Apple's Beats brand in April unveiled the Powerbeats Pro, a redesigned wire-free version of its popular fitness-oriented Powerbeats earbuds.
Apple Online Store Security Flaw Exposed PINs of T-Mobile Customers
A security flaw in Apple's online store exposed the account PINs of more than 72 million T-Mobile customers, reports BuzzFeed News.
The vulnerability was discovered by security researchers Phobia and Nicholas "Convict" Ceraolo, who also found a similar flaw in the website for phone insurance company Asurion that exposed AT&T account PINs.
Both Apple and Asurion fixed the website flaws that left the PINs vulnerable after learning about them from BuzzFeed News. Apple opted not to provide further comment on the situation, but told BuzzFeed News that it is "very grateful to the researchers who found the flaw."
The page on Apple's site that let hackers brute force PINs, via BuzzFeed News
PINs, or passcodes, are numbers that are used as an additional account security measure by many carriers in the United States. Mobile device PINs are typically a last line of defense for a cellular account as both carrier websites and support staff will ask for the PIN for confirmation before making account changes.
SIM hacking, which uses social engineering to get carrier support staff to transfer a person's phone number to a new SIM, has become increasingly prevalent due to the number of accounts (bank, email, social media, etc.) that are tied to a person's phone number. A PIN is used as a defense mechanism against SIM hacking, which means exposed PINs can be particularly dangerous.
Accessing the T-Mobile PINs on Apple's website involved a brute force attack where a hacker used software to input multiple different numeric combinations to guess the proper one.
As BuzzFeed News explains, after initiating a T-Mobile iPhone purchase on the Apple online store and selecting monthly payment options through T-Mobile, Apple's site directs users to an authentication form asking for a T-Mobile number and account PIN or last four digits of a social security number (which most carriers use in place of a PIN when one has not been set).
The page allowed for infinite entry attempts into the PIN field, enabling the brute force attack that let hackers guess PINs associated with a T-Mobile phone number.
The security vulnerability appears to have been limited to T-Mobile accounts, as the same validation page for other carriers on Apple's site uses a rate limit that locks access to the form for 60 minutes after five to 10 incorrect entries. Given that the other carrier pages had rate limiting enabled, it's likely Apple made an error on the T-Mobile page.
A phone number was required for both of these attacks, limiting the number of people who may have been impacted, but AT&T and T-Mobile customers who are concerned about their account safety should choose a new PIN.
The vulnerability was discovered by security researchers Phobia and Nicholas "Convict" Ceraolo, who also found a similar flaw in the website for phone insurance company Asurion that exposed AT&T account PINs.
Both Apple and Asurion fixed the website flaws that left the PINs vulnerable after learning about them from BuzzFeed News. Apple opted not to provide further comment on the situation, but told BuzzFeed News that it is "very grateful to the researchers who found the flaw."
PINs, or passcodes, are numbers that are used as an additional account security measure by many carriers in the United States. Mobile device PINs are typically a last line of defense for a cellular account as both carrier websites and support staff will ask for the PIN for confirmation before making account changes.
SIM hacking, which uses social engineering to get carrier support staff to transfer a person's phone number to a new SIM, has become increasingly prevalent due to the number of accounts (bank, email, social media, etc.) that are tied to a person's phone number. A PIN is used as a defense mechanism against SIM hacking, which means exposed PINs can be particularly dangerous.
Accessing the T-Mobile PINs on Apple's website involved a brute force attack where a hacker used software to input multiple different numeric combinations to guess the proper one.
As BuzzFeed News explains, after initiating a T-Mobile iPhone purchase on the Apple online store and selecting monthly payment options through T-Mobile, Apple's site directs users to an authentication form asking for a T-Mobile number and account PIN or last four digits of a social security number (which most carriers use in place of a PIN when one has not been set).
The page allowed for infinite entry attempts into the PIN field, enabling the brute force attack that let hackers guess PINs associated with a T-Mobile phone number.
The security vulnerability appears to have been limited to T-Mobile accounts, as the same validation page for other carriers on Apple's site uses a rate limit that locks access to the form for 60 minutes after five to 10 incorrect entries. Given that the other carrier pages had rate limiting enabled, it's likely Apple made an error on the T-Mobile page.
