Hackers exploit Apple's 'Find My Phone' feature, lock users out, ask for ransom

San Francisco: Multiple users on Apple Inc's online support forum and Twitter have reported an unusual smartphone and tablet hack in which cyber attackers were said to have locked Australian users' smartphones and demanded payment in return for unlocking them.

The alleged cyber attackers, first reported by The Sydney Morning Herald, appeared to use Apple's "Find My Phone" feature to lock the devices' screens and send a message demanding money be sent to a PayPal account, according to multiple users. The anti-theft feature locks phones that are reported lost.

Apple, in response to inquiries about the hacking, confirmed there had been an incident. The technology giant said in an emailed statement it "takes security very seriously and iCloud was not compromised during this incident".

It recommended affected users change their passwords as soon as possible and avoid using the same username and password for multiple services.

Alleged cyber attackers appear to use Apple's "Find My Phone" feature to lock the devices' screens and send a message demanding money be sent to a PayPal account

An Apple spokeswoman in Sydney said by telephone Apple did not have any details on how widespread the incident was or whether it was contained to Australia.

Multiple users requested information on Apple's support forum about how to reset their phones or otherwise circumvent the lock, while other users also tweeted their concerns.

"I went to check my phone and there was a message on the screen saying that my device(s) had been hacked by 'Oleg Pliss' and he/she/they demanded $100 USD/EUR," said "veritylikestea", a user from the Australian city of Melbourne, on an Apple discussion board.

Other users replied that they had received the same message.

Telstra Corp Ltd, Australia's largest telecommunications provider, said it was aware of the issue, while Vodafone Hutchison Australia said it was encouraging worried customers to contact Apple.

Reuters could not immediately verify the identity of the users, or the accuracy of their claims.

Ref: IBNlive