Bitcoin Forum

Disable iCloud automatic backups in your iPhone or apple product if you are running any crypto wallets on the phone, why? iCloud will make your encrypted vault password available online, meaning if someone or an hacker phishes your ICloud credentials your fund will vanish into thin air.

https://i.imgur.com/HlANdos.jpeg

The idea of Icloud storage is only good gallery and Media, passwords private keys and seed  phrase or recovery seed shouldn't be store in such places.
I was going through the tweets thread and my mind was a bit scared with things I have been hiding on my Icloud right before I took my privacy serious. So I checked my Icloud and there was an Altcoin wallet I installed back then and ignorant me, I backedup the private key to the Icloud( the developers enable the option backup to my private key to Icloud).

https://i.ibb.co/WgpwMVF/9-BCADAE2-B397-4685-80-A7-62-AFD63787-BE.jpg

The wallet was no longer on my phone and I decided to installed the app on my device to test the magic. I installed  the app, I allowed the face ID and the next thing that pop up was the options to login with my previous account or to import new account. The app had access to my Icloud.

https://i.ibb.co/0FGY44K/1-C50554-A-0325-4-B20-98-CC-45-DDFCD1-DD20.jpg

I selected the previous account and that's was how my previous staking transactions pop out, there was no nothing in the wallet as I have already sent them back to an exchange.

I have did one thing with the Icloud backedup private keys....DELETE

https://i.ibb.co/0mkssF6/8598332-A-7429-4055-829-E-133639-F5-E266.jpg

The data has been deleted from my cloud. Such things are not meant for any third party, it should only be on your custody, you can mistakenly lose your password to another person, your Apple ID AND PASSWORD will make you loss everything, including privacy once  anyone has access to them.
You can see the amount of stolen ethereum that was announced by Metamask, is possible that such exploit is still going on. while Apple has promised you that your data are encrypted, note anything encrypted can be decrypt.
Stay safe.

And do you now really believe that everything that you decided to delete has been deleted? It's the internet, mate. Everything that fell into the clutches of the iPhone and Apple is never deleted. They just give you the illusion of security, nothing more. Surveillance and more spying on users, that's the motto of this company.

Only the uninformed will believe Icloud to be a preserve place for security. Delete may not be the best measure but I want my mind to out of that place and any sensitive data. I don't have anything on the private keys, the least I worry now is the privacy I have exposed but that's fine. I wish internet could have futures to disable many things. :-\

Yes you are right, you can even recover all deleted files on iCloud, that means that anyone that have access to your iCloud account can still try to recover deleted files from that same account, its not recommendable to use iPhones to store recovery seeds and private keys, I won't even dare open a trust wallet on such platform.

I do know that and i never enable icloud caused by this potentially fucked me when i didn't aware if my password or a sensitive data gets stored into my icloud. The best way to store your media but it's not for your data. I personally always disable any cloud storage when i will be using this device to store my data caused by it's all a very important data for sure. Even when it says already deleted but yeah apple is having your data permanently.
In my opinion if this is a very bad thing to be enabled when someone decide to use apple device as his main desktop to work.

If iPhone could be that dangerous why not get and android phone for any mobile wallet installation or windows to slime the chances of being hacked and compromised device. most at time we don't have to allow autosave maybe could be one bad thing will happened us whereby user data could be fitch and empty their wallets.

The reality is that there is nothing wrong with metamask on ios, or ios itself. The core problem is that people are not protecting their crypto currency wallets as they ought too. They call is seed phrase, paper wallet with an instruction that says store it where no one else can see it; why upload your seed phrases to cloud storage ? Clipboard storages are well prohibited, but we see guys who pin private keys to their clip board too. either android or ios, keep your seed phrases far from cloud storage

People arent really that tech savy most of us will learn the hard way. I also started in crypto by saving my bitcoin private key on gmail.

I also used exchanges as my personal wallet most of us dont even know how to avoid viruses.

