If you're new to AirPods, considering buying a pair, or just want to pick up some new tips.
AirPods and AirPower: Everything We Know
Apple Online Store Security Flaw Exposed PINs of T-Mobile Customers
A security flaw in Apple's online store exposed the account PINs of more than 72 million T-Mobile customers, reports BuzzFeed News.
The vulnerability was discovered by security researchers Phobia and Nicholas "Convict" Ceraolo, who also found a similar flaw in the website for phone insurance company Asurion that exposed AT&T account PINs.
Both Apple and Asurion fixed the website flaws that left the PINs vulnerable after learning about them from BuzzFeed News. Apple opted not to provide further comment on the situation, but told BuzzFeed News that it is "very grateful to the researchers who found the flaw."
The page on Apple's site that let hackers brute force PINs, via BuzzFeed News
PINs, or passcodes, are numbers that are used as an additional account security measure by many carriers in the United States. Mobile device PINs are typically a last line of defense for a cellular account as both carrier websites and support staff will ask for the PIN for confirmation before making account changes.
SIM hacking, which uses social engineering to get carrier support staff to transfer a person's phone number to a new SIM, has become increasingly prevalent due to the number of accounts (bank, email, social media, etc.) that are tied to a person's phone number. A PIN is used as a defense mechanism against SIM hacking, which means exposed PINs can be particularly dangerous.
Accessing the T-Mobile PINs on Apple's website involved a brute force attack where a hacker used software to input multiple different numeric combinations to guess the proper one.
As BuzzFeed News explains, after initiating a T-Mobile iPhone purchase on the Apple online store and selecting monthly payment options through T-Mobile, Apple's site directs users to an authentication form asking for a T-Mobile number and account PIN or last four digits of a social security number (which most carriers use in place of a PIN when one has not been set).
The page allowed for infinite entry attempts into the PIN field, enabling the brute force attack that let hackers guess PINs associated with a T-Mobile phone number.
The security vulnerability appears to have been limited to T-Mobile accounts, as the same validation page for other carriers on Apple's site uses a rate limit that locks access to the form for 60 minutes after five to 10 incorrect entries. Given that the other carrier pages had rate limiting enabled, it's likely Apple made an error on the T-Mobile page.
A phone number was required for both of these attacks, limiting the number of people who may have been impacted, but AT&T and T-Mobile customers who are concerned about their account safety should choose a new PIN.
The vulnerability was discovered by security researchers Phobia and Nicholas "Convict" Ceraolo, who also found a similar flaw in the website for phone insurance company Asurion that exposed AT&T account PINs.
Both Apple and Asurion fixed the website flaws that left the PINs vulnerable after learning about them from BuzzFeed News. Apple opted not to provide further comment on the situation, but told BuzzFeed News that it is "very grateful to the researchers who found the flaw."
PINs, or passcodes, are numbers that are used as an additional account security measure by many carriers in the United States. Mobile device PINs are typically a last line of defense for a cellular account as both carrier websites and support staff will ask for the PIN for confirmation before making account changes.
SIM hacking, which uses social engineering to get carrier support staff to transfer a person's phone number to a new SIM, has become increasingly prevalent due to the number of accounts (bank, email, social media, etc.) that are tied to a person's phone number. A PIN is used as a defense mechanism against SIM hacking, which means exposed PINs can be particularly dangerous.
Accessing the T-Mobile PINs on Apple's website involved a brute force attack where a hacker used software to input multiple different numeric combinations to guess the proper one.
As BuzzFeed News explains, after initiating a T-Mobile iPhone purchase on the Apple online store and selecting monthly payment options through T-Mobile, Apple's site directs users to an authentication form asking for a T-Mobile number and account PIN or last four digits of a social security number (which most carriers use in place of a PIN when one has not been set).
The page allowed for infinite entry attempts into the PIN field, enabling the brute force attack that let hackers guess PINs associated with a T-Mobile phone number.
The security vulnerability appears to have been limited to T-Mobile accounts, as the same validation page for other carriers on Apple's site uses a rate limit that locks access to the form for 60 minutes after five to 10 incorrect entries. Given that the other carrier pages had rate limiting enabled, it's likely Apple made an error on the T-Mobile page.
