4 ms·

iPhone thief explains how he breaks into phones [video]

19 points by saikatsg 3y ago

asylteltine 3y ago
Anything actually technical here? I’m always skeptical of legacy media reporting on tech
- david_allison 3y ago
  Nothing
- mcgeez 3y ago
  Well more of a product/security matter here. The amount of access that an unlocked device gets you is nuts. I didn't expect to be able to reset an apple id password with a device pin code.
- deleted 3y ago
  [deleted]
- xethos 3y ago
  I'm not sure it matters - it's not a technical-heavy flaw in Apple's security. He either recorded people putting in their unlock codes, or straight up asked them what it was. The reporter doesn't have to be very technically-minded to follow.
  - asylteltine 3y ago
    Ah well where’s the hack then? I assumed it was going to be their typical click bait and was right. Accessing someone’s data with an unlocked phone isn’t hacking at all.
    - sgerenser 3y ago
      I think most people wouldn’t expect it to be possible to disable iCloud and turn off remote wipe with just the device passcode.
ofrzeta 3y ago
He "broke into the phones" by using social engineering to get the PIN.
- c0pium 3y ago
  And I bet it’s super effective. Adversary goals are not generally to do something cool, they’re to do the easiest possible thing that works.
unsupp0rted 3y ago
> "I was homeless, started having kids, needed money" > "I'm here [in prison] because I got too carried away" Arrested for getting passcodes through trickery and violence. That said, this report makes a good point: * Johnson would quickly replace the passcode and then replace FaceID with his face * He could then get into PayPal, Venmo, etc via (his) FaceID * He could make ApplePay transactions at physical stores, again using FaceID So, device PIN = all you need to get into all finance apps (if FaceID was enabled for them) > "Johnson made $20,000 per weekend from selling the stolen phones" > "I wish I had not been so greedy and just got what I got and changed my life" > "When you get out, will you forget about this trick?" > "There's gonna be new tricks out"
- akie 3y ago
  but he concludes with > "...and I don't want nothing to do with it"
  - deleted 3y ago
    [deleted]
- cassianoleal 3y ago
  Yeah this is pretty glaring. Changing the biometrics should automatically invalidate all FaceID tokens and block falling back to device PIN. It should effectively log the device out of all services, perhaps even delete browser cookies etc. since it should mean the person holding the phone is not the one who logged on to those. Of course, this could have other implications so a lot of care has to be taken when designing and implementing this.
  - Tommstein 3y ago
    Android appears to do something like this with fingerprints (or at least enable it). Whenever I add a new one, apps stop accepting fingerprints until I enter my password/passcode/whatever in each one.
    - 3y ago
rational_indian 3y ago
Moral of the story buy Android when everybody else has an iPhone.
noodlesUK 3y ago
There are a few things that I wish I could change which would improve my personal security posture massively: 1. When advanced data protection is turned on, it should not be possible to change the Apple ID password without the associated hardware tokens. 2. Again when advanced data protection is on, it should require the hardware tokens to add a Face ID appearance or change the device passcode.
slayne 3y ago
I mean, how Apple is letting someone change my Apple ID password just by knowing my iPhone pass code, that's insane. What's the point of having an Apple ID password if you can change it with the phone pass code ? It just bother the regular users to have 2 passwords to remember, but adds no security whatsoever...
- fingerlocks 3y ago
  Did you try this to confirm it’s even true? It takes 5 seconds, just try it. Because I did. My iPhone prompted me for my password in addition to the PIN. Maybe we shouldn’t take this article at face value.
  - Tactical45 3y ago
    Likely been already fixed as a result of issues like these.
  - wannacboatmovie 3y ago
    In the time it took you to type out that snarky response I did in fact try it and it allows it under the following conditions: 1. you have a passcode set 2. you are logged into iCloud. 1 & 2 are true for nearly everyone so sounds like yes this is still a problem.
- rawgabbit 3y ago
  Apple says you are supposed to set a second PIN under screen time to prevent Account Changes.
notzane 3y ago
https://xkcd.com/538 https://xkcd.com/538

