The Brazilian newspaper
Folha de S. Paulo reported last month how criminals had been
stealing iPhones in Brazil to access people’s bank accounts instead of reselling the devices. Now, the police seem to have finally figured out how they gain access to bank accounts, and to our surprise, the process seems easier than you might think.
Folha de S. Paulo now reported that Police in São Paulo have arrested one of the gangs that specialize in smartphone theft, and the criminals have detailed how they crack the security of Apple devices. One of them even mentions that he can “unlock all iPhones, from 5 to 11.”
At first, it was believed that the thieves used some exploit or other advanced method (like Cellebrite’s tools) to unlock the stolen iPhones, but the whole thing is much simpler than that. Police Chief Fabiano Barbeiro revealed that criminals need only a single tool to access all the device’s data: the iPhone SIM card.
Basically, thieves take the SIM card out of the stolen iPhone and then put it into another iPhone. Using social networks like Facebook and Instagram, they can easily find out the email address used by the person who had the phone stolen. In most cases, this email address is the same as the one used for the Apple ID. All they need to do is reset the Apple ID password using the victim’s phone number.
Barbeiro says that the easiest way criminals have to find passwords is by looking in the Notes app since many users seem to store bank and credit card passwords there. However, with access to the iCloud account, they can easily get all the passwords from the iCloud Keychain as well.
9to5mac.com
