“I Didn’t exploit any accounts while writing this, as well i didn’t even test it out (Hope it works lol). The disclaimer explains that the usage of the tool for hacking into iCloud account is illegal, decline any responsibility for damages caused by the iDict tool and confirm that he hasn’t broken any account. Why? This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it.īasically, the tool run a dictionary attack on iCloud Apple ID that bypasses account lockout restrictions and secondary authentication on any account. What this isn’t: A bypass or fully automated removal What is this? A 100% Working iCloud Apple ID Dictionary attack that bypasses Account Lockout restrictions and Secondary Authentication on any account. We reached out to Apple for comment on this story and will update if we hear back.The user Pr0x13 posted the code of iDict on GitHub, Pr0x13 explains that the code is very easy to use and exploits a very simple mechanism implemented to protect the iCloud accounts. Hundreds of naked photographs leaked online after hackers bypassed Apple's security question system.Īfter the wave of leaked images of celebrities emerged online, Apple CEO Tim Cook gave an interview where he promised to increase iCloud's security by adding alerts and improving two-factor authentication. ICloud was criticized in 2014 when hackers used the online service to access the accounts of celebrities like Jennifer Lawrence and Kate Upton. iDict was released on New Year's Day, and its creator tweeted on January 2 that people trying to use the service were causing iCloud accounts to be locked for security reasons, preventing hackers from gaining access.

It looks like Apple acted fast to shut down the hacking tool. Apple blocks these 'brute force' attacks, but it seems that there was a hole in its security that iDict exploited.

IDict worked by guessing a user's password by running through a long list of commonly used passwords until it hit upon the right one.

Idict tool