19 points by saikatsg 3y ago

asylteltine 3y ago

Anything actually technical here? I’m always skeptical of legacy media reporting on tech

david_allison 3y ago
Nothing
mcgeez 3y ago
Well more of a product/security matter here. The amount of access that an unlocked device gets you is nuts. I didn't expect to be able to reset an apple id password with a device pin code.
deleted 3y ago
[deleted]
xethos 3y ago
I'm not sure it matters - it's not a technical-heavy flaw in Apple's security. He either recorded people putting in their unlock codes, or straight up asked them what it was. The reporter doesn't have to be very technically-minded to follow.
- asylteltine 3y ago
  Ah well where’s the hack then? I assumed it was going to be their typical click bait and was right. Accessing someone’s data with an unlocked phone isn’t hacking at all.
  - sgerenser 3y ago
    I think most people wouldn’t expect it to be possible to disable iCloud and turn off remote wipe with just the device passcode.

ofrzeta 3y ago

He "broke into the phones" by using social engineering to get the PIN.

c0pium 3y ago
And I bet it’s super effective. Adversary goals are not generally to do something cool, they’re to do the easiest possible thing that works.

unsupp0rted 3y ago

> "I was homeless, started having kids, needed money" > "I'm here [in prison] because I got too carried away" Arrested for getting passcodes through trickery and violence. That said, this report makes a good point: * Johnson would quickly replace the passcode and then replace FaceID with his face * He could then get into PayPal, Venmo, etc via (his) FaceID * He could make ApplePay transactions at physical stores, again using FaceID So, device PIN = all you need to get into all finance apps (if FaceID was enabled for them) > "Johnson made $20,000 per weekend from selling the stolen phones" > "I wish I had not been so greedy and just got what I got and changed my life" > "When you get out, will you forget about this trick?" > "There's gonna be new tricks out"

akie 3y ago
but he concludes with > "...and I don't want nothing to do with it"
- deleted 3y ago
  [deleted]
cassianoleal 3y ago
Yeah this is pretty glaring. Changing the biometrics should automatically invalidate all FaceID tokens and block falling back to device PIN. It should effectively log the device out of all services, perhaps even delete browser cookies etc. since it should mean the person holding the phone is not the one who logged on to those. Of course, this could have other implications so a lot of care has to be taken when designing and implementing this.
- Tommstein 3y ago
  Android appears to do something like this with fingerprints (or at least enable it). Whenever I add a new one, apps stop accepting fingerprints until I enter my password/passcode/whatever in each one.
  - 3y ago

rational_indian 3y ago

Moral of the story buy Android when everybody else has an iPhone.

noodlesUK 3y ago

There are a few things that I wish I could change which would improve my personal security posture massively: 1. When advanced data protection is turned on, it should not be possible to change the Apple ID password without the associated hardware tokens. 2. Again when advanced data protection is on, it should require the hardware tokens to add a Face ID appearance or change the device passcode.

slayne 3y ago

I mean, how Apple is letting someone change my Apple ID password just by knowing my iPhone pass code, that's insane. What's the point of having an Apple ID password if you can change it with the phone pass code ? It just bother the regular users to have 2 passwords to remember, but adds no security whatsoever...

fingerlocks 3y ago
Did you try this to confirm it’s even true? It takes 5 seconds, just try it. Because I did. My iPhone prompted me for my password in addition to the PIN. Maybe we shouldn’t take this article at face value.
- Tactical45 3y ago
  Likely been already fixed as a result of issues like these.
- wannacboatmovie 3y ago
  In the time it took you to type out that snarky response I did in fact try it and it allows it under the following conditions: 1. you have a passcode set 2. you are logged into iCloud. 1 & 2 are true for nearly everyone so sounds like yes this is still a problem.
rawgabbit 3y ago
Apple says you are supposed to set a second PIN under screen time to prevent Account Changes.

notzane 3y ago

https://xkcd.com/538 https://xkcd.com/538