5 ms·

I'm not sure I'm comvinced this is a problem. I can do th e same thing just by putting QR codes on stuff. Someone is curious, scans the code, clicks the link. W

I'm not sure I'm comvinced this is a problem. I can do th e same thing just by putting QR codes on stuff. Someone is curious, scans the code, clicks the link. Way cheaper to print sheets of QR code stickers than $30 a pop AirTags

alexatalktome 5y ago
I think the intended attack is to fake an apple login page with the link. You open an actual apple.com page first when you find a tag - so pretty safe to scan - then if you open the link you’ll get an apple login page. Not suspicious. Now you’ve phished the apple credentials off someone thinking they’re helping find you lost keys. Less people would scan a random QR code they found. And even fewer would mistake it for a real apple login and feel compelled to login.
- asiachick 5y ago
  I'm sure I could design codes people would scan. Ideas "dog lost, scan to help". "win free iPad at Apple [Apple Logo] offical back to school give-away for education [QR]" "50% off Coke [QR]" etc... and just make up a domain "officialapplecontest.com", "couponsforcoke.com" etc..
  - eCa 5y ago
    No, you can’t get me to scan a qr code found in the wild. It’s on Apple to convince us that it is safe to scan Airtags. And currently their messaging is that they don’t care? Then I ain’t scanning no Airtag.
    - rjmunro 5y ago
      This isn't an Airtag bug as such. This is a bug in displaying user information on Apple's website, it just happens to be in the part that was made for Airtags to link to. It's a simple XSS vulnerability. The fact that Apple let such a stupid bug into their web site is worrying enough. The fact that they don't acknowledge and fix it within hours, when reported to them via their bounty program means that it's not just "don't scan Airtags" you should be thinking, it's "don't visit apple.com / icloud.com / other Apple websites"
      - fortran77 5y ago
        > The fact that Apple let such a stupid bug into their web site is worrying enough. Those recent articles about large groups of employees pushing the company to take stands on anything but work-related matters makes me wonder if the sane, competent employees have either left or have "mentally checked out." See: https://www.nytimes.com/2021/09/17/technology/apple-employee-unrest.html?searchResultPosition=1 https://www.nytimes.com/2021/09/17/technology/apple-employee...
  - iforgotpassword 5y ago
    Sure, you could do that an get some people to fall for that. But in the end, you can just call them stupid for scanning random qr codes and then entering private information. No involvement by Apple. An airtag is a product by a big company, claiming to be trustworthy. Claiming their products are safe. You are actually told by Apple to scan those airtags, made by them. So you find an Apple airtag, scan it with your Apple iPhone, and an Apple login form is presented to you. Way, way different from that qr code scenario.
  - deleted 5y ago
    [deleted]
  - simion314 5y ago
    The story has 2 main ideas 1 Apple is bad at security 2 Apple is bad at relation with security researchers. So as a fanboy you forgot to defend the second part(and the zero days from last week caused by the 2nd point).
deleted 5y ago
[deleted]
kataklasm 5y ago
You know, I'm always astonished to which length people go to defend Apple! Apple makes a gadget that has an explicit mode for good samaritans to locate the original owner. This mode has a security flaw (lack of input validity checks, I thought we overcame this stuff last decade?) that opens up the good samaritan to abuse by means of phishing. And somehow you want to explain to me that that is not a problem? Just because I can take a random car and drive into people doesn't mean a self-driving car having a bug that drives into people isn't an issue, to give an example of why your logic doesn't pass.
- throwaway287391 5y ago
  > You know, I'm always astonished to which length people go to defend Apple! The reason this is a serious problem and not equivalent to any other situation where you can get people to click an arbitrary link wasn't immediately obvious to me either. I'm glad the question was asked and answered. I'm not a diehard Apple defender, just someone who's not immersed in this phishing stuff on a daily basis. shrug
  - Grustaf 5y ago
    Sorry, but what is the answer? I still don't get it.
    - johnday 5y ago
      The answer is that a link provided by an Apple AirTag is expected to be secure. Indeed, a page on an apple domain is expected to have been vetted entirely by Apple, and therefore earns a degree of trust by the good samaritan. As it stands, a malicious user can replace the entire website, still under an apple.com domain, with content of their own devising. This content can, for example, pretend to be an Apple login page, and exfiltrate entered credentials. I hope it's obvious why this form of attack is more malicious and more dangerous than simply putting up an arbitrary QR code.
jmull 5y ago
[1] is a better explanation of how this can be exploited. Basically, a victim finds an air tag, and as a Good Samaritan, opens the "found" link to attempt to reunite the air tag with its owner. The key is, the victim may trust the Apple Airtag to direct them to a secure, private web page, so may be willing to do something like provide their iCloud credentials when prompted. It's not an attack that would be deployed indiscriminately -- it costs an attacker $30 for a chance that a desired target will find the Airtag, be a Good Samaritan and interact with the "found" page as hoped. But it could make sense against high value targets. [1] https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-credentials-with-apple-airtags-stored-xss-6997da43a216 https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-cred...

