This is a very entertaining and educational article, giving insights into the methods used by thiefs to try and get access to your phone data.

I don’t like Apple but it’s great that their security is so good when it comes to this.

  • themoonisacheese@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    101
    arrow-down
    17
    ·
    7 months ago

    How so? A Samsung or pixel with default settings would also behave that way, possibly even more securely because it wouldn’t show the thieves your number.

    • Nurse_Robot@lemmy.world
      link
      fedilink
      English
      arrow-up
      63
      arrow-down
      18
      ·
      edit-2
      7 months ago

      I guess just anecdotally. I have a pixel 7, I’m pretty confident I could factory reset the device without 3rd party authentication. Also, from the tech channels I follow, I think I could recover my data if I forgot the password. Android has always felt more "free"and customizable, and I love it for that. But I also think that freedom allows for more exploits. It’s a trade off that’s worth it to me, personally. But if I had illegal shit to hide on my phone, I’d probably do it on an apple device.

      Edit: just checked. I can completely bypass all my locked down Google Pixel settings to factory reset my phone pretty easily if I press the right keys in the right order. It would be pretty easy to steal and resell my phone.

      • Midnight Wolf@lemmy.world
        link
        fedilink
        English
        arrow-up
        47
        arrow-down
        4
        ·
        7 months ago

        If you do it the manual way - not unlocking the phone and doing it through settings - you can wipe it sure, but when you try to set it up it requires the prior Google account credentials to proceed. No creds, no passing go, just a shiny brick. It’s been like that for years.

        Also might I recommend you take a gander at GrapheneOS for more intense security capabilities than stock.

        • Orygin@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          7 months ago

          Not sure about the latest Android version, but I managed to unlock and bypass a phone which had factory reset protection, and as far as I know a lot of vendors like Samsung have their own exploit available.
          Using this you can manage to get to the settings app (while still locked, waiting for the previous owners google account) and remove the account, add your own or disable the security.
          Done!

      • Avid Amoeba@lemmy.ca
        link
        fedilink
        English
        arrow-up
        33
        arrow-down
        1
        ·
        7 months ago

        You can factory reset it easily. You can’t use it without the previous Google account credentials afterwards. You can’t reuse a stolen Pixel which has Google account logged into it.

      • Thatuserguy@lemmy.world
        link
        fedilink
        English
        arrow-up
        14
        ·
        7 months ago

        For what it’s worth, they’re trying to fix that with Android 15. Not sure if this is one of the features they’ll also be back porting to older phones too like this article briefly touches on, but either way it sounds like if you factory reset the phone, it can’t be set up again unless they know your login: https://www.wired.com/story/android-15-theft-detection-lock/

        Google says in a blog post, the company is adding four data protection features that can help keep your information locked down. The first stops your phone from being set up after a factory reset, unless the person knows your login details. “This renders a stolen device unsellable, reducing incentives for phone theft,” Google vice president Suzanne Frey writes.

          • Midnight Wolf@lemmy.world
            link
            fedilink
            English
            arrow-up
            5
            ·
            7 months ago

            Yeah, I’ve had to wipe pixel devices the dirty way and it prompts (requires) your credentials to continue. Maybe it’s a pixel exclusive, and others are getting it via a15?

          • Thatuserguy@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            7 months ago

            Honestly not too familiar with that. I imagine if they’re touting this as a new thing, FRP either does something different or was lacking compared to this in some way.

            Though it is Google, they could have just killed FRP in favor of this and added messaging features like they do with everything else

      • Yamayo@lemmy.world
        link
        fedilink
        English
        arrow-up
        14
        arrow-down
        1
        ·
        7 months ago

        Edit: just checked. I can completely bypass all my locked down Google Pixel settings to factory reset my phone pretty easily if I press the right keys in the right order. It would be pretty easy to steal and resell my phone.

        Mind to share what “Keys in the right order” are? I mean a link, of course, because in my experience you just can’t do that with a locked bootloader.

        • devnull406@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          4
          ·
          7 months ago

          Enter recovery mode and choose factory reset. The specific key combination for your device may vary.

          • Yamayo@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            7 months ago

            You think we’re still in 2010? It’s been a while since you need to unlock the bootloader first. And no, you can’t do it with the device locked.

