Computers can be really expensive, especially Apple computers. So when you upgrade and buy a newer model, you might want to sell your old one to help pay for the new one. Do you think you did enough by erasing the old one? Surprisingly, no.
An employee of Google sold his old iMac on Craigslist only to find that the Find My iPhone feature was still tracking it three years later despite being erased and having a clean install. A Google employee, Brendon Mulligan knows his way around but still this happened to him.
One Man’s Experience
When looking at his “Find My iPhone” device list three years after he sold the iMac, Mulligan noticed an entry called “Michael’s iMac.” The problems is, he didn’t know who Michael is and why it was showing up on his list. The location it was showing was about 100 miles north of his home.
“For whatever reason,” Mulligan explains, “this person didn’t need to sign in to iCloud. So this meant that Apple still associated the computer hardware with my iCloud account. The computer wasn’t logged in to my iCloud account but was still associated with my account, so I could track the computer’s location in real time.”
Mulligan was still safe. Nothing of his was being shared. But the person who bought the computer from him definitely wasn’t. He had the ability to keep an eye on the Michael by following him. It was a desktop computer, so it wasn’t going many places, but had it been a laptop, Mulligan would be able to track the user.
And that’s not all. Mulligan still had usage of the safety features through “Find My iPhone” for that computer. He could do “Play Sound,” “Lock,” or “Erase Mac.” First, it would be spooky if the iMac started playing a sound without your doing, but it would be real frustrating if someone else could either lock or certainly worse yet erase it.
How it was resolved was that Michael finally did log into his own iCloud account and turned on “Find My Mac.” The computer then told him Mulligan’s name.
How to Solve This Issue
Mulligan admitted that he doesn’t know if Apple has fixed this privacy/security flaw in a more recent macOS update, as it was a computer he sold three years ago. Additionally, it may not even be a flaw. Maybe something went wrong with his erasing process, and that’s why this was still available.
And it should also be enforced that had Michael signed into his own iCloud account initially, It would have killed Mulligan’s chances of being able to track or potentially disrupt the computer later down the line.
There are two things you can do, one as the buyer and one as the seller. Of course, as the buyer, if you don’t want to be tracked, on your computer from the previous owner, make sure you sign into your own “Find My” account with your own iCloud account.
But there’s also something you can do as the seller. To fully disassociate the computer from your iCloud account, you need to turn off “Find My Mac” before you wipe it. Again, this is assuming this security flaw hasn’t been fixed already and that it’s a flaw that can be replicated, but still, better safe than sorry.
In Closing
Whether or not you have a Mac, it certainly raises the question of what happens with second hand devices. It means things are never as cut and dry as erasing.
Have you ever sold your computer or device or bought one secondhand? Was this type of thing happening a concern of yours? Add your thoughts to the comments below and let us know.
