All a hacker needs to access the victim's content stored in Apple's cloud is their AppleID login details, as two-factor authentication (2FA) is not required to restore iCloud backups .
The feature is designed to confirm the identity of the account holder, through a code sent to a device designated by the account holder, after the username and password have been entered.
As Apple states, 2FA is used in the MyAppleID, iTunes, AppStore, and iBooksStore services.
Other actions that require authentication do not resort to the two-factor security feature, including iCloud backups for new devices; this feature only requires the username and password for the account.
Vladimir Katalov from ElcomSoft gave a presentation in November 2013 at the DeepSec conference in Vienna on how Apple's iCloud works, where he said that Apple's 2FA did not affect iCloud backups, Find My iPhone data, or documents stored in the cloud.
The researcher stated that no notification was made to the account owners after a backup was taken, as would be the case in the restoration process.
Photo Stream is also accessible without having to enter a verification code when logging in.
The next step for Apple to strengthen customer privacy is likely to be to implement 2FA across all iCloud services. However, users have already begun to lose confidence in the much-touted impenetrable defenses of Apple products.
