The Underground Company That Hacks iPhones for Ordinary Consumers

Researchers suspect the checkm8[dot]info service is used by criminals to launder stolen iPhones. The tool's administrator claims the service is just a response to Apple's poor right to repair policies. From a report: "Activation Lock," a message displayed across the iPhone's screen read. "This iPhone is linked to an Apple ID. Enter the Apple ID and password that were used to set up this iPhone." This lock essentially turns iPhones into very expensive paperweights until the owner enters the requested credentials. The feature is designed to stop anyone else from using the phone if it's lost, or thieves from making money by reselling a stolen device. In part, Activation Lock is intended to make iPhones less attractive to thieves because stolen devices can't be used.

Now, an underground group is offering people a way to strip that lock from certain iPhones with its pay-for-hacking service. iOS security experts suspect it is being used to remove protections from stolen iPhones. The hacking group called Checkm8[dot]info offering the service, which lifts its name from a popular free-to-use jailbreak, insists its tool cannot be used by thieves. "Our goal is the ability to repair electronics as it's the key to saving resources, tackling e-waste and environmental damage," the administrator of Checkm8[dot]info told Motherboard in an email. Motherboard has previously written about how criminals have used phishing emails to grab necessary login credentials to remove the Activation Lock. Checkm8[dot]info provides a much easier method, and appears to streamline what is ordinarily a complicated process into one that non-technical users can follow. Checkm8[dot]info is correct in that Activation Lock can be frustrating to iPhone repair professionals, electronic waste facilities, and refurbishers, and has caused many perfectly good phones obtained through legal means to be shredded or destroyed. A user of the Checkm8[dot]info site told Motherboard they used the service as part of their legal phone reselling business.

Of course they claim legitimacy

[Registered Coward v2]

What does anyone expect them to say? "We know thieves use our service but hey, $50 is $50 in our bank?"

Re:

[fermion]

A collary would be that Apple would make more money if there was a vibrant market for stolen phones. People donâ(TM)t go without a phone. If it was easy to sell stolen phones, more people would pay for the $300 applecare+ Then, of course you have to pay $200 to get a new phone.

Proof of purchase

[fermion]

The device lock is disabled by entering your Apple password. Apple has made changing the password easier, but it can still be a grueling experience if you only have the single Apple device as 2FA is a pop up on a working Apple device. But this is status qua as I was trying to make a $1 purchase on a Samsung device I have not used in a while and it took half an hour.

But I think the ultimate difficulty is being overstated. I was in an Apple store a while back where a customer was fighting this. In fact ever

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[evil_aaronm]

It doesn't even have to be stolen. I had a customer who had two iPhones of the same model, one with a broken screen, and another with a dodgy logic part - it's been a while; might've been a bad battery, but it was something I could repair, but they didn't want to. They wanted the intact screen placed on the other phone so they had at least one device that worked. IIRC, they were going to buy a new second phone. They said I could keep the logic part that wasn't working properly, so I did. It's just sitt

Re:

[dgatwood]

All they have to do is remove the device from their iCloud account [apple.com], and the phone should allow activation by anyone after that. They don't need to do anything on the device itself at all. Wiping the device and removing the activation lock takes just a few clicks if you're the legitimate owner unless you have also lost access to your iCloud account.

Re:

[sjames]

ID is easy for most people (and damned near impossible for a few who fall through the cracks), proof of purchase can be more difficult even if you are the one and only legitimate owner. Harder still if you legitimately bought the thing used from the original legitimate purchaser.

That's part of why many if not all states allow older cars to simply have a bill of sale rather than a title transfer.

I'm all for preventing theft, but I can't honestly say that the process isn't filled with corner cases where crack

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[account_deleted]

Comment removed based on user account deletion

Well, now

[93 Escort Wagon]

That's one poorly-written summary. Did it go through some sort of English-to-Bulgarian-to-Thai-to-English translator?

Re:

[davidwr]

Did it go through some sort of English-to-Bulgarian-to-Thai-to-English translator?
--
Randomly posting Futurama quotes on Slashdot since 2003

If "Did it go through some sort of English-to-Bulgarian-to-Thai-to-English translator?" isn't a Futurama quote, it should have been one.

I'm for it. Dad gave me his old iPad...

[zephvark]

Dad gave me his antique iPad. It still works fine, although it's a massively heavy device.

It has three security systems on it. Luckily, Dad is still around, and we managed to figure out the first two password levels.

The third? Nope. So, I can use the tablet but, I really don't want to connect it to the internet, because it may not be secure. It contains some of my Dad's financial information that Apple won't let me erase without the third password. Of course, they'll be glad to send a reset through a regist

Re:

[account_deleted]

Comment removed based on user account deletion