          • Quantum Cog@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            edit-2
            7 months ago

            This don’t work anymore, now they have frp protection which requires google authentication to the previous account after reset

      • lurch (he/him)@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        10
        ·
        7 months ago

        AFAIK you can’t wipe the IMEI and if you report it stolen to providers they will block it from using their networks. (It will only be able to use wifi.)

      • Shadow@lemmy.ca
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        3
        ·
        7 months ago

        Same for Samsung afaik. Pop into the bootloader and just wipe everything.

        • lurch (he/him)@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          11
          ·
          7 months ago

          AFAIK you can’t wipe the IMEI and if you report it stolen to providers they will block it from using their networks. (It will only be able to use wifi.)

        • Aceticon@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          ·
          7 months ago

          If recently upgraded an old Samsung tablet (Tab A6 from 2016) to Lineage OS and not only do you have to remove the Google Account before flashing just the TWRP to be able to just start replacing the actual OS, but there is a configuration flag that can only be changed in the stock OS logged in to that Google Account and with Dev Mode enabled to, after you replace the OS, allow the custom OS to actually work (if you don’t do it the device with the custom OS will go into a boot fail loop as soon as you restart it).

          It was actually a PITA to do that upgrade of my own device because of that (I had to reinstall the old OS and log in to the old account just to toggle the “Allow OEM install” option after which I could install Lineage OS … again … without the device going into a boot fail loop on the first restart)

          This is on a Samsung device that’s almost 8 years old so it would be a bit strange if they went back on it since, especially as it’s in the best interest of Samsung to make it hard for people to upgrade their devices away from the enshittified Samsung software.

      • Im pretty sure u cant fuck with a device that has a locked bootloader without unlocking said bootloader which requires u know the password. And u definatly cant recover data without passcode unless u can extract the hash from whatever chip holds it (shouldn’t be possible if u have a tpm) and bruteforce it. Ur data should be encrypted and u shouldn’t be able to tamper with os without unlocking bootloader which once unlocked will wipe all device data. Might be possible if u do some dodgy power injection directly into some of the chips but thats pretty advanced stuff.

      • steersman2484@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        2
        ·
        edit-2
        7 months ago

        The encryption on Android devices is pretty strong, as long as you use a good screen lock you should be fine. Yes they can reset you phone, but accessing your data is a whole other level.

        If I had illegal shit on my phone, I wouldn’t send it to apple servers by using an iPhone. They are the first who would comply with a surpena. I’d use GrapheneOS on a Pixel and use an obvious duress pin like 1234. If entered it wipes your encryption keys and avoids restoring your data.

        And if it gets stolen, it is gone and I’d get a new one. This is the cost of having proper opsec.

        Edit:

        But I also think that freedom allows for more exploits.

        This is a common misconception called security through obscurity

      • TrickDacy@lemmy.world
        link
        fedilink
        English
        arrow-up
        16
        arrow-down
        13
        ·
        edit-2
        7 months ago

        As everyone is pointing out you’re just wrong about this.

        Also apple is overbearing AF. I recently had several back and forths with my IT department about an old company mac laptop I used to have. Since I had signed into my apple account once, Apple permanently tied that laptop to my account and wouldn’t allow the fucking IT department to fully wipe it.

        Keep in mind also that I would have preferred to not have or use an apple account (they kind of force it on you, even asking you to login to iCloud constantly even if you’ve literally never used it once), and even though I could login to the apple account in my browser and see that the laptop wasn’t listed under my devices, IT was still locked out.

        Literally the only way to fix this was giving the IT dept my apple password so they could authenticate then sign out of it. There was nothing I could do remotely about it. This is a security issue in itself. Zero reason I shouldn’t be able to use my account remotely to remove or sign that device out. Zero reason I should have to give my password to another human. Except for apple being shit.

        The apple security theater is widely believed but it’s still largely theater.

        Edit: before you tell me I didn’t have to give up my password, understand that I fucking know that. I could’ve driven to the office, told my employer to fuck off, had them ship the laptop, etc… all of which are things that shouldn’t be necessary. I took the least shitty option at the time. Kindly fuck off if you are so dicksloppery on apple that you can’t understand the obvious point: pretending every shit decision is about security doesn’t shield you from all criticism.

