Hackers use security utility to lock Macs in blackmail scheme

File photo: A guest points to a new MacBook Pro during an Apple media event in Cupertino, California, U.S. October 27, 2016. (REUTERS/Beck Diefenbach)

Although utilities like Find My iPhone have helped curb smartphone thefts, they also provide a new avenue of attack for hackers. The security utility is now being used by some underhanded individuals to lock Apple users' hardware, before blackmailing them into paying to have their devices unlocked.

Originally introduced by Apple in 2010, the "Find My" service lets users use GPS location to find exactly where their iPhone, iPad, or Mac computer is in the real world. "Lost Mode" allows users to lock their device, too, theoretically preventing a thief from being able to access personal information. But unfortunately, that means that if a nefarious individual steals someone's login information, they can use it to ransom access to a user's device.

The ransom message is delivered on the lock screen itself, often with a Bitcoin wallet address. In the case of one user, their hacker demanded 0.01 Bitcoin to unlock the device, or around $40.

Much like ransomware, the general advice is to not pay the blackmail charge as it only emboldens hackers to continue the practice. The best bet would be to contact Apple directly to help solve the problem.

Although not yet a widespread issue, there have been several recent reports of users finding their systems locked without warning. MacRumors claims that it stems from hacks of third-party services and the age-oldissue of password reuse. That has led to the locking of some Apple devices.

It also highlights the fact that one of the key issues with Apple's "Find my X" service is that it does not require two-factor-authentication. That's somewhat understandable considering an Apple user may have only the one device of that brand and therefore if they lose it, their trusted secondary login credential may be the one that has gone missing. But that issue is mitigated by the likes of Google, which offers secondary, backup devices to act in their stead in such cases.

Even if you haven't found yourself affected by this latest scheme, no matter your device brand, it would behoove you to use strong passwords, unique login credentials and two-factorauthentication where possible. Although that won't guarantee you cannot be hacked, it makes you far from the lowest hanging fruit, which is often enough to avoid trouble.