Never use the Cloud for saving anything that has connection with assets and money. I learned about that Cloud with a friend who is looking for help to fix his Iphone. I tried and was surprised I could see all his passwords just by opening the Cloud. It's not safe, I'd rather stick with my Android and use a memory device to save some information but still never the passwords.
The best option is to write it down and burglary will be the only thing you should be worried about in case they know you own cryptos.

online storage "Icloud or anything" related to digital assets is indeed very dangerous if it is successfully hacked.
never use the cloud to store crypto-related assets. or store in any cloud that is online data storage.
it is better if the password or password is stored offline, that is, by writing it in a book or small note that you keep in a safe place that only you know.
stay alert and be careful storing keywords.

Once you enable automatic function to store your data to the icloud and this will become a disaster for sure. thank you for OP as this thread is very useful for anyone. As long as someone can keep their icloud securely and that will be fine if he was storing his data into the icloud but when he can't keep it secure and this will become a horrible thing for sure as his data may be downloaded by hacker and then it will be hacked. All of money in the wallet will be stolen. It's better to store any data into the offline hardware

Due to security leak in MetaMask, someone lost $650,000 worth of NFTs in a phishing attack : https://twitter.com/revive_dom/status/1514751885126914051
The full story was published days ago : https://watcher.guru/news/metamask-warns-apple-users-as-a-man-lost-650000-in-a-phishing-scam
The most impressive part is that there is no reply from Apple company about this Metamask warning. Neither from MetaMask team as well who should be aware about the case.

You didn't post the tweet fully which includes the way to disable it.

Here is the full reference:


I think not strong enough Metamask password also plays its parts here. In the first scenario, if some users got their iCloud creds leaked, it is safe to say that likely the user didn't have a good enough security awareness. I won't be surprised if both credentials have similarities.

---

The word of promise and encryption itself is contradictory. After all, we can't be sure that Apple didn't have any master key for their products :-\

What are you talking about? any material support this case ?

The suspect of this case, is mostly brute force data or phishing. Example brute force data, while you have the same information (one for all) like your password. So, example some marketplace getting data breach.

The buyer data, can tested to different platform to see if user also set up a same password for other too.

This is correct, it is because of this that any sensitive information should never be stored in a smartphone, at least with a Desktop PC there are some OS that do not have integrated spyware or bloatware that you do not need or want.

Apple is infamous for storing information their users never wanted to share to begin with, so while a mobile wallet could make sense as a wallet in which you keep a small amount of capital to spend online, it must never be the main wallet in which you store your coins or from which you make important movements since it is simply impossible to secure it properly.

Encrypted data? Then what is the point of encryption at all and this is another proof to the Apple lovers to realize it is also not safe and no matter anything is 100% secure when its connected to internet. Is there any reply from the Apple company about this Metamask warning?

Thanks for sharing up!

Pretty much sure that there are lots of users of Iphone arent really that mindful about having that icloud back up but honestly bypassing someones password of your Icloud credentials isnt something that
easy to be done therefore i dont really mind much about security issue about this but its better to be safe than sorry.Its never been good on making out some storage of your coins or assets
on a mobile phone specially if we do talk about large sums because you wont know on what would happen next.

Thanks for the warning, this is very important. You should not store any important data on the Internet, even if it is encrypted, because this is very dangerous and can expose your data to hacking and stealing your wallet and accounts. Personally, I do not store any data on the Internet, but I write it on paper and disable the feature Save data to cloud storage because it is very possible that your data storage site will be hacked and then you may lose all your assets.

Whenever I hear the word "cloud", I always steer clear any means to access my money from it. I won't even include my personal information to it, even if they claim that they do not access whatever you store there.

---

Always remember that if a platform is being managed or was coded by somebody, assume that you are willing to give them whatever you put it in there.

It is the reason why people shouldn't be saving their keys in a cloud storage. A lot must learn from this that if you ever save your keys or seeds on the cloud, you're really prone to this even the software or system you use is very secured. There's always a possible flaw and hole in these systems that would really be able to target those important details or screenshots of your keys. This common act is making these hackers aware of what they must do through social engineering.

The Metamask team should monitor the effects of certain apps or features in all types of phones. This may not have been discovered it there wasn't a victim. Poor lad losing all that money but it's also his fault for not using more secure wallets.

Actually, it's not just for iCloud. Applies to all cloud backups. I pay attention to the people around me, they provide everything from their photos to password backups on cloud uploads. But hijacking these accounts means stealing everything that belongs to you at once. That's why I put both encryption and fingerprint recognition on all my wallet applications. I write down private keys in a notebook and then I do not use these keys anywhere unless necessary. I recommend this to you too.

