they try to ‘sound like’ Council workers.

Two questions: do you hand over all your worldly goods, chattels and loaves and, secondly, do we decide to have a petition demanding that councils do something to stop this?

Apple’s as secure as it gets. Try losing your Apple ID and forgetting your password and the answers to the secret questions you’ve set up and see how easy it is to get them reinstated. People need to educate themselves and learn about the risks. They’ve probably cottoned on to not patting a bull or sticking their hands in a wasps’ nest but being on the internet is as much about security and care as any other activity. People need to become more savvy.

Duncan brings up an interesting point. BT does have a server-side option blocking capability for individual senders, but spammers change the ‘from’ fields as often as their socks (or more, probably). The only email address from which I’ve never, ever had spam is my Apple iCloud address.

Never owned any Apple product in my life, find them overpriced with plenty of lower priced alternatives. Yet I have friends and work colleagues who drool over any thing Apple, just cannot see it myself!

Stop being so damn ridiculous. Why target Apple specifically… this sort of scam is happening daily and I see all sorts aimed at my bank, linked in, Facebook, etc. Are you going to campaign to get them to address their scam issues. How about directing your energy to getting the scammers and spammers shut down, that would be a greater good.

This is not just a text based scam, this hits any apple based email system such as @icloud.com, @me.com, etc. the emails pose as official apple emails but here’s how to check their validity.

WARNING!!! DO NOT CLICK ANY LINK on the emails. fake Apple ID emails contain links to 2 or 3 part hack structures which hit your email services, they can also obtain credit card information and location to commit advanced acts of fraud.

Here’s how to tell a fake apple ID email.

1: look at the email address received from. some email systems will hide the complete email host but you can click on the email address name and it discloses the full details.
2: examine the format of the subject header including it’s wording, poor english is a huge clue here in their emails, lack of correct grammar and punctuation are also good indications.
3: examine the format of the email body. do not double click the email to read it, just preview it. You will notice a number of issues including: poor english language usage, poor grammar and punctuation.
4: examine any attached files that are visible such as logo files, etc, these have been cloned and altered.
5: sometimes the email will not be a pure html based email, it will be an image embedded email with HTML links. with this there can be potential embed instructions.
6: you will also spot certain words like “blocked”, “Permanently” and also be aware that some comments can be of a forced instruction nature, basically threatening the use of your apple ID.

How these scams work:

These scam emails fall under the following action methods…

1: a cloned version of Apple ID login script service.
2: A cloned version of Apple’s website.
3: A direct connection instruction (rare) but this has surfaced.

DO NOT FALL FOR ANY OF THESE SCAMS!!!

You will know if you accidentally engage with one of these emails how to be 100% sure of it’s flaws by looking at the web address bar. THIS IS A HUGE CLUE! the domain Apple uses officially is a secure APPLE ID framework with a secure ID key. these pages do not have this and are front ends to extremely dodgy websites. some of these websites can contain virus code and yes macs CAN be potentially harmed but the likelihood is rare. There are mac based viruses but the likelihood of such occurring is rather rare. The is the potential for a background embedded key logger script in the website constructed (cloned from apple’s secure service) to clone your details, etc then attempt lookups.

Here is what to do if you receive any of these emails.

1: right click on the email and “Forward As Attachment”.
2: in the email address field, please use the two following addresses.: Abuse@icloud.com and reportphishing@apple.com
3: If you receive more than one of these (I have done so and as a developer, my data is secure) please contact Apple and inform them of a potential security threat and that your icloud account may have been compromised. They will advise you to change your icloud password and I advise you to do the same. they will also advise you to do steps 1 and 2 of the above.

We as consumers have the legal right under data protection for our email addresses to be protected. Apple has the legal right to secure their systems completely by performing a rewrite of their web systems and blocking copy options etc or screen grabs to edit site forms etc. this is achievable but it’s a question of whether Apple will listen. I have channeled my time into this but there’s only so much time I have or patience. as a customer and service provider for apple for 20 years plus, this is where a lot of headaches are now surfacing for customers.

Good luck.

Back again, this time to alert folks to a very new piece of Malware. My wife received it yesterday, and it was sent from [removed]@ which. net…

I’ll resist asking Lauren if she intends to run a topic asking what Which? are doing to stop this (!) and restrict myself to describing the scam.

“This fake document scan has a malicious attachment. It appears to come from within the victim’s own domain, but this is a malicious forgery.

From: admin [[removed]@(various inc. Which.net)]
Date: 24 March 2016 at 15:25
Subject: Scanned image

Image data in PDF format has been attached to this email.

I have only seen a single sample with an attachment containing a malicious script [pastebin] which in this case downloads a binary from:

[Links removed by mods.]

My sources say that other versions download from:

[Links removed by mods.]

As this Hybrid Analysis shows, the payload is the Locky ransomware. The dropped binary has a detection rate of just 3/55. Those reports show the malware phoning home to:

The important point here is that the Which? Mail servers allowed this through without question. No system is perfect and it behoves every email user to educate themselves as to the dangers of opening unsolicited attachments. But please stop trying to pin the blame on companies such as Apple. They at least have DMARC, or Domain-based Message Authentication, Reporting, and Conformance records. Which?, it would seem, does not…

[Hi Ian, we’ve just had to edit your comment to remove the malicious links. We’ll be in touch with you about this, so thank you very much for raising it. Thanks, mods.]

They may have great products, but, in my experience, Apple’s after-sales service is appalling. For a considerable time, now, I’ve been trying to make an appointment online to visit a “Genius Bar”. All I ever get is a message advising me that there are no appointments available. So the fault on my MacBook Pro remains unrepaired and I have no way, that I can find,to have it repaired.

Well, the ‘weekly scoop’ has just gone out with this as the main leader item:

Is your Apple account secure from this Apple ID scam? Read more about the threat

which itself raises more questions. Why is Apple being targeted by Which? in this way? Why not Microsoft, or Google, or your bank, your post office account, your sky subscription – in short anyone for whom you need both a username and password. Yes – these scams are flying around the internet at an astonishing rate for just about every company you can name and some you can’t, but I’m not at all clear why the topic only mentions Apple.

And why does Which? not maintain an up to date list of known scams for all companies? It could be grouped under subheadings such as Banks, Building Societies and so on and would, I believe, be far more effective than YASS – yet another scare story.

As this Convo is related to Apple and security I think I should use it to put out a warning worldwide to IPHONE users . Apple are urging users to update their devices to the latest =IOS-9.3.5 in order to protect themselves from the newly found sophisticated IPHONE spyware . Unusually Apple are being targeted because they are so secure and the target is dissidents and activists so you can guess who is hacking iPHONE .The malware has been dubbed a Pegasus , I wont even name the country involved because it is highly political (no -not Russia/Iran/China ) , more “friendly ” . In any case Apple says dont even think about it update unless you want all your data taken .