Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #102213 > unrolled thread

Fake Email From Apple

Back to article view | Back to comp.sys.mac.system

Contents

  Fake Email From Apple csampson@inetworld.net (Charles H. Sampson) - 2017-03-11 18:23 -0800
    Re: Fake Email From Apple nospam <nospam@nospam.invalid> - 2017-03-11 21:24 -0500
    Re: Fake Email From Apple Lewis <g.kreme@gmail.com.dontsendmecopies> - 2017-03-12 16:17 +0000
      Re: Fake Email From Apple dcohenspam@talktalk.net (Daniel Cohen) - 2017-03-14 09:48 +0000
        Re: Fake Email From Apple nospam <nospam@nospam.invalid> - 2017-03-14 06:00 -0400
        Re: Fake Email From Apple befr@eaglesoft.de (Bernd Fröhlich) - 2017-03-14 11:36 +0100
        Re: Fake Email From Apple Jolly Roger <jollyroger@pobox.com> - 2017-03-14 16:02 +0000
        Re: Fake Email From Apple dorayme <do_ray_me@bigpond.com> - 2017-03-15 07:28 +1100
    Re: Fake Email !From Apple David Ritz <dritz@mindspring.com> - 2017-03-12 12:50 -0500
      Re: Fake Email !From Apple nospam <nospam@nospam.invalid> - 2017-03-12 13:51 -0500
        Re: Fake Email !From Apple David Ritz <dritz@mindspring.com> - 2017-03-12 17:30 -0500
          Re: Fake Email !From Apple nospam <nospam@nospam.invalid> - 2017-03-12 18:33 -0400
            Re: Fake Email !From Apple dorayme <do_ray_me@bigpond.com> - 2017-03-13 16:38 +1100
        Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-12 22:45 +0000
          Re: Fake Email !From Apple Alrescha <alrescha@gmail.com> - 2017-03-12 18:55 -0400
            Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-13 00:39 +0000
              Re: Fake Email !From Apple Alrescha <alrescha@gmail.com> - 2017-03-12 21:03 -0400
                Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-13 01:28 +0000
                  Re: Fake Email !From Apple Alrescha <alrescha@gmail.com> - 2017-03-13 00:39 -0400
                    Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-13 17:37 +0000
                      Re: Fake Email !From Apple dempson@actrix.gen.nz (David Empson) - 2017-03-14 09:58 +1300
                        Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-14 21:05 +0000
                          Re: Fake Email !From Apple Alrescha <alrescha@gmail.com> - 2017-03-14 17:41 -0400
                            Re: Fake Email !From Apple Jolly Roger <jollyroger@pobox.com> - 2017-03-14 21:50 +0000
                              Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-15 05:20 +0000
                                Re: Fake Email !From Apple Jolly Roger <jollyroger@pobox.com> - 2017-03-15 15:07 +0000
                                  Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-15 16:07 +0000
                                    Re: Fake Email !From Apple Jolly Roger <jollyroger@pobox.com> - 2017-03-15 16:34 +0000
                                      Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-15 17:58 +0000
                                        Re: Fake Email !From Apple Jolly Roger <jollyroger@pobox.com> - 2017-03-15 19:32 +0000
                                        Re: Fake Email !From Apple Lewis <g.kreme@gmail.com.dontsendmecopies> - 2017-03-18 14:51 +0000
                          Re: Fake Email !From Apple dempson@actrix.gen.nz (David Empson) - 2017-03-15 13:21 +1300
                  Re: Fake Email !From Apple Nelson <nelson@nowhere.com> - 2017-03-13 04:28 -0400
                    Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-13 17:31 +0000
                      Re: Fake Email !From Apple Nelson <nelson@nowhere.com> - 2017-03-13 14:30 -0400
                        Re: Fake Email !From Apple Nelson <nelson@nowhere.com> - 2017-03-13 15:17 -0400
                          Re: Fake Email !From Apple "David B." <DavidB@nomail.afraid.invalid> - 2017-03-13 23:33 +0000
          Re: Fake Email !From Apple dempson@actrix.gen.nz (David Empson) - 2017-03-13 14:36 +1300
            Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-13 03:54 +0000
              Re: Fake Email !From Apple Alrescha <alrescha@gmail.com> - 2017-03-13 00:35 -0400
              Re: Fake Email !From Apple Nelson <nelson@nowhere.com> - 2017-03-13 05:04 -0400
                Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-13 17:27 +0000
              Re: Fake Email !From Apple Lewis <g.kreme@gmail.com.dontsendmecopies> - 2017-03-13 14:13 +0000
                Re: Fake Email !From Apple JF Mezei <jfmezei.spamnot@vaxination.ca> - 2017-03-13 11:59 -0400
              Re: Fake Email !From Apple dempson@actrix.gen.nz (David Empson) - 2017-03-14 09:58 +1300
                Re: Fake Email !From Apple Patty Winter <patty1@wintertime.com> - 2017-03-14 21:09 +0000
                  Re: Fake Email !From Apple JF Mezei <jfmezei.spamnot@vaxination.ca> - 2017-03-14 17:53 -0400
                    Re: Fake Email !From Apple Jolly Roger <jollyroger@pobox.com> - 2017-03-14 23:40 +0000
                  Re: Fake Email !From Apple dempson@actrix.gen.nz (David Empson) - 2017-03-15 13:21 +1300
          Re: Fake Email !From Apple Lewis <g.kreme@gmail.com.dontsendmecopies> - 2017-03-13 14:10 +0000
    Re: Fake Email From Apple JF Mezei <jfmezei.spamnot@vaxination.ca> - 2017-03-12 17:27 -0400