alexatalktome 5y ago

I think the intended attack is to fake an apple login page with the link. You open an actual apple.com page first when you find a tag - so pretty safe to scan - then if you open the link you’ll get an apple login page. Not suspicious. Now you’ve phished the apple credentials off someone thinking they’re helping find you lost keys. Less people would scan a random QR code they found. And even fewer would mistake it for a real apple login and feel compelled to login.

asiachick 5y ago
I'm sure I could design codes people would scan. Ideas "dog lost, scan to help". "win free iPad at Apple [Apple Logo] offical back to school give-away for education [QR]" "50% off Coke [QR]" etc... and just make up a domain "officialapplecontest.com", "couponsforcoke.com" etc..
- eCa 5y ago
  No, you can’t get me to scan a qr code found in the wild. It’s on Apple to convince us that it is safe to scan Airtags. And currently their messaging is that they don’t care? Then I ain’t scanning no Airtag.
  - rjmunro 5y ago
    This isn't an Airtag bug as such. This is a bug in displaying user information on Apple's website, it just happens to be in the part that was made for Airtags to link to. It's a simple XSS vulnerability. The fact that Apple let such a stupid bug into their web site is worrying enough. The fact that they don't acknowledge and fix it within hours, when reported to them via their bounty program means that it's not just "don't scan Airtags" you should be thinking, it's "don't visit apple.com / icloud.com / other Apple websites"
    - fortran77 5y ago
      > The fact that Apple let such a stupid bug into their web site is worrying enough. Those recent articles about large groups of employees pushing the company to take stands on anything but work-related matters makes me wonder if the sane, competent employees have either left or have "mentally checked out." See: https://www.nytimes.com/2021/09/17/technology/apple-employee-unrest.html?searchResultPosition=1 https://www.nytimes.com/2021/09/17/technology/apple-employee...
- iforgotpassword 5y ago
  Sure, you could do that an get some people to fall for that. But in the end, you can just call them stupid for scanning random qr codes and then entering private information. No involvement by Apple. An airtag is a product by a big company, claiming to be trustworthy. Claiming their products are safe. You are actually told by Apple to scan those airtags, made by them. So you find an Apple airtag, scan it with your Apple iPhone, and an Apple login form is presented to you. Way, way different from that qr code scenario.
- deleted 5y ago
  [deleted]
- simion314 5y ago
  The story has 2 main ideas 1 Apple is bad at security 2 Apple is bad at relation with security researchers. So as a fanboy you forgot to defend the second part(and the zero days from last week caused by the 2nd point).

deleted 5y ago

[deleted]

kataklasm 5y ago

You know, I'm always astonished to which length people go to defend Apple! Apple makes a gadget that has an explicit mode for good samaritans to locate the original owner. This mode has a security flaw (lack of input validity checks, I thought we overcame this stuff last decade?) that opens up the good samaritan to abuse by means of phishing. And somehow you want to explain to me that that is not a problem? Just because I can take a random car and drive into people doesn't mean a self-driving car having a bug that drives into people isn't an issue, to give an example of why your logic doesn't pass.

throwaway287391 5y ago
> You know, I'm always astonished to which length people go to defend Apple! The reason this is a serious problem and not equivalent to any other situation where you can get people to click an arbitrary link wasn't immediately obvious to me either. I'm glad the question was asked and answered. I'm not a diehard Apple defender, just someone who's not immersed in this phishing stuff on a daily basis. shrug
- Grustaf 5y ago
  Sorry, but what is the answer? I still don't get it.
  - johnday 5y ago
    The answer is that a link provided by an Apple AirTag is expected to be secure. Indeed, a page on an apple domain is expected to have been vetted entirely by Apple, and therefore earns a degree of trust by the good samaritan. As it stands, a malicious user can replace the entire website, still under an apple.com domain, with content of their own devising. This content can, for example, pretend to be an Apple login page, and exfiltrate entered credentials. I hope it's obvious why this form of attack is more malicious and more dangerous than simply putting up an arbitrary QR code.

jmull 5y ago

[1] is a better explanation of how this can be exploited. Basically, a victim finds an air tag, and as a Good Samaritan, opens the "found" link to attempt to reunite the air tag with its owner. The key is, the victim may trust the Apple Airtag to direct them to a secure, private web page, so may be willing to do something like provide their iCloud credentials when prompted. It's not an attack that would be deployed indiscriminately -- it costs an attacker $30 for a chance that a desired target will find the Airtag, be a Good Samaritan and interact with the "found" page as hoped. But it could make sense against high value targets. [1] https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-credentials-with-apple-airtags-stored-xss-6997da43a216 https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-cred...