When iOS5 came out, I did sync my Contacts up to iCloud, but then later turned that off so I could just sync them locally to Outlook. I didn't realize that my Contacts stayed in iCloud. No issue normally, but yesterday someone got into my Apple account and emailed everyone on my list with a link to making millions, yadda yadda yadda. Some of the NPN members I've emailed were in there, so if you got an email from pauliedc@me.com, just delete it.
Here's how it happened, so everyone can be on guard: that email account is only on my iPad, no other email account is on there, and I never use that account to send anything, it's just there in case I have to email something to myself (pointless, really, now that we have DropBox). At some point I must have hopped onto a non-secure wireless network at a restaurant or coffee shop (any place where there's a hotspot) during the time that some other customer in the place was using their laptop with a sniffing utility to grab people's usernames and passwords (easy to do, because our devices are always auto-checking for email). That's not Big Brother silliness, those utilities are easy to get and use, I know a network engineer who forgot his own email password and fired up a sniffer and grabbed his own account info from his network when Outlook was checking for new mail. Email passwords are usually in plain text, FYI. So once they had my email and password, getting into my Contacts and generating spam email was a breeze. Apple caught on, because when I got the spam and then tried to login to my account on the web to see what was happening, the page immediately said "to many attempts, please reset your password", which I gladly did.
I apologize to those that got the spam, as a professional IT guy I should have been more responsible. BTW Jim & Donna, check your junkmail, y'all were on the send list, lol! I'm happy it was spam and not a virus, but don't visit the link in the email, you never know.
One easy way to guard against this simply not to check email on a public wireless, only use your mobile device through your cellular provider, it's a bit more secure. If you have a laptop, then consider a cellular broadband card, the expense is worth the safety. Unsecured public wireless is a risk, yet it's easy to just hop on sometimes and we all do it. Another good option is if your cellphone offers tethering, consider that, because you can then run a laptop and iPad or Droid tab and whatever else from your 3G/4G conection... much safer. It works great on my iPhone, and by paying the extra $20 per month, AT&T doubles my data cap from 2GB to 4GB. I believe Verizon has a similar plan.
I have a bad habit of leaving my wireless on in my iPad. That's bad on my part. If my iPad is laying on the seat of my van and I drive up to a Burger King take-out window, BAM, I'm on their unsecured wireless automatically, and if my iPad polls out for email in that 60-second window, somebody inside or even in the parking lot with a laptop and a sniffer will have my email account login. I think I can set my iSomething to not auto-connect, I need to check that. Anyway, just be careful folks... I let my guard down and was fortunate that it wasn't virus/adult material/trojan/whatever.
Hey Paul - Make sure your iTune account was not hacked too. Mine was a few months ago and I had about $1000 drained from Paypal /bank account which unknown to me was permanently attached to my iTunes account which I never authorized. BTW - iTune store - you can't actually talk to anyone except by email and they essentially say it was my fault for not having a complex password. I rarely, if ever purchase apps (maybe <$20 total). Well let me tell you, my passwords are very complex and even my husband who is in IT also agreed. My account was hacked from somewhere in China probably by a developer. I say that since Chinese apps started showing up on my iPhone. What the...... All was resolved but with many headaches and I completely disabled any association with iTunes/Apple on my iPhone and iPad including iCloud. I wonder if your problem is more related to Apple / iTunes issues which there appear to be MANY. Google it. Apple needs to get with the hacking program because they have not responded in a suitable manner to many, many, many complaints. I will never, ever, buy an Apple computer due to this blatant disregard for client security and certainly wonder if my iPhone and iPad were a wise choice..... I THINK NOT. I think people grabbing info on unprotected wireless is less of an issue. I never use them only 3G, home (secure), and work (secure). Wireless and location services are turned off on my iPad and iPhone except at home and work or 3G. Here is my post http://www.naturephotographers.net/imagecritique/bbs.cgi?a=vm&mr=68932&CGISESSID=abbcb41d0718153a3ee0559763ac81d5&u=3108
Even Paypal let this happen twice. Too many slithering snakes out there in the cyber world.
On your iPhone, if you go to "Settings" and then "Wi-Fi", you'll see an option called "Ask to Join Networks". If you set this to "ON" you will be asked before joining an unknown network. Known networks will be joined automatically.
I have a couple of known networks set up on my iPhone (e.g. my home wi-fi). For all others, I only join if I think it is safe.
Posted by Rick Diffley on May 18, 2012 at 12:55 AM
Thanks for taking the time to be honest about your bad experience and sharing with us!
Posted by Lance Warley on June 23, 2012 at 3:33 PM
Hi, Paul. I just started looking into personal VPNs, I and I remembered your post on this subject. I haven't done anything yet beyond starting the research. The first company that leaped out is Witopia https://www.witopia.net/. $70 per year for the primo offering.
To protect yourself from unsecured hotspots, a personal VPN should do it.
