How I got hacked, lost crypto and what it says about Apple’s security. Part 1
I was hacked. The attacker gained access to several of my accounts (Apple Cloud, Yahoo, Gmail, Telegram), found private keys, mnemonic seeds and drained several thousand dollars worth of crypto.
In this article, I’ll try to recreate the exact timeline of events, the damage, commentary on how this could have happened. I’ll also talk about a few moments that I don’t yet understand (mostly around 2FA) and hope my readers will be able to help me out. I’ll also share a few tips about what you can do today to protect yourself from the attack that happened to me.
Attack Timeline
The events took place on Sunday morning, October 4th, 2020. Between 9am and 11am, GMT+8. I was not home, far away from my two MacBooks. They were in hibernate mode, locked, lids closed, at home. The night before, I finished setting up my brand new MacBook Pro (2020).
I received my new (certified refurbished, directly from Apple) MacBook on Friday (Oct 2nd). Saturday ~8pm I finished setting it up. Sunday, ~9:14am the attack started. I suddenly started receiving 2FA SMS notifications on my phone. Here we go:
9:14am — I receive a notification of a new login into my Telegram. Prior to that I did not receive any 2FA code from Telegram through SMS, or Telegram’s chat history. (Did the attacker delete the code? Telegram doesn’t send you confirmation SMS codes if you are logged in on several devices and instead sends the code within the app.
9.15am — Yahoo 2FA SMS. Again, not something I requested:
9.18am — Immediately after, I got this login confirmation email from Yahoo. “We sent a code to <phone number> which was used to sign in to your Yahoo account”:
9.18am — the password was changed:
9.20am -Signing into my old gmail account (Google Apps)
The attacker synched their Chrome with the account. Which means all the passwords that were stored in the Googles Password Manager of that account leaked. Chrome provides an easy CSV export of all your stored passwords. I assume the attacker used just that. Exported passwords were used as a dictionary in the following steps of the attack.
9.28am — Apple 2FA call. I pickup. The robo-voice reads out my 2FA and the line drops.
9.29am — I get a login confirmation email from Apple:
By 9.40am I reached home. Stress is through the roof + I was sweaty after the ~3hour morning cycle. I’m opening my laptops, trying to understand what’s going on. Started changing more passwords. When suddenly:
10:09am — I’m receiving notifications that some tokens moved from one of my wallets.
These wallets drained the funds:
0xc7a93685f6ae28d29d4a6e974a9c774f8ebbc904
0x8C46335777867367e279350eEDacdA5463de9029A few unauthorized transactions, draining tokens and crypto:
0x60c4082d976f245fc3c2ff52814cea5858a89423f7f81046da45809a5d0f37a1
0x31ab912f984a803ffd4e79340e050a31254535f07050242eb72dd360fce4a851
0xedff4cc789d7a53133a4451680f1e73321c52b5da1725432a4288ac4e418c356
0x929226416c83da6a4a2962368803c392b2d05b701aad419269b032e1a125c411
0x542e3f237013bd7e81b5b90fffc5c83aa46824a38e9fd535a533d5f00dddfaef
0x4a370b66e5ea3577dfe9fce2230fefda0d27de1cf913d9215953a534352652aeThe hacker moved ~$800 ETH, ~$1700 hard-earned UNIs, ~$209.73 ETH/BTC RSI set, ~$40 worth of WBTC, 27 DAI, etc… totalling $3k++
I’m not just stressed anymore. I’m shaking.
I had some old hot wallets stored in my iCloud. Some as a file. Some as a password protected note in Apple Notes. I’m quickly realizing that the issue got escalated to a whole new level. And a few seconds later I realized that I should start withdrawing funds myself from all the wallets that ever touched my iCloud. Transferring crypto is stressful on its own — there is always a risk of sending money to a wrong address, and losing them forever. Doing transfers under pressure, where every second counts, is next level. I did my best. “Do I transfer all the tokens first? Or all the ether? What’s more valuable? What will the hacker go after first?” — a thousand thoughts race through my head.
Tuesday — I try investigating what happened. Just in case someone physically accessed my laptops, I decided to look at the logs.
pmset -g log | grep -e “ Sleep “ -e “ Wake “This gave me a nice output of when both computers were on and off.
I didn’t notice any activity during the hours I was hacked. My laptops were asleep. Lids were closed. I do recall some battery activity, but I didn’t find it meaningful. Most macs wake up for a few seconds or ms to perform some maintenance activity.
Wednesday night — my old laptop is acting a bit slow (as usual), and I decided to restart it. When it started booting up, it went into “Installation” mode. That while screen when mac has a major OS X update. I don’t remember any new OS X versions coming out, or any update pending installation… naturally, I became suspicious. After waiting a few minutes for installation to complete, it wasn’t making much progress. I thought that, given the recent hack, I better not risk it. Last thing I want is for some malware to format my hard drive. So I force-shut down my mac. And took it to the Apple store the next day.
Thursday — I got to the Apple Store. I’m quite surprised that no one at Apple seems to understand how to even work with the CLI, once rebooting the computer. The Genius that was assisting me, said that I’m more knowledgeable than he was after 10 mins of conversation. (He was very nice though.) Not what I wanted to hear at that moment. Anywho. We rebooted up the machine with an external hard drive. I moved my important files out. And we proceeded to reboot my laptop up again. After 20 min or so, my laptop finally starts. Nothing was formatted. I was happy… for a moment.
Apple Genius managed to find amore Senior Genius and handed over the case to him. Just by a coincidence that guy has a background in cyber forensics. However, Apple retail store policies don’t allow him to share his own opinion or interact with my machines beyond a basic “let’s re-install the OS” level.
Takeaways and mistakes to avoid:
- if you are storing private keys or mnemonics in your Apple Notes or iCloud — they are up for grabs. Even if you have 2FA. Even if your Notes are password protected. Use a hardware wallet for everything, no matter how much crypto you hodl.
- Do set up Telegram 2FA password now. If your Telegram gets hacked and you don’t have a password set — hackers will set it for you. And the only way to reset it would be to reset your whole account.
- Make sure you don’t have any password reuse. Not even partial. Have unique passwords for every new service you sign up for. Store them in a password manager. Don’t store your main email in the password manager. Remember some main master passwords and don’t reuse them either.
- Do not save passwords in your Chrome. Or, if you do, make sure your Google account has multiple levels of 2FA. SMS is not one of them.
- iCloud has limited security options. Consider using Google Voice number as your trusted 2FA.
- When you leave your laptop unattended, or close it for the night, make sure to turn WiFi off. Or, better, shut it down completely. Closing the lid and putting it in the hibernate mode is not enough. Your laptop can wake up at any time, even when the lid is close and remote code can be executed.
Resources
- Personal Security Checklist
- MacOs Security and Privacy Guide
- MalwareBytes — that’s what Apple recommends and it works. Free version is good enough for a periodic check.
- ClamAv — for those of you who are friendly with the CLI. OSX/Linux
Part 2
In Part 2 I’ll write about incident response, forensics, chain analysis, and hopefully an identification of the attacker. I’ve reached out to a few friends from cyber sec and blockchain space to help me out and piece together the puzzle. If you’d like to participate, help analyse the attack and (hopefully) identify the attacker please contact me on Twitter (https://twitter.com/ksaitor) and jump in to our Google Doc.
Credits
James Pavur, Daniel Aaron, Tushar Singal, Sebastien Couture, Hitesh Suresh , Tim and Dan from Mana Security — thank you guys for providing feedback and helping bring more clarity to this incident!