Page 1 of 3  [1] 2 3  Next page →

#102213 — Fake Email From Apple

I recently got a couple of emails from Apple titled "Your Apple ID was
used to sign in to FaceTime on an iPhone 5: and "Your Apple ID was used
to sign in to iCloud on an iPhone 6". Now I don't have any model of
iPhone and I didn't remember setting up an Apple ID, or using iCloud or
FaceTime. So I figured that somebody was impersonating me and I should
probably put a stop to it. I clicked on the supplied link and after a
minute of so I noticed that I was at a web site whose URL ended in .ru.
I closed that window immediately.

Did they plant a Trojan Horse? So far, no trouble, but a Trojan Horse
could be lurking until some future date. I happen to have a recent
backup (3:00 a.m. this morning) but wiping out everything and restoring
it would be a pain.

Charlie
-- 
Nobody in this country got rich on his own.  You built a factory--good.
But you moved your goods on roads we all paid for.  You hired workers we
all paid to educate. So keep a big hunk of the money from your factory.
But take a hunk and pay it forward.  Elizabeth Warren (paraphrased)

[toc] | [next] | [standalone]

#102214

In article <1n2qiyq.84ctq8teexd6N%csampson@inetworld.net>, Charles H.
Sampson <csampson@inetworld.net> wrote:

> I recently got a couple of emails from Apple titled "Your Apple ID was
> used to sign in to FaceTime on an iPhone 5: and "Your Apple ID was used
> to sign in to iCloud on an iPhone 6". Now I don't have any model of
> iPhone and I didn't remember setting up an Apple ID, or using iCloud or
> FaceTime. So I figured that somebody was impersonating me and I should
> probably put a stop to it. I clicked on the supplied link and after a
> minute of so I noticed that I was at a web site whose URL ended in .ru.
> I closed that window immediately.
> 
> Did they plant a Trojan Horse? So far, no trouble, but a Trojan Horse
> could be lurking until some future date. I happen to have a recent
> backup (3:00 a.m. this morning) but wiping out everything and restoring
> it would be a pain.

highly unlikely. they wanted you to log into your apple id account so
they could get your password.

[toc] | [prev] | [next] | [standalone]

#102226

In message <1n2qiyq.84ctq8teexd6N%csampson@inetworld.net> Charles H. Sampson <csampson@inetworld.net> wrote:
> I recently got a couple of emails from Apple

No you didn't.

> I clicked on the supplied link

Never click a link in an email.

-- 
It was all very well going about pure logic and how the universe was
ruled by logic and the harmony of numbers, but the plain fact was that
the disc was manifestly traversing space on the back of a giant turtle
and the gods had a habit of going round to atheists' houses and smashing
their windows.

[toc] | [prev] | [next] | [standalone]

#102293

Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:

> Never click a link in an email.

I wish legit firms made it easier to avoid clicking on links when they
make special offers.

Case in point. A recent email from Micromat with an offer for anupgrade
to TechTool Pro with a link to click.

No, I didn't click the link, I went direct to the Micromat site but the
offer wasn't on the site. So I emailed Micromat sales to enquire if the
email was genuine.

They confirmed that it was and that the link was the only way to get the
offer.