        • matthewc@lemmy.world
          link
          fedilink
          English
          arrow-up
          17
          arrow-down
          4
          ·
          7 months ago

          Your post details how it isn’t possible for IT professionals to wipe a Mac without the consent of the owner’s account. How is that security theater?

          • Natanael@slrpnk.net
            link
            fedilink
            English
            arrow-up
            2
            ·
            7 months ago

            IT was the owner and obviously consented to their own actions.

            You didn’t read the post.

            You pretty much MUST use paid mobile device management tools to set up and administer company owned Apple hardware, and those tools are notoriously annoying and often just bad

              • Natanael@slrpnk.net
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                1
                ·
                7 months ago

                Read again - for most other devices there are cheap and often some free administration tools that small businesses can use. And for many devices they can just reinstall them. But for Apple devices pretty much everything is expensive or very limited.

          • TrickDacy@lemmy.world
            link
            fedilink
            English
            arrow-up
            9
            arrow-down
            8
            ·
            edit-2
            7 months ago

            You missed the part where I had to give my password to another human.

            Also, I wasn’t the owner, they are. Also, again, it makes zero sense to not allow me to sign it out remotely.

            Nothing is secure about a system designed so poorly you have to give out your password. That should never be needed.

            Not to mention, I never wanted or needed to sign in. I was just nagged to do so 100 times so I relented. Nothing about that means I own the device.

            • Fushuan [he/him]@lemm.ee
              link
              fedilink
              English
              arrow-up
              8
              arrow-down
              3
              ·
              7 months ago

              I’m with you that you should be able to log out remotely, but this is more of a failure in the IT department. You should have been given a PC with the apple ID already introduced, with your company mail and some password. How would they even access your PC remotely for security udpwtes if they didn’t have access to your appeal id? Right, they didn’t. So they gave a computer they didn’t have remote access to, not properly configured, and then forced you to either move or give private information.

              • TrickDacy@lemmy.world
                link
                fedilink
                English
                arrow-up
                7
                arrow-down
                5
                ·
                7 months ago

                You are absolutely incorrect. They had remote access and I watched them use it in various ways. When troubleshooting issues they would login and move my mouse and use a virtual keyboard. They could install software remotely on a schedule.

                Not sure why you’re under the impression that an apple account is required for remote management. There’s probably >5 different popular third party software solutions for that

                The apple sign in is an extraneous unneeded piece that once they annoy you into it, it then becomes considered a sign of ownership, which I never considered, because why would I?

                You are right that IT should’ve had a way of dealing with it better, but in their defense this may have been an anti-feature (asking a user to login to iCloud, a service they’ve never used once, is not a feature) added in an update, after they issued the laptop. It’s a small company, so I don’t fault them on it as much as the trillion dollar company with the goal of inflating their iCloud metrics by forcing users to login to it.

                • Fushuan [he/him]@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  7 months ago

                  Oh, I assumed that you would be forced to type your password or have enough rights to install stuff in a computer, be it in person or remotely, so I assumed that whatever 3rd party program they used required to have enough access, and that apple would use the apple id as a master password, given that it’s what is being used to lock down the device itself.

                  Well, yet another issue with apple lol, why add a ownership id if it’s not even what gives root access. Lmao.

                  • TrickDacy@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    3
                    arrow-down
                    2
                    ·
                    7 months ago

                    Nah the iCloud crap is literally just another account. Up until the moment you login to it, then it silently ties the device to that account for “security” purposes. I kept emailing the IT guy back saying I don’t know what I can do, I can see a list of devices here and that laptop has been removed from it.

                    After him asking me for help repeatedly I felt I had to just give up, give him the password on a slack call, then immediately reset it once he’d done what he needed.

              • TrickDacy@lemmy.world
                link
                fedilink
                English
                arrow-up
                4
                arrow-down
                6
                ·
                7 months ago

                I don’t have the type of position where that would be needed or considered appropriate. Why should I need to anyhow? A lot of people are missing the point here. Logging into a service (especially one I didn’t want or need but was harassed into doing it) should not unexpectedly be considered proof of ownership.

                The scenario wasn’t that during os setup I was asked to login. And I wasn’t prompted with a warning that this could happen. What happened was every time I opened system settings for months it wanted me to login to iCloud and no matter how many times I refused it just kept asking.

