I read it all the time, "my insta was hacked", etc.
I would really like to know if hacking is as common as it is reported rather than a successful phishing campaign, a simple issue of forgotten password or getting locked out of email, account ban for rule violation, or something else entirely unrelated to actual hacking.
In this case my skepticism skyrocketed when the hackers write "we are in control".
It is a mechanism of shifting responsibility. If your password is "1234" and you gave it away to a totally legit MS support center employee that called you recently because MS has detected that your iPhone has a virus, then it is on you. But if North Korean hackers compromised your watch via elaborate hacking campaign to mine bitcoin on it, then it is "not your fault".
Turns out for a lot of people your piss drunk self, your weird ex boyfriend, and that person setting up fake OF with a selection of your public fb/insta pictures, are all threat actors too.
It sounds like a legitimate usage of the word “hacked” to me. Maybe not the most critical vulnerability because they did not gain full access, but they managed to gain some level of control of the owner’s watch without their permission, and it sounds like the reason was not that they left it lying around unlocked (to be clear it sounds like they got control because the watch was unlocked in the owner’s wrist, but they were accessing it wirelessly- sounds like an issue with Apple’s security model that can be fixed).
Hacker News is meaning 1.6.
When I logged onto Skype, I had a new name, and a new contact, both of which were Ivan something. I immediately started chatting with Ivan, who told me that there was a weakness in the Skype login security, which he tried to exploit.
I changed my password to another Medium to Strong password, and a few minutes later my name was again changed to “Anders xoxo Hafreager”, and a message that he had hacked me again.
I still don’t know what he did or how he did it.
I was getting dozens of one-time code emails per day caused by login attempts via what must have been Tor. None of them were successful logins, but it got me worried. They seem to have stopped after I reworked my account's requirements to include OTP, but now every couple of days my Skype app posts an error that it couldn't log in, when it is clearly logged in just fine. Even that OTP can't be a standard one, it has to be Microsoft authenticator.
Microsoft has been improving in a lot of ways lately but this is not just embarrassingly bad, it's substantially worse than it was a few years ago.
That said, phishing is a form of hacking the individual so even by a strict definition it still works.
Having so many accounts where some stuff might (or might not) be important, folks get very sensitive to being "hacked". Or in other words, having a stranger break in and rummage through their underwear.
In the late 70s in a central Pennsylvania farmhouse that was some of the earliest technical documentation I ran into.
Different times.
I sort of hate how this thread immediately rallied around “must be crazy people hallucinating” and I hope Apple takes the reports a bit more seriously & investigates.
Edit: I do agree that passwords guessed or phished doesn’t count in my mind as hacking.
Either the user had a bad digitizer, and misread and/or hallucinated the "We are in control" message, or the entire story is made up. Perhaps a group of people working together to post "Hey me too!" stories? I'm not sure what the motive would be, though.
Extraordinary claims require extraordinary evidence, and this is beyond believability.
Also, something I noticed working for large orgs with over 100K staff and 1M users: An appreciable fraction of the human population is simply mentally ill. Hallucinations, drug use, psychosis, etc... all have a non-zero rate. Given enough users, you'll get the same type that imagines being abducted by aliens and even makes police reports that sound suspiciously like the sci-fi movie that's popular at the time.
One consequence of these ghost touches would be inputting the wrong PIN which will initially lock the device for one minute, so I don't see what's strange about that.
Which messages, specifically, are you referring to with "exact time & date" and "same timestamp"? I skimmed through them but nothing of sort stood out.
Otherwise, why on earth would i care about signing up to apple forums?
I’d only go there if i had issues (obviously)
It's something that perfectly sane people could experience and not realize it was a hallucination because it's a quite rare & unknown phenomenon(and one that you often won't mention because everyone thinks you're crazy if you say it).
1: https://support.apple.com/guide/watch/apple-watch-mirroring-...
To make Apple Watch antivirus scams?
> From: definitelyNotAppleScam.com
> Subject: Your Apple Watch is hacked
> Hello [insert name here],
> We have found that your Apple Watch Series x has been compromised by hackers.
> Please click on the link below to reset your password
> [Link that asks for previous password and something idk]
That's the intended design, but perhaps the trusted device layer could be bypassed under some circumstance? It seems extremely unlikely, but maybe not impossible.
edit: The more I read and think about this, the less I think it's likely. I'll keep this as a devil's advocate sort of message, but I feel like I should still point out that the entire premise here seems a little nuts and the people reporting the hacks are more likely to be uninformed/paranoid/etc and dealing with ghost touches than the watches were likely to be compromised.
If this is for real I expect we'll hear more about it soon enough.
Nevertheless, this does seem like an anti-Apple campaign.
It seems like the ghost touch issue, and not actual hacking.
In my case I was waking up to my watch using itself. It changed contacts, added locations in maps, placed and cancelled two calls to emergency services and more. I then made the mistake of taking it off my wrist. Now the screen is locked and the watch will continue to enter wrong PINs, locking itself for more time every time. You can’t shut it down - the watch will start to type and dismiss the shutdown dialog (or call 911 again!).
I haven’t gotten around to taking it to an Apple Store and have returned to my Garmin watch.
(or maybe some really really unlucky markov chain)
This reads like bad hacking fiction, complete with the guy typing that wearing a Guy Fawkes mask. Why the hell would the (hypothetical) attacker lose precious time doing something like that.
Because it’s probably kids messing around.
