I wonder how such hack would even work. The watch does have the option to control it remotely, through the iPhone accessibility options, but obviously this only works with the paired iPhone and not over the internet.

> but obviously this only works with the paired iPhone and not over the internet.

That's the intended design, but perhaps the trusted device layer could be bypassed under some circumstance? It seems extremely unlikely, but maybe not impossible.

edit: The more I read and think about this, the less I think it's likely. I'll keep this as a devil's advocate sort of message, but I feel like I should still point out that the entire premise here seems a little nuts and the people reporting the hacks are more likely to be uninformed/paranoid/etc and dealing with ghost touches than the watches were likely to be compromised.

That multiple people reported a "spam" phone call right before the incident makes it look like they've found some zero day cellular exploit.

If this is for real I expect we'll hear more about it soon enough.

Only one person reported the spam call in that thread, the Marcus-II commenter. Their comment shows up twice in the first page and once on the second page. No one else mentions the spam call.

The baseband processor is entirely separate, with some basic commands and responses communicated from the phone's CPU to the baseband, so even this explanation is suspect.

No one is burning a baseband 0day to write "we are in control" on a screen.

Apple Employees can certainly access your devices remotely, I have seen it happening with iPhone, I don’t know about Watch.

Nevertheless, this does seem like an anti-Apple campaign.

That's not true. Apple employees can see a video feed of your screen after you accept their support request (similar to screen sharing over FaceTime), but they can't interact with your phone remotely.

Can you be more specific about when an Apple employee remotely accessed your iPhone.

It would almost certainly would be illegal.

I’ve had this happen when I called in a support request for some iOS issue I had. Their interface has all the devices on your Apple ID, and they can enable screen sharing on any of them after you accept it via a notification. I have to admit, it must be a lot better for the support experience as opposed to trying to verbally describe what’s going on.

This seems even more hard to believe and requires even more extraordinary evidence.

> I'm not sure what the motive would be, though.

To make Apple Watch antivirus scams?

maybe some kind of anti commercial to not trust apple products? but I wouldn't suspect any major brands for something at this level, so maybe just bunch of people trying to mess with people believes like it was multiple times in the past? like with charging iPhone in microwave etc, basically noone benefits just some folks want to see people panic

Hoaxers hoping to drum up enough news stories to impact Apple's share price to make money on shorting it?

Maybe to make this scenario seem plausible?

> From: definitelyNotAppleScam.com

> Subject: Your Apple Watch is hacked

> Hello [insert name here],

> We have found that your Apple Watch Series x has been compromised by hackers.

> Please click on the link below to reset your password

> [Link that asks for previous password and something idk]

The thing that gets me is all the similar stories. I guess it could be astroturfing, but why that product?

It's pretty obviously fake. A bunch of "level 1" (new) users, all with the same story? They literally mention the exact time & date in the same style, and mention the 1-minute lockout in the same way as well. Two of them use the same timestamp even, down to the minute.

Also, something I noticed working for large orgs with over 100K staff and 1M users: An appreciable fraction of the human population is simply mentally ill. Hallucinations, drug use, psychosis, etc... all have a non-zero rate. Given enough users, you'll get the same type that imagines being abducted by aliens and even makes police reports that sound suspiciously like the sci-fi movie that's popular at the time.

FWIW - The commonality of alien abductions can actually be decently explained by sleep paralysis + hallucinations (+ the mind already having been 'seeded' by the idea).

It's something that perfectly sane people could experience and not realize it was a hallucination because it's a quite rare & unknown phenomenon(and one that you often won't mention because everyone thinks you're crazy if you say it).

Not only that, but all those new users actually bothered to look for a pre-existing topic on their issue instead of making their own new topic. Unlikely.

I own an iPhone and i would be a level 1 / new user if i had issues.

Otherwise, why on earth would i care about signing up to apple forums?

I’d only go there if i had issues (obviously)

Okay, that covers 1/5th of the parent comment.

A lot of the people here are much more experienced with technology, so our behaviour is going to be different, but I have a hard time understanding why someone would sign up for a forum as a first step for obtaining assistance. Calling the vendor, sure. Using vendor support options that connect me directly to their staff, sure. None of the people posting about the issue mention taking other prior steps in obtaining support (even though a couple of posts from established members say they should).

I suppose posting to the vendor forums is fine if you need support. On the other hand, I do not think it is an acceptable source of information about a security flaw in a product. There information provided is not verified. The sources are not verified. We don't know whether the details are true, a misinterpretation (innocent or malicious), or made up. In other words, there is no reason to trust what is being said. If I came in here suggesting that my computer was hacked, I would expect people to respond with similar incredulity. (I am simply someone who posts to a forum. There is no reason for people to trust anything I say, particularly if the posting doesn't contain detail on reproducing the problem.)

Personal experience from browsing n = n + 1 apple support threads: Just message support. It’s much faster and has a higher chance of producing a result.

Their support raises issues directly to the dev teams when they happen often enough, too. There's a good chance the touch screen team is working their asses off right now on this already

Not necessarily disagreeing with you regarding the people that are imagining things, but with a device so relatively popular as the Apple Watch, this could be very well explained by a software update that messed up the touch screen "driver" and is generating ghost touches. As the update rolled out, it started affecting more and more users who turn to the forums to look for help.

One consequence of these ghost touches would be inputting the wrong PIN which will initially lock the device for one minute, so I don't see what's strange about that.

Which messages, specifically, are you referring to with "exact time & date" and "same timestamp"? I skimmed through them but nothing of sort stood out.

That fraction is about 4%: https://slatestarcodex.com/2013/04/12/noisy-poll-results-and...

You get different percentages depending on what you’re counting.

I regularly choose one of the first countries in those forms that collect your info so they can spam you. There’s some marketing person out there who is convinced Albania and Afghanistan are a cloud computing Mecca.

That doesn’t make me “crazy”.

Similarly, over 5% of students are on ADHD medication but they’re not what I would consider nuts.

What I mean is that there are people that would be homeless vagrants shouting about space worms burrowing into everyone’s brains, but they’re on medication and got a government job where from they’re nearly unfireable even if they stop taking their pills one day.

Two of my friends are conspiracy theorists… in private. It’s basically a fan-fiction club to them, a setting in which to make up stories.

I’ve met an IT guy who truly believed that software updates were a conspiracy and made sure that every system in that place used the “clean” golden image from the original CD and was never ever patched.

There are statics like “20% of all adults have some mental health issue” and then there is the guy who literally spends his day planning your murder because you didn’t talk to him at the water cooler.

Obviously this guy was fooled by a friend who was using his iPhone to remotely operate the watch (which explains the „we are in control“ phrase). Now in this forum numerous people that simply have a broken digitizer chime in. Case closed.

It wasn't obvious at all to me that that's even possible. But as it turns out: it's an accessibility feature (1) to mirror the watch screen on iPhone in order to voice control it or use assistive touch.

1: https://support.apple.com/guide/watch/apple-watch-mirroring-...

Surely this is a vector for attack then?

No. You need to gain access to the phone. If you have access to the phone, the watch isn’t interesting anymore.