And there are plenty of other similar cases.
-- 
<http://www.decohen.com>
The Labyrinth of the Heart: Changed Myths for Changing Lives 
book and e-book <http://www.decohen.com/labyrinth.htm>
Send e-mail to the Reply-To address, not the From address.

[toc] | [prev] | [next] | [standalone]

#102295

In article <1n2te7i.n4tsg01v36dy9N%dcohenspam@talktalk.net>, Daniel
Cohen <dcohenspam@talktalk.net> wrote:

> > Never click a link in an email.
> 
> I wish legit firms made it easier to avoid clicking on links when they
> make special offers.
> 
> Case in point. A recent email from Micromat with an offer for anupgrade
> to TechTool Pro with a link to click.
> 
> No, I didn't click the link, I went direct to the Micromat site but the
> offer wasn't on the site. So I emailed Micromat sales to enquire if the
> email was genuine.
> 
> They confirmed that it was and that the link was the only way to get the
> offer.

they could have sent a unique promo code to those targeted for the
offer, the way other companies do it.

if it was an upgrade offer for an existing product, then use the serial
number of the previous version, which the recipient of the email
already has, so no unique code or link would be needed.

> And there are plenty of other similar cases.

none that are worthwhile.

[toc] | [prev] | [next] | [standalone]

#102296

Daniel Cohen <dcohenspam@talktalk.net> wrote:

> Case in point. A recent email from Micromat with an offer for anupgrade
> to TechTool Pro with a link to click.

I was a TechTool Pro user too.
One of the reasons they lost me was their terrible emails.

[toc] | [prev] | [next] | [standalone]

#102302

On 2017-03-14, Daniel Cohen <dcohenspam@talktalk.net> wrote:
> Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>
>> Never click a link in an email.
>
> I wish legit firms made it easier to avoid clicking on links when they
> make special offers.
>
> Case in point. A recent email from Micromat with an offer for anupgrade
> to TechTool Pro with a link to click.
>
> No, I didn't click the link, I went direct to the Micromat site but the
> offer wasn't on the site. So I emailed Micromat sales to enquire if the
> email was genuine.
>
> They confirmed that it was and that the link was the only way to get the
> offer.
>
> And there are plenty of other similar cases.

It's very easy to verify that a message is legitimate by examining the
headers and looking to see where the links actually point. I don't see a
problem.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#102317

In article <1n2te7i.n4tsg01v36dy9N%dcohenspam@talktalk.net>,
 dcohenspam@talktalk.net (Daniel Cohen) wrote:

> Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> 
> > Never click a link in an email.

Or go out in the dark, or on your own... 

What crap!

-- 
dorayme

[toc] | [prev] | [next] | [standalone]

#102228 — Re: Fake Email !From Apple

On Saturday, 11 March 2017 18:23 -0800, 
 in article <1n2qiyq.84ctq8teexd6N%csampson@inetworld.net>, 
 Charles H. Sampson <csampson@inetworld.net> wrote:

> I recently got a couple of emails from Apple titled "Your Apple ID was
> used to sign in to FaceTime on an iPhone 5: and "Your Apple ID was used
> to sign in to iCloud on an iPhone 6".

As others have pointed out, this was a phish, attempting to convince 
you to provide your Apple ID credentials.  Apple ID phishing has 
jumped substantially over the last couple of months.  It's worth being 
aware of this and constantly wary.

-- 
David Ritz <dritz@mindspring.com>
 Never underestimate the gullibility of the average user.

[toc] | [prev] | [next] | [standalone]

#102229 — Re: Fake Email !From Apple

In article <alpine.OSX.2.20.1703121243590.92604@mako.ath.cx>, David
Ritz <dritz@mindspring.com> wrote:

> > I recently got a couple of emails from Apple titled "Your Apple ID was
> > used to sign in to FaceTime on an iPhone 5: and "Your Apple ID was used
> > to sign in to iCloud on an iPhone 6".
> 
> As others have pointed out, this was a phish, attempting to convince 
> you to provide your Apple ID credentials.  Apple ID phishing has 
> jumped substantially over the last couple of months.  It's worth being 
> aware of this and constantly wary.

no need to be wary at all. 

enable 2 factor authentication and eliminate the risk.