I believe HID-over-GATT was recently introduced to iOS (only a decade late), and implementation details could potentially be relevant here.
https://arstechnica.com/security/2023/11/flipper-zero-gadget...
On the other side hacking a watch is something that probably doesn't get unnoticed by the wearer if it must go through the UI. Are they subtler ways to get in control?
https://www.zdnet.com/article/ghost-touches-are-haunting-som...
I stared pressing the button to return home and they popped up the keyboard and typed “We are in control”.
That would be a very unusual ghost touch issue, if true.
I don't doubt that this might be nothing, but seeing all these commenters completely dismissing it is rather odd.
Hopefully Apple is less dismissive of this potential security issue.
If this is a software (or somehow even a hardware) issue, than it's still not positive for Apple.
So it's a good idea to apply Occam's razor.
Digitizer/ghost touch is probably the simplest explanation.
The only thing the hacked/pwned idea has going for it is the "We are in control" message, which is still a bit marginal if the watch really was hacked. (None of the other posts mention this and why would a hacker type that message in? Could be because it's a practical joke or maybe part of a phishing attack, but those are tenuous and nothing else mentioned supports those.)
Ghost touches and typing "we are in control" with predictive text, sounds more plausible but still raises an eyebrow.
thats why this sound like some kind of hardware malfunction (or some substance on touch screen - I personally experienced ghost touches on my phone from dirty screen) or it's some kind of prank by kids using some flipper and previously authorized device or something similar
https://support.apple.com/en-my/guide/watch/apd890848603/wat...
Or, more likely, it's some kind of shitty prank by someone nearby to the users.
The presses were completely random and amounted to nothing. Looked like the process that reads touch went into an infinite loop of some sort.
Has only happened the one time. Lasted about 2 minutes. I may have rebooted the watch to make the issue go away, can’t remember.
Second, presumably if one gains access to the device through a sophisticated hack they'd probably also be able to exfiltrate data without having to alert the user.
With all of that being said, I wish there was some sort of black box mechanism for logging certain events in such a way that the device itself can't tamper with it. That way you'd have a log that can be easily analyzed to judge whether or not a hack is likely to have taken place. Right now if you open the syslog on an Apple device it's filled with so much crap that it's basically impossible to detect if anything nefarious was likely to be happening.
This is a strange argument. Of course there can be sensitive data there. Photos, (i)Messages, eMail, calendar events, addressbook, health data, voice recordings, location data. The device is password-protected for a reason.
It is also usually connected to a paired iPhone and to the Internet. You might be able to do some shady stuff with the phone using private APIs.
This is called an append-only log. It can be built in many ways. Which way is suitable largely depends on the security requirements.
My personal favorite kind of append-only logging is transparency logging. If you'd like to learn more you can check out e.g. sigsum.org, an open-source project my colleagues and I have been working on for several years now.
It's a factory test script is getting triggered on the watch somehow.
It would normally be run near the end of the manufacturing process to ensure everything is working as expected. It automatically runs through a series of steps hitting a wide swath of watch functionality and would look a lot like someone rifling through a watch remotely. But a persons watch wouldn't have test data or factory password, so the script soon ends up getting the watch locked (or maybe that's just part of the test).
It could even conceivably type the message "We are in control" (though I have my doubts about that part of the story), because, as those of us who know some hardware verification folks, that's right where their sense of humor is.
If it's an hardware issue with touch it just means that no software patch can actually fix it enough to not waste battery in future. And that there is a realistic change that the issue gets worse when the devices get older.
Edit: A hardware issue that appears like a remote take over?
Ahahahahahahaha. This must be satire!
Possible it tried to do something about the ghost touch and made it worse in a subset of devices.
That feels more likely than a bunch of random people all being targeted with no other commonality like region or status
https://www.macrumors.com/2024/02/10/apple-watch-series-9-ul...
I am kind of shocked, that state of mind was acceptable around 95-2000, but not a quarter millennium later.
I for sure live i a bubble, but are people really like that?
Even Google's practically useless forums have helpful users who suggest workarounds between the hundreds of "I have the same problem" comments. Microsofd's near-useless forums have some good information if the thread doesn't die once a Certified Super Microsoft Systems Engineer tells you to reinstall Windows (because that seems to be all they can come up with). But for some reason, Apple's forums are somehow worse. Maybe it's because of Apple targeting a more tech-averse audience, I don't know, but when it comes to Apple's forums, nobody has any real answers.
PS: but a little correction not 2,250 but 250 years or 0.250 millennia.
Given apple's security track of record and the fact that I pose no value as a target for the such an hacking effort. I deducted that it just was ghost touch.
I restarted it and the issue was gone - I doubt there was any hacking involved.
Way back in the early days of Android (pre Ice Cream Sandwich), I spoke to one co-worker who told me that when they looked at their Google Map app while driving it would show their actual physical car (and all the other surrounding vehicles etc.) on the satellite view - in motion - in real time.
No manner of attempts by me to state why this was impossible would dissuade them and they went away thinking I was the technical idiot as a result.
So “we are in control”?
Yeah, no.
This is what happens when folk think that shows like NCIS and their ilk are factual based docudramas.
Obligatory link: https://m.youtube.com/watch?t=14&v=u8qgehH3kEQ&feature=youtu...
Not sure it does matter at this point, these people paid $800 and now feel their device is heavily insecure, they need help and a explanation from official side they understand.
Case closed.
Admittedly, this was last year and the watch was already 4 years old.
