Apple (NASDAQ: AAPL) CEO Tim Cook on Wednesday met in Beijing with Ma Kai, China's vice premier, according to Chinese state news agency Xinhua, and "exchanged views on protection of users' information." The meeting came just days after a report emerged that indicated Chinese-based hackers had attacked users of Apple's iCloud cloud storage service in the country.
The Xinhua report did not give further details, but Carolyn Wu, a Beijing-based Apple spokeswoman, told Bloomberg the report is accurate. The meeting and the hacking report come at a delicate time for Apple, which just started selling its new iPhones in China, the world's largest smartphone market. Apple received approval from Chinese regulators to sell the phones only after it addressed privacy concerns that the regulators brought up in testing the phones.
According to Greatfire.org, an independent group that monitors Internet censorship in China, when many users across China tried to sign into their iCloud accounts starting this past weekend, they may have been unknowingly disclosing login information to a third party, in what is known as a man-in-the-middle attack. The group said not all iCloud users in China were affected because the attack is only targeted at one of several IP addresses used by iCloud, according to Bloomberg.
"You think you are getting information directly from Apple, but in fact the authorities are passing information between you and Apple, and snooping on it the whole way," a Greatfire spokesman who declined to be named because of fear of reprisal told the New York Times.
According to the Times, activists and security experts think the attacks are backed by the Chinese government because they are hosted on servers to which only the government and state-run telecommunications companies have access, according to Greatfire. They are also similar to recent attacks on Google (NASDAQ: GOOG), Yahoo and Microsoft (NASDAQ: MSFT) aimed at monitoring users on sites run by those companies.
"All signs point to the Chinese government's involvement," Michael Sutton, vice president for threat research at Zscaler, a San Jose, Calif., security company, told the Times. "Evidence suggests this attack originated in the core backbone of the Chinese Internet and would be hard to pull off if it was not done by a central authority like the Chinese government."
Apple expressed concern over the attacks. "We're aware of intermittent organized network attacks using insecure certificates to obtain user information, and we take this very seriously," spokeswoman Trudy Muller told Re/code. "These attacks don't compromise iCloud servers, and they don't impact iCloud sign-in on iOS devices or Macs running OS X Yosemite using the Safari browser."
On a security webpage, Apple indicated that man-in-the-middle attacks were being used to direct people to fake connections of iCloud.com, which could expose users to giving up their user names and passwords. Apple said users will get a warning if their browser detects a fake certificate or an untrusted connection and told users to heed those warnings and avoid signing in.
For more:
- see this NYT article
- see this Bloomberg article
- see this Reuters article
- see this Re/code article
Related Articles:
FBI director says cell phone data must be available for law enforcement
Apple to start selling iPhone 6, 6 Plus in China after addressing security concerns
AT&T fired employee who accessed personal info of around 1,600 customers
Apple highlights privacy safeguards amid concerns over user data being compromised