5

Girlfriend's MacBook was stolen, and she fell into their phishing trap and gave them her iCloud password (changed less than 15 minutes later, and luckily different from her login password).

Next, the iCloud password was changed by my girlfriend 15 minutes after she realized she god scammed. The thieves managed to unlink the macbook from her apple id, it's unclear what else they did if anything.

She had many of her online passwords stored in chrome, and then of course everything in Keychain. We worry that either of those can be read without the login password.

Anything else we should be aware of, assuming they have unrestricted access to the FS?

1
  • Good points in the accepted answer here. Seems a pity that for all of Apple's "security measures", they don't have anything to address this.
    – Seamus
    Apr 30, 2023 at 19:04

1 Answer 1

7

You’ve given up the keys to the kingdom!

General rule of thumb: When someone has possession of your device, assume it can and will be compromised. That means all of the data including passwords and security keys.

she fell into their phishing trap and gave them her icloud password

This means they can use her Apple ID to reset the MacBook password. Once they do that, it is assumed that they are the owners of the device and can now take ownership of it.

What can they do in this case?

  • Take ownership of the MacBook
  • Take ownership of her iCloud account
  • Remove her ability to use Find My and Wipe/Lock device
  • Gain full access to Keychain
  • Gain full access to all documents, software…basically everything.

This isn’t over..since they have access to everything on her device, possibly including personal info this means everything else is at risk.

  • Banking and Financial accounts
  • Personal videos, text messages, including everything she doesn’t want her mother to see
  • Medical info
  • Email and cell phone accounts
  • Anything else attached to that laptop

What to do…

The two of you need to work together. One needs to call the police and report a stolen laptop, while the other begins calling all critical entities she deals with (banks, credit cards, etc.)

  • Lock all credit cards and bank accounts
  • Change all passwords on online accounts (email, Twiter, Facebook, etc.)
  • Call the CRA’s (credit reporting agencies) and lock her credit file
  • Have a friend/relative try to notify as many people in her circle her accounts were compromised and to ignore any requests from her account(s). Get the word out in case they try to phish others.

If you have shared accounts, you must do this yourself (and anyone else she shares accounts with). By this I mean things like an Amazon account, a Ring video doorbell, etc.

To respond to your question in comments about email notifications, the short answer is it is worthless at this time. If they’ve gained access to email from your laptop, they can respond and delete notification messages as they come in. They can unlink her phone from her Gmail account (for example) from Gmail’s settings.

The bottom line is by the time you receive and react to the email message, it’s a moot point.

Going Forward…

There are tons of security features implemented by Apple, email providers, etc. To help you thwart all of this:

  • 2FA or two factor authentication. This will require her approving access on her phone. Not only does Apple support this, but almost every (reputable) online account/service offers this.
  • FileVault will encrypt the drive with a different password from the AppleID. Without this, the MacBook is a boat anchor. The data will be secure and the only value the Mac will have is for parts (it will basically go to an electronic version of a “chop shop”)

However, the most important thing to remember is no matter what, never, ever, EVER, give out a password or 2FA challenge/response code to anyone over the phone..

For example, to verify my account with my credit card company, they will tell me they are generating a code and to enter it into my App; they also remind me not to tell them the code. If they want the code, it means an attacker is attempting to spoof themselves as you, but need the code that is sent to your mobile device. When you get it and tell them, they enter it and gain access to your device.

Final Thoughts…

The question Is My Mac Hacked gets asked quite often here and the answer is usually “no” because hacking is 90% social engineering. In this case, (very) unfortunately, it is a textbook case study in how systems are compromised by socially engineering your girlfriend into giving up credentials to take ownership of a device.

I genuine empathize for her and your current predicament and I don’t envy the amount work you’ve got in front of you to secure everything to protect her identity and financial well being. To make some good come from this, use it as a teaching moment to educate people in your/her circle on the dangers of not using the security features that come with technology and some simple rules to follow concerning password security.

3
  • Would she receive an e-mail notification that it happened? Or is it an automatic/quick process to reset the computer's password? We will change all passwords either way, I just need to prioritize what to handle first. This happened 30 minutes ago.
    – Gloomy
    Apr 28, 2023 at 16:06
  • @Gloomy they may have access to her email if they took action before your girlfriend reset her iCloud password.
    – fabspro
    Apr 29, 2023 at 3:30
  • "Never, ever, EVER, give out a password or 2FA challenge/response code to anyone over the phone." I have several accounts where they will verify my identity by sending me a text message and I have to read it back to them. I know this is not entirely secure; they could get me to solve a 2FA challenge for a different "app", but these are calls that I have initiated, so I am relatively safe.
    – jrw32982
    May 2, 2023 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .