Selling Locked iPhones on eBay for Parts: A Guide
ebay has triggered a security escalation by enabling the resale of iCloud-locked and activation-locked iPhones as “parts,” according to a June 2026 audit by the Open Source Security Foundation. This practice creates a direct pathway for malicious actors to exploit device recovery mechanisms, with 12,437 such listings identified in the past 30 days.
The Tech TL;DR:
- Reselling locked iPhones as “parts” bypasses Apple’s device verification protocols, enabling unauthorized access to user data.
- Apple’s Find My iPhone service now logs 43% more suspicious activity from eBay-sourced devices, per the 2026 iOS Security Report.
- Enterprises must now prioritize endpoint monitoring solutions with real-time MDM integration, such as CrowdStrike Falcon or Palo Alto Networks Prisma Access.
Apple’s activation lock, designed to prevent unauthorized device reactivation, has been circumvented through eBay’s “non-functional” device listings. According to the official Apple documentation, these locks require the original Apple ID and password to disable. However, third-party resellers are exploiting a loophole where devices are labeled as “non-functional” to evade eBay’s automated detection systems. This creates a “black market” for device recovery keys, as noted in a CISA 2026 advisory.
Exploit Mechanics: How Activation Lock Bypass Works
The bypass relies on a combination of hardware and software manipulation. When an iPhone is listed as “non-functional,” eBay’s API does not trigger Apple’s device verification checks. Attackers then use tools like libimobiledevice to extract firmware hashes, which can be cross-referenced with public firmware repositories to identify vulnerable models. A 2026 IEEE whitepaper demonstrated that 68% of affected devices run iOS 15.7, which lacks the latest Secure Enclave protections.
# Example: Extracting firmware hash from a locked iPhone
sudo ideviceinfo -u $(idevicedevicename) | grep -i 'Firmware Version'
This process allows attackers to map device IDs to user accounts, creating a “shadow database” of potential targets. A ZDNet analysis found that 14% of compromised accounts in Q2 2026 had previously purchased “non-functional” devices from eBay.
Cybersecurity Implications: Beyond Device Theft
The proliferation of locked devices on eBay has amplified risks for enterprise environments. When employees purchase these devices, they often connect them to corporate networks, creating an entry point for supply chain attacks. A SANS Institute report highlights that 32% of recent breaches involved devices with unverified activation locks.
“This isn’t just about stolen phones—it’s about stolen identities,” says Dr. Lena Cho, lead researcher at the TechSafe Repair Collective. “Every unlocked device is a potential phishing vector for corporate credentials.”
Apple has responded by updating its DeviceCheck API to include eBay transaction logs. However, the patch only applies to devices shipped after June 2026, leaving older models vulnerable. Enterprises are now deploying Mandiant and PwC cybersecurity auditors to audit employee device purchases.
Technical Countermeasures: Mitigating the Risk
For individual users, enabling two-factor authentication on Apple IDs and avoiding purchases from unverified sellers is critical. Enterprises should implement zero-trust architectures with continuous monitoring of device compliance. A AWS security blog recommends using aws cloudtrail to track device-related API calls.
# AWS CloudTrail example for device tracking
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=awsiotdeviceadvisor.amazonaws.com
For developers, integrating end-to-end encryption in device management apps can prevent data leakage. The Apple Endpoint Security framework now includes enhanced logging for suspicious device interactions.
The Directory Bridge: Actionable Solutions
With this vulnerability actively exploited, IT departments are turning to managed service providers for real-time device validation. Deloitte Digital has