                • danl@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  11
                  arrow-down
                  3
                  ·
                  7 months ago

                  Nah - you’re complaining that you “were forced into handing your password to someone else” when there were at least six ways you could have avoided that:

                  • you gone to the computer,
                  • they send the computer to you,
                  • you remote in to the computer,
                  • you tell them “suck it, you should have blocked iCloud sign-in with MDM” or, as others mentioned,
                  • you sign out before handing the computer back or, my favourite,
                  • don’t sign in to personal accounts on work devices even if they bug you to.

                  Finally, we release devices like this all the time through our ABM account. It takes 5 days maximum. Your IT team led you up the garden path.

                  • Natanael@slrpnk.net
                    link
                    fedilink
                    English
                    arrow-up
                    3
                    arrow-down
                    2
                    ·
                    edit-2
                    7 months ago

                    It was a small company, as he said elsewhere, negating your first 4 options, and the last two of blaming the user are equally stupid because Apple can fix this and doesn’t want to. Not everybody has an MDM tool which can set up ownership right for Apple devices - and they should not have to

                    It’s shameful that you have a bunch of upvotes and he’s getting downvotes

                  • TrickDacy@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    5
                    arrow-down
                    8
                    ·
                    7 months ago

                    You are bending over backwards to justify absolute garbage practices. I am aware there were literally other ways around this. I was more referring to being forced into a situation where I’d even need to consider this.

                    Yes, I shouldn’t have used my personal account… however I also should have never expected doing so to tell apple “I own this shit please make sure no one else can use it ever without my permission”. Logging into iCloud should mean “I want to use iCloud”, which btw I NEVER wanted to do. Every time I opened system settings the piece of shit insisted I login to it. That alone is a problem. But I’m sure you’ll justify that one too.

              • Natanael@slrpnk.net
                link
                fedilink
                English
                arrow-up
                2
                arrow-down
                3
                ·
                7 months ago

                You should finish reading the part where the company owned the device.

                  • Saik0@lemmy.saik0.com
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    arrow-down
                    1
                    ·
                    7 months ago

                    Fortunately, apple and google corporate policy != law. If a company buys a device… and let’s an employee use it. There’s no amount of rules or policy that makes it the employee’s property. It’s company property. If you want to claim it’s employee property then you’d at the very least be lying to the IRS as it would be considered a form of payment.

                    The real unfortunate part is that Apple or Google will never be incentivized to fix it because in this case you as the employee would be on the hook for “theft”/bricking of the device.

            • BorgDrone@lemmy.one
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              3
              ·
              7 months ago

              Nothing is secure about a system designed so poorly you have to give out your password. That should never be needed.

              You didn’t have to give out your password, in fact you never should. If the machine remains locked, that’s not your problem. Your IT department should have created an admin account on the machine for IT before handing it over to you to avoid this scenario. The IT departments incompetence is not your problem.

              If you wanted to unlock it as a courtesy, then they should have offered to send the laptop to you so you could unlock it. You never ever give anyone your password, and IT should know better than to ask for it.

              If someone is holding a family member at gunpoint and threatening to kill them if you don’t give up your password; you do NOT give up your password. If an evil mastermind is about to destroy the world, and it can only be saved by you telling your password to another person. You do NOT give your password. There is no valid reason to ever give your password to anyone.

              • TrickDacy@lemmy.world
                link
                fedilink
                English
                arrow-up
                3
                arrow-down
                1
                ·
                edit-2
                7 months ago

                You missed the point entirely. Harassing me into signing into iCloud shouldn’t mean I ever have to do anything inconvenient at all, regardless.

                I wasn’t presented with a dialogue that said “login to establish device ownership”. Instead it was “login to iCloud now” dozens and dozens of times. I have never once used iCloud nor will I ever. That part alone was indefensible. But then locking the device to that account is plain stupid and reckless. There are plenty of scenarios where this fucks people worse than having to choose from a few shitty options

                • BorgDrone@lemmy.one
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  arrow-down
                  2
                  ·
                  7 months ago

                  I wasn’t presented with a dialogue that said “login to establish device ownership”.

                  There is an entire screen in the initial setup that explains that the machine is added to your Find My and what that means. You probably just clicked ‘continue’ without reading.