According to Ceraolo, the vulnerability is likely due to an engineering mistake made when connecting T-Mobile's account validation API to Apple's website.A similar vulnerability on Asurion's website exposed an unspecified number of AT&T account PINs. An AT&T spokesperson said that it is working with Asurion to investigate the issue and will "take any additional action that may be appropriate."
A phone number was required for both of these attacks, limiting the number of people who may have been impacted, but AT&T and T-Mobile customers who are concerned about their account safety should choose a new PIN.
[ 109 comments ]
Top Rated Comments
(View all)
13 months ago
But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.
13 months ago
But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.
Having the best security =/= flawless security. No tech company is completely flawless. But go ahead and chastise Apple for not being absolutely perfect, because that's so productive.
13 months ago
Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.
It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.
If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.
It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.
If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.
13 months ago
Apple don't care about security because even after several security incidents customers are brain washed into thinking Apple is flawless.
13 months ago
Security issue after security issue for T-Mobile and many carriers in general. Remember when T-Mo Germany said they don't need to salt their passwords because their security is "that good"? Or when it was discovered that it's very easy to get access to a T-Mo account AND clone people's sims because T-Mo doesn't have very good security practices beyond asking for the last 4 of your SSN? I've heard stories of people phoning up carriers under the guise of being a store employee and they get access to all sorts of information without thorough identity verification!
I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.
I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.
13 months ago
Even though the fix is in place, I went ahead and changed my PIN again.
Things like this are frustrating. At the same time, most of us informed nerds and geeks realize that any time one creates an account online, there are security risks. As noted earlier, nothing in the tech world is 100% safe forever.
Things like this are frustrating. At the same time, most of us informed nerds and geeks realize that any time one creates an account online, there are security risks. As noted earlier, nothing in the tech world is 100% safe forever.
13 months ago
Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.
13 months ago
I though Apple didn't share your private information with anyone :D
Remember the kind of scandal when Yahoo! or any high street shop lost 78million records...
How will the fanboys spin this one?
[doublepost=1535157037][/doublepost]
Remember the kind of scandal when Yahoo! or any high street shop lost 78million records...
How will the fanboys spin this one?
[doublepost=1535157037][/doublepost]
Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.
It did happen, its just the bigger you get, the more scrutiny you get. Not detecting it didn't mean the bugs/flaws were not there, just that not as many people were looking.
13 months ago
I'm happy you could do the same with your armchair analysis.
Well, whatever it takes to blame Apple - because Tmo is clearly so great about protecting your information ('https://www.cbsnews.com/news/t-mobile-breach-may-have-impacted-2-million-customers/')..
Let me pull this quote directly from the article:
According to Ceraolo, the vulnerability is likely due to an engineering mistake made when connecting T-Mobile's account validation API to Apple's website.
Hmm - let's see who isn't protecting accounts ('https://clark.com/protect-your-identity/t-mobile-website-data-breach-exposed-customer-addresses-pins/'), let alone validation from brute forces...? No API for authentication should trust the client supplying it to do the validation - another Tmo fail to allow this.
¯\_(ツ)_/¯
[ Read All Comments ]
Apple today sent out emails to customers about its latest Apple Pay promo, which will see the company donating $10 to the National Park Foundation for Apple Pay purchases made from the Apple...
We're just a few weeks away from the unveiling of this year's iPhone lineup as well as the official release of iOS 13 and Apple's other new operating system versions, and we're...
For this week's giveaway, we've teamed up with RAVPower to offer MacRumors readers a chance to win a 61W USB-C Power Adapter and a USB-C to Lightning cable, which can be used to fast charge...
Satechi this summer launched its first HomeKit-compatible product, the Dual Smart Outlet, a HomeKit plug that turns dumb appliances and electronics into smart electronics that can work alongside...
As we head into the weekend, there are a few notable deals going on today that include an all-new MacRumors exclusive offer from Eve, Best Buy's anniversary sale with lowest-ever iPad prices, and...
Version 7 of Heart Analyzer was released today, and the popular third-party heart-rate app for iPhone and Apple Watch has gained some additional features for users looking for even deeper insight...
Apple today seeded the seventh beta of watchOS 6, the software that runs on the Apple Watch. The new beta comes a week after the sixth beta and two months after Apple first unveiled the new watchOS...
Apple today seeded seventh beta of an upcoming tvOS 13 update to developers, one week after seeding the sixth beta and two months after unveiling the tvOS 13 software at the Worldwide Developers...