[toc] | [prev] | [next] | [standalone]

#102237 — Re: Fake Email !From Apple

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sunday, 12 March 2017 13:51 -0500,
 in article <120320171351537547%nospam@nospam.invalid>,
 nospam <nospam@nospam.invalid> wrote:

On Sun, 12 Mar 2017, nospam wrote:

> In article <alpine.OSX.2.20.1703121243590.92604@mako.ath.cx>, David
> Ritz <dritz@mindspring.com> wrote:

>>> I recently got a couple of emails from Apple titled "Your Apple ID
>>> was used to sign in to FaceTime on an iPhone 5: and "Your Apple ID
>>> was used to sign in to iCloud on an iPhone 6".

>> As others have pointed out, this was a phish, attempting to
>> convince you to provide your Apple ID credentials.  Apple ID
>> phishing has jumped substantially over the last couple of months.
>> It's worth being aware of this and constantly wary.

> no need to be wary at all.

> enable 2 factor authentication and eliminate the risk.

And all along, I thought using two factor authentication was being
wary.

- -- 
David Ritz <dritz@mindspring.com>
 Be kind to animals; kiss a shark.

-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAljFzA4ACgkQUrwpmRoS3utpKQCdHtzDMArcL7AO5cMSjNblsLua
HHAAoMxZZ8ZfE2H3ffO+TYqVXPbyhz+T
=Yr9p
-----END PGP SIGNATURE-----

[toc] | [prev] | [next] | [standalone]

#102238 — Re: Fake Email !From Apple

In article <alpine.OSX.2.20.1703121729200.92604@mako.ath.cx>, David
Ritz <dritz@mindspring.com> wrote:

> >>> I recently got a couple of emails from Apple titled "Your Apple ID
> >>> was used to sign in to FaceTime on an iPhone 5: and "Your Apple ID
> >>> was used to sign in to iCloud on an iPhone 6".
> 
> >> As others have pointed out, this was a phish, attempting to
> >> convince you to provide your Apple ID credentials.  Apple ID
> >> phishing has jumped substantially over the last couple of months.
> >> It's worth being aware of this and constantly wary.
> 
> > no need to be wary at all.
> 
> > enable 2 factor authentication and eliminate the risk.
> 
> And all along, I thought using two factor authentication was being
> wary.

it isn't.

[toc] | [prev] | [next] | [standalone]

#102251 — Re: Fake Email !From Apple

In article <120320171833342965%nospam@nospam.invalid>,
 nospam <nospam@nospam.invalid> wrote:

> In article <alpine.OSX.2.20.1703121729200.92604@mako.ath.cx>, David
> Ritz <dritz@mindspring.com> wrote:
> 
...

> > > no need to be wary at all.
> > 
> > > enable 2 factor authentication and eliminate the risk.
> > 
> > And all along, I thought using two factor authentication was being
> > wary.
> 
> it isn't.

Even worse than being plain wrong is your pissing competition 
instincts harnessed to your complete lack of humour.

-- 
dorayme

[toc] | [prev] | [next] | [standalone]

#102239 — Re: Fake Email !From Apple

In article <120320171351537547%nospam@nospam.invalid>,
nospam  <nospam@nospam.invalid> wrote:
>
>enable 2 factor authentication and eliminate the risk.

A few minutes ago, I began a login iCloud on my MacBook. Same computer,
same web browser as always, yet for some reason TFA got triggered. My
iPhone beeped to let me know about the code I needed. A moment later,
the required six-digit code for my MacBook appeared on another device--
my MacBook. I typed it in and got logged in to iCloud. Never had to
reach for the iPhone on the table. 

Clearly, this is not how things are supposed to work. Either Apple's
security system knew that Firefox on this computer was trusted, and
therefore shouldn't have demanded a verification code, or if it really
thought that this system wasn't trusted, then it shouldn't have sent a
verification code to it. It's as though one security database isn't
talking to another one.


Patty

[toc] | [prev] | [next] | [standalone]

#102240 — Re: Fake Email !From Apple

On 2017-03-12 22:45:16 +0000, Patty Winter <patty1@wintertime.com> said:

> Either Apple's security system knew that Firefox on this computer was 
> trusted, and therefore shouldn't have demanded a verification code, or 
> if it really thought that this system wasn't trusted, then it shouldn't 
> have sent a verification code to it.

Firefox on your system is not the same as your system.

It is also not clear how that message got sent to your MacBook - was it 
a forwarded text message?  (that would imply you are using two-step 
authentication rather than two-factor - see:  
https://support.apple.com/en-us/HT204152 )

A.