                  Also, you don’t have to do anything inconvenient. It’s not your laptop so not your problem. The owner can have activation lock removed if they provide proof of ownership to Apple.

                  • TrickDacy@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    arrow-down
                    1
                    ·
                    7 months ago

                    You really earn your “apple simp” tag. You know apple doesn’t give a fuck about you, actually.

                    And I really don’t care about your invalidations of what happened to me. If by some chance I did make some other mistake besides using my personal apple account, it’s irrelevant. I do not think it should be possible to accidentally opt in to this bullshit. It is a shitty feature to force on every user. And it shouldn’t be possible for an employee to render thousands of dollars worth of company hardware useless trash ready for the landfill. It shouldn’t be possible intentionally, let alone by accident. If you removed the apple schlong from you mouth for a second you might see my point but you won’t.

          • Fushuan [he/him]@lemm.ee
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            3
            ·
            7 months ago

            It’s more about the fact that they didn’t have a webpage in their apple account where they could remotely log out, and the IT department had the physical computer so they had to either move to the department or give the department their personal password, which is bogus. Being able to remotely log out of the computer doesn’t seem to be that big of an ask.

            I get thay the computer should remain locked if there’s no internet, but once the computer gain connectivity it should unlock if it was logged out in the user page.

            • matthewc@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              7 months ago

              I see what you’re saying. I agree that users should be able to remove device locks remotely. You can with iPhones. Hopefully that moves to all devices.

              I still prefer this to not having the lock at all.

        • Juvyn00b@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          7 months ago

          I get this as being a bit of a hurdle, but wouldn’t a good option in hind sight be to create a separate work related apple account based on your work email? I’ve done that in the past with various companies for iPhones and MacBooks. Makes it cleaner to return the device and doesn’t compromise my personal account should they ultimately need my credentials on the non-owned-by-me device.

          • TrickDacy@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            arrow-down
            3
            ·
            7 months ago

            I eventually did do that, but apparently at the time that I was nagged into iCloud for the 1000th time I was quite annoyed and just used my personal account like an idiot.

          • TrickDacy@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            4
            ·
            7 months ago

            The thing is, I never expect logging into a service to immediately lock my device to that account. But I’ve since learned not to trust Apple’s login systems for this reason. So yeah, I won’t buy any other apple devices and any work machines will use a work account for everything like that

        • BeardedBlaze@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          4
          ·
          7 months ago

          Your “IT” could’ve literally do fresh install of MacOS. I’m not a fan of Apple, but that’s just silly.

          • TrickDacy@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            7 months ago

            Pretty sure that’s what they were trying to do. I know for sure that on iPhones, if you ever sign in (which I think is required), wiping the phone doesn’t matter, it’s still locked to that account somehow – a ROM chip on the board stores the account info somehow I think? I think their computers work the same way now.

            On other systems, logging in means that: you’ve logged in. And you should be right: wiping the OS should always remove any login/account status. If Apple wants to provide some system like this for people worried about theft, cool, let them opt into it. But don’t force every user to.

    • Monument@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      27
      arrow-down
      1
      ·
      edit-2
      7 months ago

      iPhones don’t do that on their own.

      She said she activated lost mode, so it’s possible/likely she made her contact info available. Asking Siri who the phone belongs to will also give up contact info, but you can change that remotely from the find my phone app.

      I think - being a writer - she sort of set herself up for the interaction so she would have material. No judgment, though. It was an interesting read.

    • jol@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      5
      ·
      7 months ago

      As far as I know factory resetting an android phone is relatively easy without having access to the device. But it’s been a while since I’ve looked I hti that.

    • SeaJ@lemm.ee
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      2
      ·
      7 months ago

      You can fairly easily factory reset phones from both. While you can report your phone as stolen and the IMEI will be blacklisted on US carriers, it would probably work fine abroad.

      • DrinkMonkey@lemmy.ca
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 months ago

        For iPhones, if you have Find My turned on, you can’t activate the device without the iCloud password, unless the owner removes the device from their iCloud account. Which is what the scammers are trying to get her to do here.

        • SeaJ@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          7 months ago

          Sorry. When I said “both,” I meant Google and Samsung. Apple definitely has better security, ocassionally to an annoying extent.