3 ms·

Considering that within days of the launch, a HW-researcher already found a way to rewrite the AirTag to direct to an entirely different URL [1], a "bad actor"

Considering that within days of the launch, a HW-researcher already found a way to rewrite the AirTag to direct to an entirely different URL [1], a "bad actor" might not even bother with such an easily fixable webpage issue... [1] https://twitter.com/ghidraninja/status/1391165711448518658 https://twitter.com/ghidraninja/status/1391165711448518658

rjmunro 5y ago
I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. An XSS can do a lot more than just redirect you. It could construct a fake Apple login page inside the apple.com domain, so you would have no reason to suspect it was a phishing attack. You could probably construct something like the Myspace Samy worm (https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)) to spread through Airtag users and change everyone's AirTags to point to your malicious script.
- chrisjc 5y ago
  > I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. While you obviously know what you're talking about, you can't honestly think that the majority of people wouldn't know any better? Even if most people knew better than clicking nwidjjjj.biz/lkqpdi15, something like youfoundmyairtag.hr/tag=238s71j would probably still fool enough to make it a viable vector.
  - petee 5y ago
    Many people wont know, notice, or look twice. It doesnt help many popular services use weird url shorteners, so some weird looking url is normal now
- londons_explore 5y ago
  > construct a fake Apple login page inside the apple.com domain Usually you don't even need to do that. As soon as you have script running inside apple.com, you can get the password manager to auto-fill the password, login, steal the login cookie, and do whatever you like, all with nothing visible to the user.
  - judge2020 5y ago
    Once it's fixed this won't be possible, in which a fake Apple sign-in domain will be the best vector.
- PartiallyTyped 5y ago
  Re url redirect: I think you are putting too much faith in the average person noticing the url given how susceptible humans are to phishing attacks. Re xss: how could you a worm in this case go from one airtag to another?
  - jameshart 5y ago
    Password managers and persistent auth cookies are why getting onto the domain matters. I guess the posited worm would make use of the fact that if an authenticated Apple.com user can inject a payload via marking an air tag as lost and setting its phone number, if that payload runs on an Apple.com page on the victim’s device, it then gets some new apple.com credentials; if the victim also has any airtags, it can mark them as lost and inject the payload into the phone number field. Requires the airtag to be scanned by another airtag owner, obviously, and unclear who would scan their airtag. Overall, a good example of how to think about how viral reproduction methods can lead to very different replication rates depending on population characteristics and behavior.
- jjulius 5y ago
  >... you know you can trust it. If the URL is someone else, you know not to trust it. If HN readers are the "you" here, then that's accurate. If you're referring to your average person, then I would argue that the majority don't know this.
  - dividedbyzero 5y ago
    > If HN readers are the "you" here, then that's accurate. Unless it's something very obviously shady, I could see myself fall for something like this.
  - rjmunro 5y ago
    Sadly that is true. Luckily, if they are using a password manager, it will do the right thing. Some work has been done on UX here, Apple seems to hide the URL and show only the domain name on iOS sometimes, which is interesting, but annoying. Firefox colour codes the domain name part in the URL bar, but it's pretty subtle.
chrisjc 5y ago
Interesting. Then again, even if apple made it immutable, what's to stop bad actors from having a bunch of lookalike tags manufactured with plain old NFC? edit: apple has no native support for reading NFC tags. You can only do it within apps. So i guess my idea wouldn't work for now.
cmeacham98 5y ago
If I'm an attacker, I'm not using this vulnerability to redirect you to an evil website, but instead to inject a fake login prompt. When you go to check the domain like a good user, you'll see it's on the Apple official website found.apple.com, perfectly safe to enter your credentials on! The ability to impersonate Apple _on their own domain_ is definitely a bigger risk than rewriting the URL or manufacturing a look-alike tag.

rjmunro 5y ago

I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. An XSS can do a lot more than just redirect you. It could construct a fake Apple login page inside the apple.com domain, so you would have no reason to suspect it was a phishing attack. You could probably construct something like the Myspace Samy worm (https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)) to spread through Airtag users and change everyone's AirTags to point to your malicious script.

chrisjc 5y ago
> I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. While you obviously know what you're talking about, you can't honestly think that the majority of people wouldn't know any better? Even if most people knew better than clicking nwidjjjj.biz/lkqpdi15, something like youfoundmyairtag.hr/tag=238s71j would probably still fool enough to make it a viable vector.
- petee 5y ago
  Many people wont know, notice, or look twice. It doesnt help many popular services use weird url shorteners, so some weird looking url is normal now
londons_explore 5y ago
> construct a fake Apple login page inside the apple.com domain Usually you don't even need to do that. As soon as you have script running inside apple.com, you can get the password manager to auto-fill the password, login, steal the login cookie, and do whatever you like, all with nothing visible to the user.
- judge2020 5y ago
  Once it's fixed this won't be possible, in which a fake Apple sign-in domain will be the best vector.
PartiallyTyped 5y ago
Re url redirect: I think you are putting too much faith in the average person noticing the url given how susceptible humans are to phishing attacks. Re xss: how could you a worm in this case go from one airtag to another?
- jameshart 5y ago
  Password managers and persistent auth cookies are why getting onto the domain matters. I guess the posited worm would make use of the fact that if an authenticated Apple.com user can inject a payload via marking an air tag as lost and setting its phone number, if that payload runs on an Apple.com page on the victim’s device, it then gets some new apple.com credentials; if the victim also has any airtags, it can mark them as lost and inject the payload into the phone number field. Requires the airtag to be scanned by another airtag owner, obviously, and unclear who would scan their airtag. Overall, a good example of how to think about how viral reproduction methods can lead to very different replication rates depending on population characteristics and behavior.
jjulius 5y ago
>... you know you can trust it. If the URL is someone else, you know not to trust it. If HN readers are the "you" here, then that's accurate. If you're referring to your average person, then I would argue that the majority don't know this.
- dividedbyzero 5y ago
  > If HN readers are the "you" here, then that's accurate. Unless it's something very obviously shady, I could see myself fall for something like this.
- rjmunro 5y ago
  Sadly that is true. Luckily, if they are using a password manager, it will do the right thing. Some work has been done on UX here, Apple seems to hide the URL and show only the domain name on iOS sometimes, which is interesting, but annoying. Firefox colour codes the domain name part in the URL bar, but it's pretty subtle.

chrisjc 5y ago

Interesting. Then again, even if apple made it immutable, what's to stop bad actors from having a bunch of lookalike tags manufactured with plain old NFC? edit: apple has no native support for reading NFC tags. You can only do it within apps. So i guess my idea wouldn't work for now.

cmeacham98 5y ago

If I'm an attacker, I'm not using this vulnerability to redirect you to an evil website, but instead to inject a fake login prompt. When you go to check the domain like a good user, you'll see it's on the Apple official website found.apple.com, perfectly safe to enter your credentials on! The ability to impersonate Apple _on their own domain_ is definitely a bigger risk than rewriting the URL or manufacturing a look-alike tag.