[toc] | [prev] | [next] | [standalone]

#102241 — Re: Fake Email !From Apple

In article <oa4jg2$a0i$1@dont-email.me>, Alrescha  <alrescha@gmail.com> wrote:
>On 2017-03-12 22:45:16 +0000, Patty Winter <patty1@wintertime.com> said:
>
>> Either Apple's security system knew that Firefox on this computer was 
>> trusted, and therefore shouldn't have demanded a verification code, or 
>> if it really thought that this system wasn't trusted, then it shouldn't 
>> have sent a verification code to it.
>
>Firefox on your system is not the same as your system.

TFA verifies specific browsers that you use on a given computer:

https://support.apple.com/en-us/HT204915

"When you sign in on the web, you can choose to trust your browser, 
so you won't be asked for a verification code the next time you sign 
in from that computer."


>It is also not clear how that message got sent to your MacBook - was it 
>a forwarded text message?  

No, the code just appeared on the computer's screen, over the boxes
where the code numbers were supposed to be entered. I memorized the
numbers, clicked to close that little window, then entered the numbers
into the boxes in the other little window. :-)


Patty

[toc] | [prev] | [next] | [standalone]

#102242 — Re: Fake Email !From Apple

On 2017-03-13 00:39:38 +0000, Patty Winter <patty1@wintertime.com> said:
> In article <oa4jg2$a0i$1@dont-email.me>, Alrescha  <alrescha@gmail.com> wrote:
>> On 2017-03-12 22:45:16 +0000, Patty Winter <patty1@wintertime.com> said:
>> 
>>> Either Apple's security system knew that Firefox on this computer was
>>> trusted, and therefore shouldn't have demanded a verification code, or
>>> if it really thought that this system wasn't trusted, then it shouldn't
>>> have sent a verification code to it.
>> 
>> Firefox on your system is not the same as your system.
> 
> TFA verifies specific browsers that you use on a given computer:

You wanted to authorize a copy of Firefox to talk to iCloud.

Two factor authentication means you need two things to authentic.  In 
this case, in order to authorize Firefox, you needed to know something 
(your Apple-ID password) and you needed to have something (a trusted 
device: your MacBook, or your iPhone).

The fact that the copy of Firefox which you wanted to authenticate 
happened to be running on your MacBook is not relevant.  Nor should 
Apple have made any assumptions about whether you wanted to trust it or 
not.

A.

[toc] | [prev] | [next] | [standalone]

#102243 — Re: Fake Email !From Apple

In article <oa4qv8$1t7$1@dont-email.me>, Alrescha  <alrescha@gmail.com> wrote:
>
>You wanted to authorize a copy of Firefox to talk to iCloud.
>
>Two factor authentication means you need two things to authentic.  In 
>this case, in order to authorize Firefox, you needed to know something 
>(your Apple-ID password) and you needed to have something (a trusted 
>device: your MacBook, or your iPhone).

So the computer was trusted but the browser wasn't? How could the
computer be trusted when the only way I've ever signed on to iCloud
from it was via the browser? And why wouldn't Firefox be trusted
when I've been using it to access the Web (including iCloud) since 
I bought this computer couple of years ago?


Patty

[toc] | [prev] | [next] | [standalone]

#102250 — Re: Fake Email !From Apple

On 2017-03-13 01:28:43 +0000, Patty Winter <patty1@wintertime.com> said:

> How could the computer be trusted when the only way I've ever signed on 
> to iCloud from it was via the browser?

I do not think this is possible.  Are you saying you have never signed 
into iCloud in System Preferences on this device?

A.

[toc] | [prev] | [next] | [standalone]

#102274 — Re: Fake Email !From Apple

In article <oa57k6$n4v$1@dont-email.me>, Alrescha  <alrescha@gmail.com> wrote:
>On 2017-03-13 01:28:43 +0000, Patty Winter <patty1@wintertime.com> said:
>
>> How could the computer be trusted when the only way I've ever signed on 
>> to iCloud from it was via the browser?
>
>I do not think this is possible.  Are you saying you have never signed 
>into iCloud in System Preferences on this device?

I didn't even know that was possible. I consider iCloud to be a website
and had never looked for any other way to log in to it than by going to
icloud.com with a web browser. 

I think maybe there's an option to sign in to iCloud when one sets up
a Mac for the first time, so I may (or may not) have done that when I
upgraded this MacBook to Sierra several months ago. Maybe that cookie
is persistent but browser verifications aren't?


Patty

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.sys.mac.system

csiph-web