Don't argue with Apple's technical consultants

You trust a multinational company and have been using its cloud services. However, one day, you received a ransom email from someone claiming to be a technical consultant of the company, claiming that he would share all your data stored in the cloud service.

You are panic-stricken, but helpless.

Such chilling things do not only exist in horror movie plots, one day, they may also appear in our real life.

A blogger with the ID "@美国往事1999" recounted such an incident on Weibo, in which the "multinational company" was Apple and the cloud service was iCloud. In the Weibo post titled "Apple's official technical consultant illegally stole users' personal information and data and blackmailed them," "美国往事1999" said that he had an argument with an "Apple technical consultant" on the phone over iCloud.

After insulting "@美国往事1999" through the customer service hotline, the technical consultant used his own mobile phone to call "美国往事1999" again to insult (this content is supported by the recording content), and told that he used his position to hack into the iCloud account of "美国往事1999", copied the personal information and data of "美国往事1999", and sent an email to the user's three mailboxes (163, Hotmail, iCloud, all of which are related to the user's Apple ID). The mailbox is his QQ number, asking the user to add him to QQ. If "美国往事1999" did not add him to QQ after an hour, he would send the user's personal information and data, and he also threatened the user that "in the future, don't even think about using Apple devices, including mobile phones and computers."

According to "Once Upon a Time in America 1999", he later found that his Hotmail password had been changed. After retrieving his password and logging in, he found that his Hotmail and iCloud mailboxes had indeed received the threatening content sent by the "technical consultant", and his 163 mailbox also received a notification letter from Apple officials, indicating that his Apple ID was used to log in to iCloud. Judging from the time, he said that this login was not done by him.

The user said, "Apple's iCloud stores a lot of important personal information and data, including contacts, photos, emails, cloud drives, notes, etc., and my notes also contain usernames and passwords for many financial and other accounts."

He then reported the matter to Apple customer service and made three requests:

• Confirm the identity and department of the customer service (technical consultant) as soon as possible. Verify as soon as possible how much of his personal information and data the customer service copied, and whether it was used for other purposes. Verify as soon as possible whether his iCloud is still safe.

At the end of the article, "Once Upon a Time in America 1999" stated that he had reported the matter to the police.

Judging from the blogger's Weibo post yesterday, Apple has contacted him and said that the employee involved has been fired, but no specific information has been disclosed. The blogger's main question was "how much personal information and data did the employee steal and copy, and whether he used it for other purposes", but Apple "did not give an explanation in the end."

The original text of this Weibo article is quite long. If you want to know more details of this incident, you can go to the blogger's Weibo.

Yunshang Guizhou is not to blame

According to the blog post of "Once Upon a Time in America 1999", the incident occurred on February 28 this year, which happened to be the first day that the iCloud service associated with Apple ID in mainland China was transferred to "Guizhou on the Cloud" for operation.

This is a sensitive time. Some users on Weibo believe that this incident is related to the change of iCloud's operator.

However, the person involved, "American Past 1999", denied this in a subsequent Weibo post. He said, "I called Apple's official 400 customer service number, and the receptionist was an Apple technical consultant, not an employee of Yunshang Guizhou."

There are still details worth pondering in this incident

It is true that horror movie scenes appearing in our real lives both scare us and make us angry.

But despite our anger, there are still some details in the blog post published by "Once Upon a Time in America 1999" that we need to verify.

The recordings released by "Once Upon a Time in America" ​​can be regarded as solid evidence that "Apple technicians" insulted and threatened users. However, on the other hand, we cannot ignore that the iPhone still does not have a convenient call recording function, especially when the user is answering the phone.

Of course, if Once Upon a Time in America 1999 was using an Android phone in addition to an iPhone 4 (according to the recording content), call recording would not be difficult to do.

However, there is another core issue in this incident that deserves further consideration.

From the perspective of encryption technology, iCloud is relatively secure. Most of its services use at least 128-bit AES encryption during transmission and on the server. When it comes to private data such as iCloud keychains and payment information, the service uses the highest level of protection - end-to-end encryption. Even Apple cannot obtain this data without getting the user's phone.

According to the recording, the technical consultant obtained the private information of "American History 1999" by "taking advantage of his position". Does this mean that the threshold for Apple insiders to obtain user information is not high? If not, how did the technical consultant accurately obtain the user's iCloud privacy? Is there a gray industry chain behind this?

In response to these questions, PingWest tried to contact "Once Upon a Time in America" ​​and Apple.

Once Upon a Time in America said, "There are a lot of things going on right now," and that it will provide us with more specific information when time is convenient. Apple said, "Sorry, we don't have any response at this time. Thank you for your attention."