iCloud warnnig message on Chrome. Image via Apple
Apple says it has taken steps to guard against ‘man-in-the-middle’ (MITM) attacks, after allegations surfaced that Chinese authorities were targeting storage service iCloud to access users’ information through the attacks.
Man-in-the-middle attacks (MITM) are a form of eavesdropping, where by victims believe they are communicating with the service of choice, in this case iCloud, when in fact the entire conversation is controlled by the attacker.
Great Fire, a non-profit organisation that monitors internet censorship in China, discovered the attacks. It issued a statement to make consumers aware of the threat.
“If users ignored the security warning and clicked through to the Apple site and entered their username and password, this information has now been compromised by the Chinese authorities.
“Many Apple customers use iCloud to store their personal information, including iMessages, photos and contacts. This may also somehow be related again to images and videos of the Hong Kong protests being shared on the mainland.”
Great Fire even suggested the attacks were orchestrated to coincide with the launch of the iPhone 6 and iPhone 6 Plus in China.
As a result, Apple has updated its support page to indicate that MITM attacks are indeed a threat to Apple and its customers. The company also emphasised the importance of users needing to be aware of whether a site or service they visit is verified.
According to its position on the MITM attacks and verification, Apple admitted that iCloud has been targeted by particular groups but has taken the necessary precautions.
“We’re aware of intermittent organised network attacks using insecure certificates to obtain user information, and we take this very seriously.”
Apple followed this up by simply asking iCloud users across all browsers to not click ‘continue’ when prompted with a message warning them that the site they are about to visit is not trusted.
