iPhone being held to ransom - hackers want paid via Bitcoin

[rebecca.smith]

Hey I have been a victim of the Findmyphone hack where a passcode is changed on your phone and it is locked and you are requested to pay $50 to unlock it. The scumbags who have done this to me have given me a bitcoin account to pay into I was wondering if there is any way to track who this account belongs to or to reverse a payment once it is made to see if they will give me the passcode back. I have a 4 month old daughter and unfortunately my phone hasnt backed up since she was born so I stand to lose all photos of her. I am absolutely devastated and really need help. Surely these low-life criminals can be traced and caught using technology. They are using the email address helpappledevice@gmail.com and want money deposited into bitcoin wallet: 1GHgoJckF7k7azPJs8YCu6FbC5nvJY8ap4

Please help, I am desperate to get these photos back!

[TomZ]

Contact Apple, and your local police may be useful too.

[rebecca.smith]

Contact Apple, and your local police may be useful too.

I have contacted apple but there is nothing they can do to recover my photos as the phone is passcode locked, wifi is turned off and siri is turned off and there is no swipe up screen. Am going to contact police today, just thought somehow the wallet could be tracked or if we did pay the ransom money then the payment could be reversed if the passcode was recovered.

[bitless]

this is hot garbage, just walked a friend through recovery last night -- phone is not locked, only in lost mode. in lost mode it will connect to previously accessed wifi networks.

this is lost mode:
https://support.apple.com/kb/PH19299?locale=en_US

steps to recover:

• reset apple ID password using your apple id email address
  
  reset security questions (if attacker has modified them) using the recovery email address on the account (probably your hotmail from 2007, good luck)
  
  if you cannot reset these using recovery email address, get on phone with apple support, but be explicit about what is happening and what access you do have to the account.
  
  take phone out of lost mode using icloud web interface
  
  alternately, wipe phone from previous backup
  
  report that email address to gmail. they are slow to react but [pretty sure laughable ransomware violates tos.

[/list]

[bitless]

if you cant get it to connect to wifi use usb to itunes. this is not a novel problem.

[zju]

... just thought somehow the wallet could be tracked or if we did pay the ransom money then the payment could be reversed if the passcode was recovered.

No. Neither of those are possible. An address can only be tracked by looking at where the bitcoins at the address come from and where they go. Bitcoin payments are not reversible.

[dragonmining]

Hey I have been a victim of the Findmyphone hack where a passcode is changed on your phone and it is locked and you are requested to pay $50 to unlock it. The scumbags who have done this to me have given me a bitcoin account to pay into I was wondering if there is any way to track who this account belongs to or to reverse a payment once it is made to see if they will give me the passcode back. I have a 4 month old daughter and unfortunately my phone hasnt backed up since she was born so I stand to lose all photos of her. I am absolutely devastated and really need help. Surely these low-life criminals can be traced and caught using technology. They are using the email address helpappledevice@gmail.com and want money deposited into bitcoin wallet: 1GHgoJckF7k7azPJs8YCu6FbC5nvJY8ap4

Please help, I am desperate to get these photos back!

This is a very sad situation. However potentially rectifiable. A lot of the procedures used in these scams are not actually hacks. It is a piece of software that is downloaded on your phone when you enter a website. The most common one is "You've been found to be viewing indecent material. Your phone has been locked by interpol and the police. You've been fined a sum of XXX you can pay this via a ecash voucher and we will unlock your phone." It sounds like you've been targeted by a very similar scam. The running software that's been placed on your phone normally provides a message that obstructs you from using the phone correctly. In some cases you can remove the software and uninstall it.

blog.yoocare.com/how-to-remove-fbi-virus-from-android-phone/
This is a link of a similar scam with the same concept of what it sounds like you're describing. This is just some rough information and a guide that may help you. We hope you rectify the problem.

[dragonmining]

Failing that, Dragon Mining suggest that you should contact local law enforcement agencies as if the individual that owns the Bitcoin wallet address has used a large and well known company such as coinbase in some cases they're required to offer ID to open their account. This is not the case with all companies but it may be a helpful lead.

[rebecca.smith]

Unfortunately due to trying to restart phone while I was locked out I am now unable to get in and my wifi is turned off so the phone is unable to backup to the cloud. When I plug it into itunes it says it requires passcode to be entered into phone. Seems like I will lose all my photos. The aupport team at Apple were very helpful but an unfortunate series of events has led to this becoming a disaster.