According to Ceraolo, the vulnerability is likely due to an engineering mistake made when connecting T-Mobile's account validation API to Apple's website.A similar vulnerability on Asurion's website exposed an unspecified number of AT&T account PINs. An AT&T spokesperson said that it is working with Asurion to investigate the issue and will "take any additional action that may be appropriate."
A phone number was required for both of these attacks, limiting the number of people who may have been impacted, but AT&T and T-Mobile customers who are concerned about their account safety should choose a new PIN.
[ 109 comments ]
Top Rated Comments
(View all)
26 weeks ago
But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.
26 weeks ago
But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.
Having the best security =/= flawless security. No tech company is completely flawless. But go ahead and chastise Apple for not being absolutely perfect, because that's so productive.
26 weeks ago
Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.
It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.
If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.
It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.
If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.
26 weeks ago
Apple don't care about security because even after several security incidents customers are brain washed into thinking Apple is flawless.
26 weeks ago
Security issue after security issue for T-Mobile and many carriers in general. Remember when T-Mo Germany said they don't need to salt their passwords because their security is "that good"? Or when it was discovered that it's very easy to get access to a T-Mo account AND clone people's sims because T-Mo doesn't have very good security practices beyond asking for the last 4 of your SSN? I've heard stories of people phoning up carriers under the guise of being a store employee and they get access to all sorts of information without thorough identity verification!
I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.
I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.
26 weeks ago
Even though the fix is in place, I went ahead and changed my PIN again.
Things like this are frustrating. At the same time, most of us informed nerds and geeks realize that any time one creates an account online, there are security risks. As noted earlier, nothing in the tech world is 100% safe forever.
Things like this are frustrating. At the same time, most of us informed nerds and geeks realize that any time one creates an account online, there are security risks. As noted earlier, nothing in the tech world is 100% safe forever.
26 weeks ago
Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.
26 weeks ago
I though Apple didn't share your private information with anyone :D
Remember the kind of scandal when Yahoo! or any high street shop lost 78million records...
How will the fanboys spin this one?
[doublepost=1535157037][/doublepost]
Remember the kind of scandal when Yahoo! or any high street shop lost 78million records...
How will the fanboys spin this one?
[doublepost=1535157037][/doublepost]
Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.
It did happen, its just the bigger you get, the more scrutiny you get. Not detecting it didn't mean the bugs/flaws were not there, just that not as many people were looking.
25 weeks ago
I'm happy you could do the same with your armchair analysis.
Well, whatever it takes to blame Apple - because Tmo is clearly so great about protecting your information ('https://www.cbsnews.com/news/t-mobile-breach-may-have-impacted-2-million-customers/')..
Let me pull this quote directly from the article:
According to Ceraolo, the vulnerability is likely due to an engineering mistake made when connecting T-Mobile's account validation API to Apple's website.
Hmm - let's see who isn't protecting accounts ('https://clark.com/protect-your-identity/t-mobile-website-data-breach-exposed-customer-addresses-pins/'), let alone validation from brute forces...? No API for authentication should trust the client supplying it to do the validation - another Tmo fail to allow this.
¯\_(ツ)_/¯
[ Read All Comments ]
Following an announcement last year and launch in Europe, Eve Systems today released the portable LED lamp Eve Flare in the United States and Canada. Similar to Hue Go, Eve Flare lets you pick up and...
SoundCloud today announced a new feature that allows creators to distribute their music directly to major streaming music services like Apple Music, Spotify, and Amazon Music (via Billboard). The...
Printer company Epson today announced the launch of voice-activated mobile printing support for Siri, Amazon Alexa, and Google Assistant. With the addition, iOS users can snap a photo and ask Siri to...
TweetDeck for Mac has been updated with backend improvements that are said to "significantly improve the stability of the app." This includes a fix for a major crashing issue that was...
Sphero today debuted a Kickstarter for its latest robot, the RVR, a fully programmable and customizable RC car that the company says has "endless coding possibilities." The RVR Kickstarter...
The Gardena Smart System is now compatible with Apple's HomeKit, thanks to the availability of a software update that brings HomeKit integration to Gardena devices like the Smart Water Control,...
Apple this week was awarded a patent for a potential Apple Watch design featuring a flexible microLED display that integrates with and encompasses almost the entire watch band.
Titled...
In his wide-ranging research note today touching on Apple's product releases for 2019, Ming-Kuo provided a glimpse at upcoming AirPods, iPads, iPhones, displays and MacBook Pros. Regarding the...
