Apple is separating the new smartphones into its usual low-cost versus high-cost categories, with big differences between the two models coming down to the camera, display, and battery life.
iOS 13 & watchOS 6 Now Available
Developer Demonstrates iOS Phishing Attack That Uses Apple-Style Password Request
Developer Felix Krause today shared a proof of concept phishing attack that's gaining some traction as it clearly demonstrates how app developers can use Apple-style popups to gain access to an iPhone user's Apple ID and password.
As Krause explains, iPhone and iPad users are accustomed to official Apple requests for their Apple ID and password for making purchases and accessing iCloud, even when not in the App Store or iTunes app.
Using a UIAlertController that emulates the design of the system request for a password, developers can create an identical interface as a phishing tool that can fool many iOS users.
The phishing method that Krause describes is not new, and Apple vets apps that are accepted to the App Store, but it's worth highlighting for iOS users who may not be aware that such a phishing attempt is possible.
As Krause says, users can protect themselves by being wary of these popup dialogues. If one pops up, press the Home button to close the app. If the popup goes away, it's tied to the app and is a phishing attack. If it remains, it's a system request from Apple.
Krause also recommends users dismiss popups and enter their credentials directly within the Settings app.
Krause has reported the issue to Apple and recommends a fix that would include Apple asking customers to enter their credentials into the Settings app rather than directly through a popup that can be easily mimicked. Alternatively, he suggests credential requests could include an app icon to indicate that an app is asking rather than the system.
As extra protection from attacks like this, Apple customers should enable two-factor authentication as it prevents attackers from being able to log into an Apple ID account without a code from a verified device.
As Krause explains, iPhone and iPad users are accustomed to official Apple requests for their Apple ID and password for making purchases and accessing iCloud, even when not in the App Store or iTunes app.
Using a UIAlertController that emulates the design of the system request for a password, developers can create an identical interface as a phishing tool that can fool many iOS users.
Showing a dialog that looks just like a system popup is super easy, there is no magic or secret code involved, it's literally the examples provided in the Apple docs, with a custom text.Though some of the system alerts would require a developer to have a user's Apple ID email address, there are also popup alerts that do not require an email and can recover a password.
I decided not to open source the actual popup code, however, note that it's less than 30 lines of code and every iOS engineer will be able to quickly build their own phishing code.
The phishing method that Krause describes is not new, and Apple vets apps that are accepted to the App Store, but it's worth highlighting for iOS users who may not be aware that such a phishing attempt is possible.
As Krause says, users can protect themselves by being wary of these popup dialogues. If one pops up, press the Home button to close the app. If the popup goes away, it's tied to the app and is a phishing attack. If it remains, it's a system request from Apple.
Krause also recommends users dismiss popups and enter their credentials directly within the Settings app.
Krause has reported the issue to Apple and recommends a fix that would include Apple asking customers to enter their credentials into the Settings app rather than directly through a popup that can be easily mimicked. Alternatively, he suggests credential requests could include an app icon to indicate that an app is asking rather than the system.
As extra protection from attacks like this, Apple customers should enable two-factor authentication as it prevents attackers from being able to log into an Apple ID account without a code from a verified device.
[ 124 comments ]
Top Rated Comments
(View all)
26 months ago
Always enter an incorrect password first. If it doesn't complain you entered the wrong password, you know it is a phishing thingie.
26 months ago
Similarly, macOS's Authorization Service dialog box is also easily spoofed.
Similar to Windows' Control-Alt-Delete, Apple's iOS and macOS should make it impossible to spoof these dialog boxes.
Similar to Windows' Control-Alt-Delete, Apple's iOS and macOS should make it impossible to spoof these dialog boxes.
26 months ago
This is very smart actually... I'm surprised this isn't massively used by shady apps already.
26 months ago
Fair point about our social conditioning on these dialogs. I don't know of a good way to address this though.
I think this one is on Apple. A user gets legitimately asked for his/her password enough times and fatigue sets in, and they stop really thinking about it.Ultimately it's a UX problem that needs to be solved so that entering one's iCloud password is 1) hard to fake and 2) doesn't happen any more often than necessary.
26 months ago
I just transferred to a new iPhone and it asked many times for my apple id password at seemingly random times. Sometimes I'm never sure if I mistyped the password or it was a new request for something else. Apple needs to get more organized and at least let the user know why they have to enter the password.
26 months ago
Not so clever. Old trick from the 90s. The old solution that still works: Give security-related system popups some obvious indication of legitimacy that can't be spoofed, like something in the bezel.
Hard part is sandboxing apps so they can't spoof it. TouchID in iOS is one good solution.
I guess it's a bit more advanced than this....
26 months ago
Always enter an incorrect password first. If it doesn't complain you entered the wrong password, you know it is a phishing thingie.
Haha, what if the phishing thing always rejects the first password and only works when you enter the same password twice? Like in Rick and Morty...
26 months ago
I had been wondering when this would be brought up, there’s really nothing that sets apart legitimate system requests on either iOS or macOS. Let’s hope that Apple finally does something about it.
26 months ago
Here's what Apple could do. The authentic message box could say this: Sign-In Required. Please press the home button, then enter your password.
If someone wanted to fake this behavior, pressing the home button would simply quit their app. When Apple is doing it, they have enough control to program this special behavior, which is impossible to fake by mundane developers. On the iPhone X, use a swipe up, which does the same as the home button.
If someone wanted to fake this behavior, pressing the home button would simply quit their app. When Apple is doing it, they have enough control to program this special behavior, which is impossible to fake by mundane developers. On the iPhone X, use a swipe up, which does the same as the home button.
[ Read All Comments ]
Burst Mode refers to when the camera on your iPhone captures a series of photos in rapid succession, at a rate of ten frames per second. It's a great way to shoot an action scene or an unexpected...
Apple's Portrait Mode has become a popular way of taking impressive shots using a depth-of-field effect known as bokeh, allowing iPhone users to shoot a photo that keeps the subject sharp with a...
Apple has redesigned the native Camera app on the iPhone 11 and iPhone 11 Pro to make space for the various additional shooting options available in its new flagship phones, and one particularly...
Apple's massive launch week has come to a close, with the iPhone 11, iPhone 11 Pro, iPhone 11 Pro Max, and Apple Watch Series 5 all debuting on Friday. And as if that wasn't enough, Thursday...
With the arrival of the iPhone 11, iPhone 11 Pro and iPhone 11 Pro Max, Apple has introduced an optional new camera feature in iOS 13 that's designed to allow you to correct the alignment of...
For this week's giveaway, we've teamed up with AnyTrans to offer MacRumors readers a chance to win one of Apple's new iPhone 11 Pro Max devices and a lifetime AnyTrans license.
For...
Due to Apple seeding the iOS 13.1 beta prior to the public release of iOS 13, upgrading to a new iPhone may be a bit trickier this year.
In a support document, Apple has provided instructions...
Apple today the golden master version of an upcoming tvOS 13 update to developers, one week after seeding the eleventh beta and more than three months after unveiling the tvOS 13 software at the...
