5 ms·

I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL

I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. An XSS can do a lot more than just redirect you. It could construct a fake Apple login page inside the apple.com domain, so you would have no reason to suspect it was a phishing attack. You could probably construct something like the Myspace Samy worm (https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)) to spread through Airtag users and change everyone's AirTags to point to your malicious script.

chrisjc 5y ago
> I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. While you obviously know what you're talking about, you can't honestly think that the majority of people wouldn't know any better? Even if most people knew better than clicking nwidjjjj.biz/lkqpdi15, something like youfoundmyairtag.hr/tag=238s71j would probably still fool enough to make it a viable vector.
- petee 5y ago
  Many people wont know, notice, or look twice. It doesnt help many popular services use weird url shorteners, so some weird looking url is normal now
londons_explore 5y ago
> construct a fake Apple login page inside the apple.com domain Usually you don't even need to do that. As soon as you have script running inside apple.com, you can get the password manager to auto-fill the password, login, steal the login cookie, and do whatever you like, all with nothing visible to the user.
- judge2020 5y ago
  Once it's fixed this won't be possible, in which a fake Apple sign-in domain will be the best vector.
PartiallyTyped 5y ago
Re url redirect: I think you are putting too much faith in the average person noticing the url given how susceptible humans are to phishing attacks. Re xss: how could you a worm in this case go from one airtag to another?
- jameshart 5y ago
  Password managers and persistent auth cookies are why getting onto the domain matters. I guess the posited worm would make use of the fact that if an authenticated Apple.com user can inject a payload via marking an air tag as lost and setting its phone number, if that payload runs on an Apple.com page on the victim’s device, it then gets some new apple.com credentials; if the victim also has any airtags, it can mark them as lost and inject the payload into the phone number field. Requires the airtag to be scanned by another airtag owner, obviously, and unclear who would scan their airtag. Overall, a good example of how to think about how viral reproduction methods can lead to very different replication rates depending on population characteristics and behavior.
jjulius 5y ago
>... you know you can trust it. If the URL is someone else, you know not to trust it. If HN readers are the "you" here, then that's accurate. If you're referring to your average person, then I would argue that the majority don't know this.
- dividedbyzero 5y ago
  > If HN readers are the "you" here, then that's accurate. Unless it's something very obviously shady, I could see myself fall for something like this.
- rjmunro 5y ago
  Sadly that is true. Luckily, if they are using a password manager, it will do the right thing. Some work has been done on UX here, Apple seems to hide the URL and show only the domain name on iOS sometimes, which is interesting, but annoying. Firefox colour codes the domain name part in the URL bar, but it's pretty subtle.

chrisjc 5y ago

> I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. While you obviously know what you're talking about, you can't honestly think that the majority of people wouldn't know any better? Even if most people knew better than clicking nwidjjjj.biz/lkqpdi15, something like youfoundmyairtag.hr/tag=238s71j would probably still fool enough to make it a viable vector.

petee 5y ago
Many people wont know, notice, or look twice. It doesnt help many popular services use weird url shorteners, so some weird looking url is normal now

londons_explore 5y ago

> construct a fake Apple login page inside the apple.com domain Usually you don't even need to do that. As soon as you have script running inside apple.com, you can get the password manager to auto-fill the password, login, steal the login cookie, and do whatever you like, all with nothing visible to the user.

judge2020 5y ago
Once it's fixed this won't be possible, in which a fake Apple sign-in domain will be the best vector.

PartiallyTyped 5y ago

Re url redirect: I think you are putting too much faith in the average person noticing the url given how susceptible humans are to phishing attacks. Re xss: how could you a worm in this case go from one airtag to another?

jameshart 5y ago
Password managers and persistent auth cookies are why getting onto the domain matters. I guess the posited worm would make use of the fact that if an authenticated Apple.com user can inject a payload via marking an air tag as lost and setting its phone number, if that payload runs on an Apple.com page on the victim’s device, it then gets some new apple.com credentials; if the victim also has any airtags, it can mark them as lost and inject the payload into the phone number field. Requires the airtag to be scanned by another airtag owner, obviously, and unclear who would scan their airtag. Overall, a good example of how to think about how viral reproduction methods can lead to very different replication rates depending on population characteristics and behavior.

jjulius 5y ago

>... you know you can trust it. If the URL is someone else, you know not to trust it. If HN readers are the "you" here, then that's accurate. If you're referring to your average person, then I would argue that the majority don't know this.

dividedbyzero 5y ago
> If HN readers are the "you" here, then that's accurate. Unless it's something very obviously shady, I could see myself fall for something like this.
rjmunro 5y ago
Sadly that is true. Luckily, if they are using a password manager, it will do the right thing. Some work has been done on UX here, Apple seems to hide the URL and show only the domain name on iOS sometimes, which is interesting, but annoying. Firefox colour codes the domain name part in the URL bar, but it's pretty subtle.