A California man and pleaded guilty to multiple felony charges related to a hacker-for-hire scheme that used social engineering to trick people into giving him their iCloud credentials.
Hao Kuo Chi, 40, of La Puente, stole over 620,000 private photos and 9,000 private videos from people’s accounts by posing as an Apple customer support technician.
Chi said, who went by the moniker “icloudripper4you,” specialized in stealing sensitive photos from Apple’s servers upon the order of his clients.
The case highlights the increasing privacy risk associated with using cloud-based services like Apple’s iCloud. As a result, many people are now vulnerable to phishing attacks that use social engineering to steal their credentials and personal data.
The case also raises concerns about the privacy implications of Apple’s plan to automatically detect child sexual abuse material images in iCloud which is criticized by privacy groups like the Electronic Frontier Foundation. The foundation warned that the process of detecting such images defies the purpose of end-to-end encryption.
Chi did not use any of the security flaws, law enforcers said. Instead, he used look-alike email addresses, such as “applebackupicloud” and “backupagenticloud” to trick victims into giving up their passwords. These two inboxes contained 500,000 emails, 4,700 of which had iCloud user IDs and passwords.
Chi then exchanged photos and videos with the clients on Dropbox. The FBI agent investigating the incident said the photos contained explicit content.
In March 2018, the FBI became involved in the case after a California company specializing in removing celebrity photos from the Internet notified a public figure that their private photos were being posted online. The victim then backed up the photos to iCloud. Investigators then traced the log-in to the victim’s iCloud account to Chi’s house.
The FIB got a search warrant to raid Chi’s house, where they discovered incriminating evidence.