I can't recommend Witopia yet, since I haven't tried it. I do use my company's VPN to connect daily. Zero impact on performance. Hope this helps.
These kinds of hacks by unscrupulous people are precisely the reason I won't own a WIFI connected device until connections are encrypted. The risk is just too great. I'd also love to see ecrypted e-mail passwords.
Here's what happened to me with a credit card hack (posted in the NPN Lounge).
It's a jungle out there!
--P.
Posted by Paul DeCesare on June 25, 2012 at 12:00 PM
Lance/Preston, it IS a jungle out there, lol! I do appreciate everyone who replied (I got a few private ones sharing their experiences also, we SO need to be aware). Ultimately I should have never had my wireless to auto-connect, I got lazy and didn't want the "Do you want to connect to these Networks" window to keep popping up, which means I snagged any and every unsecured wireless hotspot I ran through. And after all this, I recently realized my iPhone was set the same way! You'd think I would have checked that! I need a vacation. Recently I was at a stop light and looked at the iBrick in my hand to see if I had full bars of 4G (wellll, 3G+ phone on a pseudo 4G network, but that's a whole other post!), and noticed I was on a wireless network! Sure enough, the AT&T Store was right there on the corner. So, all that is clamped down now, and for my iPad I simply have it tethered to my iPhone and connect to the net that way like I mentioned in my first post. That doesn't mean some whiz kid can't eventually crack my network but at least it's secure, at least as much as it can be. Even if my Personal Hotspot gets infiltrated there are still my passwords that would need to be figured out, and the hacker better know Old Testament Hebrew if he/she wants to gain access, lol!
Discussion
6 repliesWhen iOS5 came out, I did sync my Contacts up to iCloud, but then later turned that off so I could just sync them locally to Outlook. I didn't realize that my Contacts stayed in iCloud. No issue normally, but yesterday someone got into my Apple account and emailed everyone on my list with a link to making millions, yadda yadda yadda. Some of the NPN members I've emailed were in there, so if you got an email from pauliedc@me.com, just delete it.
Here's how it happened, so everyone can be on guard: that email account is only on my iPad, no other email account is on there, and I never use that account to send anything, it's just there in case I have to email something to myself (pointless, really, now that we have DropBox). At some point I must have hopped onto a non-secure wireless network at a restaurant or coffee shop (any place where there's a hotspot) during the time that some other customer in the place was using their laptop with a sniffing utility to grab people's usernames and passwords (easy to do, because our devices are always auto-checking for email). That's not Big Brother silliness, those utilities are easy to get and use, I know a network engineer who forgot his own email password and fired up a sniffer and grabbed his own account info from his network when Outlook was checking for new mail. Email passwords are usually in plain text, FYI. So once they had my email and password, getting into my Contacts and generating spam email was a breeze. Apple caught on, because when I got the spam and then tried to login to my account on the web to see what was happening, the page immediately said "to many attempts, please reset your password", which I gladly did.
I apologize to those that got the spam, as a professional IT guy I should have been more responsible. BTW Jim & Donna, check your junkmail, y'all were on the send list, lol! I'm happy it was spam and not a virus, but don't visit the link in the email, you never know.
One easy way to guard against this simply not to check email on a public wireless, only use your mobile device through your cellular provider, it's a bit more secure. If you have a laptop, then consider a cellular broadband card, the expense is worth the safety. Unsecured public wireless is a risk, yet it's easy to just hop on sometimes and we all do it. Another good option is if your cellphone offers tethering, consider that, because you can then run a laptop and iPad or Droid tab and whatever else from your 3G/4G conection... much safer. It works great on my iPhone, and by paying the extra $20 per month, AT&T doubles my data cap from 2GB to 4GB. I believe Verizon has a similar plan.
I have a bad habit of leaving my wireless on in my iPad. That's bad on my part. If my iPad is laying on the seat of my van and I drive up to a Burger King take-out window, BAM, I'm on their unsecured wireless automatically, and if my iPad polls out for email in that 60-second window, somebody inside or even in the parking lot with a laptop and a sniffer will have my email account login. I think I can set my iSomething to not auto-connect, I need to check that. Anyway, just be careful folks... I let my guard down and was fortunate that it wasn't virus/adult material/trojan/whatever.
Even Paypal let this happen twice. Too many slithering snakes out there in the cyber world.
On your iPhone, if you go to "Settings" and then "Wi-Fi", you'll see an option called "Ask to Join Networks". If you set this to "ON" you will be asked before joining an unknown network. Known networks will be joined automatically.
I have a couple of known networks set up on my iPhone (e.g. my home wi-fi). For all others, I only join if I think it is safe.
To protect yourself from unsecured hotspots, a personal VPN should do it.
I can't recommend Witopia yet, since I haven't tried it. I do use my company's VPN to connect daily. Zero impact on performance. Hope this helps.
Here's what happened to me with a credit card hack (posted in the NPN Lounge).
It's a jungle out there!
--P.