Isn't the metamask password has been encrypted ? How about other wallets on my phone ?
For example i use trust wallet on my phone, will icloud automatically save the credential of my trust wallet too ?
We should be able to setting the cloud backup so not all the data in our phone automatically getting uploaded to the cloud.

So, basically never use any cloud storage to store anything regarding money and related data. It is not safe anyway, they are easily hackable, so quite risky.

Thank you for sharing this one, I already disable it a year ago I am not really fan of any automatic online backups since I am not comfortable storing my information or any of my files online and we are not sure whether that website or storage is safe or not including the dropbox of the Apple.

Are there any similar case for android users? This should be  at the top of discussion, most users are android and installed Metamask on their phones. Oh my, I was planning to buy an Iphone, icloud is a very nice features especially when you've lost your apple gadget. I wouldn't dare to turn it off, I was using iphone way back before I entered crypto but I am not aware of this until now.

You better turn off auto backup on your phone and never give OTP to any stranger. The victim in this case is he has backed up everything on iCloud and he gets a request to change his apple id password. He carelessly did not check carefully and gave the OTP code to the hacker, the hacker accessed the victim's iCloud and stole the metamask data.

As long as you don't give your password or OTP to anyone, including support staff from the company. You will still be safe, but it is best to buy yourself a cold wallet to ensure safety.

this is great information basically it helps many of us that doesn’t even have a clue that apple is literally keeping our passwords in their service from losing our assets.
just imagine someone saving up their investment in wallet using apple products and turns out the asset gone just because apple is trying forcing their service, I think if i remember correctly android also saves some password in their service but I could be wrong since I haven’t used android anymore for quite sometimes but I know that gdrive is kinda similar with apple iclouds. regardless i think these service providers like the big company apple and google should give options for usage of their service and gives warning beforehand.

Mobile wallets can also have additional fingerprints and password patterns for security, as well as metamasks which can also add additional security to your PC or laptop.
So there is no need to worry about this because there has never been any problem so far related to it.

Different varieties of scam coming in everyday i hope no one falls victim to such scam. Thanks for the information i know it will be of help to the members of the forum. Saving passwords online is really not safe.

I don’t think we have to blame Metamask in a situation like this. It’s really not their fault, because this is just like having a malware on your computer or phone that is stealing every information that you input. So, the developers really can’t tell that there is such thing, but they will do their best in making sure that their wallet is secure, but for a situation like this, I don’t think that it is something that we would all have to be blaming the developers.

We as the users really have to be careful and make sure that we maintain the top practices in ensuring the safety of our assets. Everything shouldn’t be the work of a developer, you as the user also have to play your own part in securing your wallets.

I do not make use of an iPhone, but I do have a lot of my friends who are into making use of iPhone. For now I am making use of Android phone and I do make use of Google backup for backing up files on my phone, but it is mainly just pictures and videos and I do not use it for any other thing. And also my backup is not set to being automatic, it is set to manual and I choose what I want to backup and the things I do not want to.

It is good that such information is passed, at least those of us who are making use of iPhone or has friends and families that are making use of iPhone and they’re into cryptocurrency, we would all let them know about this so that they would all be very careful with what they are backing up to their iCloud. These days we all really have to be careful.

Thanks for the warning, but the question arises, how could this have come to this? Wasn't this vulnerability previously known? Whatever it was, but security has always been, is and will be the most important thing, especially when it comes to the security of our funds and assets. On the other hand, this may be a bad reminder for all cryptocurrency users that we still don’t know much and new surprises may lie ahead of us. It is surprising that this vulnerability was discovered for the iPhone and Apple, because it could undermine their importance and credibility in the market.

According to https://decrypt.co/98078/metamask-warns-users-apple-icloud-phishing-scam, the funds are lost within two seconds. This makes me wonder whether the victim is saving plaintext seed phrases on Metamask or not. Metamask itself is saying that indeed the backed-up application data is encrypted.
 
It's likely that iCloud backup may also include sensitive information: Refer to https://support.apple.com/en-us/HT207428

You can disable the iCloud backup feature and the app data backup.

