Apple says hackers attacked iCloud

Apple announced security warnings for its iCloud storage service after organized attacks. Apple said the attacks were trying to obtain users' information.

Paul Sakuma/AP/File
Apple CEO Steve Jobs introduces iCloud during a keynote address to the Apple Worldwide Developers Conference in San Francisco, Monday, June 6, 2011.

Apple has posted a new security warning for users of its iCloud online storage service amid reports of a concerted effort to steal passwords and other data from people who use the popular service in China.

"We're aware of intermittent organized network attacks using insecure certificates to obtain user information, and we take this very seriously," the computer-maker said in a post Tuesday on its support website. The post said Apple's own servers have not been compromised.

Apple's post did not mention China or provide any details on the attacks. But several news outlets reported Tuesday that some Chinese Internet users have begun seeing warnings that indicate they had been diverted to an unauthorized website when they attempted to sign into their iCloud accounts.

That kind of diversion, known to computer security experts as a "man in the middle" attack, could allow a third party to copy and steal the passwords that users enter when they think they are signing into Apple's service. Hackers could then use the passwords to collect other data from the users' accounts.

Chinese activists blamed the attacks on that country's government, according to news reports and the Chinese activist website GreatFire.org, which suggested the campaign was spurred by the fact that Apple recently began selling its newest iPhone models, the iPhone 6 and 6 Plus, in China. The new smartphones have software with enhanced encryption features to protect Apple users' data.

Apple, which is based in Cupertino, California, said in its post that the attacks have not affected users who sign into iCloud from their iPhones or iPads, or on Mac computers while using the latest Mac operating system and Apple's Safari browser. But the company suggested users should verify they are connecting to a legitimate iCloud server by using the security features built into Safari and other browsers such as Firefox and Google's Chrome. The browsers will show a message that warns users when they are connecting to a site that doesn't have a digital certificate verifying that it is authentic.

"If users get an invalid certificate warning in their browser while visiting www.icloud.com , they should pay attention to the warning and not proceed," Apple said in the post.

The attacks appear unrelated to an episode last month in which hackers stole nude photos from the iCloud accounts of several U.S. celebrities. In that case, Apple said its investigation concluded the hackers had obtained the users' passwords through so-called "phishing attacks" or by guessing at the answers to security questions that allowed access. The company said its servers were not breached in that case.

You've read  of  free articles. Subscribe to continue.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to CSMonitor.com.