See:

What happens is that people get deceived very easily by the marketing, the cloud is just a nice sounding name for letting someone else to store your data for you, and this is a huge mistake because as we know those services are always targeted by hackers.

And even if the security they can provide may seem adequate hackers always find a way around it and we can lose sensitive information like our seed words or private keys, so people need to think twice about enabling those services, I do not recommend anyone to have their main wallet in one of those devices as securing your coins is simply too difficult in a device that is full of secret backdoors.

Didn’t aware of this one, though upon checking I only save pictures on the iCloud luckily saw this one and I might disable it now and get my photos back on a safer place. This is why we should always read the terms and conditions, most probably its written there and we are no just paying attention about it.

With that, well we can never do nothing about that. If we can use other smart phones aside from iPhones and Apple, that way we will feel safer and more secured. However, always remember that even if we get to use other than iPhones and Apple, there will always be hackers that will always try to steal whatever we have in our wallet. Being responsible for the security of our own account is always the key not to fall a victim for this.

People is getting scammed every day and the to reduce of scam will be hard before some people have taken it as choice of life and it will be very bad to remove it from their blood any information of scam suppose to be spell out to serve another people not to be victim of the the issue some people. Yes it is good make people not fall victim

Just put it off from your iphone. Icloud was so bad as this is storing almost all of data that available to be stored from our iphone. I think that our icloud has small potential to be breached by the hacker. We do know that how good the security of our icloud and as long as we can save our phone properly and our data will not be hijacked by others or hacker.

You don’t know where your files/photos goes the moment you enable that iCloud storage, this is why I’m not into this and I will never enable it because its just a 5gb free space the extra will be charge on your account, and I don’t think its worth the risk. This is a reminder to every Apple users here, stat cautious and stay safe.

I think this icloud storage is safe, because they dare to charge extra for bigger storage.
so I think they have secured our data well and safeguarded the privacy of its users.
as well as security, they must have taken care of it very well so that it is not easily broken by hackers. I think nowadays cloud storage like this is an alternative
which is worth a try. but still be careful with choosing a good storage place.

So its still useless to keep disabled icloud when the fact is Apple has really steal our data the moment we start using it. Its always the sad reality when it comes to Apple, they always give you the best features yet they also come to unlock the security of your funds. So if this is the case, then do not trust Apple for the security of your funds. Use it only for your social media experience.

Things like this that we always have to be vigilant, because hackers are always looking for ways to be able to get into our wallets, especially those of us who have large assets of course maximum security must be applied so that nothing happens that we do not want, and never use the Cloud in storing personal data because of maximum security we cannot be sure, In this case, we have to be careful.

No matter how high security is, there is always a loophole, well maybe this could also be an opportunity for hackers to attack IOS users. I think the use of the Iphone already has high security, because usually the iphone is superior because of its security but in terms of hacking there are always loopholes. I'm just an android user, I don't think it needs to be complicated enough, if it's to guard against hacker attacks for metamask access, isn't it safe if we don't store too many assets or change wallets on a regular basis?

Another big problem and from here i have learned if i shall not put anything in my iphone. I can only use it for trade or something else but not to keep my assets and wallet. This thread was really helpful for people who didn't know about this. Sometime apple users didn't even notice this if their icloud were sending whole of information that available in their phone to the icloud. I would agree if this potentially disaster for anyone.

It's true that if the hacker is professional they can really do anything to get into the wallet,
a very high level of security is required although that is also no guarantee that it will be free from hackers,
you really have to be careful and maybe it's better to move the assets to a place that we think is really safe

So that's why each of our storage wallets must have strong security and must activate other security such as Authenticator because no matter how we make security with gmail, if our wallet doesn't have strong protection, our wallet will still be hacked.

People need to be very wary of those services, to begin with even if we assume that such a service was completely invulnerable to hackers, which is not true but lets assume for a moment they are, then you are giving a private company complete access to your private information.

And it is reasonable to think that they never delete anything from their servers so that information is always going to be there, if to this we add they also store data that could compromise your wallets then this is an even bigger reason to not use them, but unfortunately I am sure there are many people that will decide to use them and will lose their coins as a result of a hack.