7 ms·

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then r

by lloeki 3y ago

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone coercing/subverting Apple, be it law enforcement or a hacker) power to get access to our accounts. This obviously stopped the attackers dead in their track. For similar reasons I set up advanced data protection as soon as it was available and disabled web access. Only trusted devices get to see our data, and only trusted devices get to enroll a new device.

fortran77 3y ago
Wow! You'd think they'd rate limit these! Once you've done it twice, go to once every 15 minutes, then hour, then 4 hours, than day, etc. Like bad logins.
- nilsherzig 3y ago
  That would allow me to log you out of your accounts
  - prepend 3y ago
    No, it would affect login status. Just a delay between reset attempts. No reset actually occurs until one prompt is accepted.
- WorldMaker 3y ago
  Krebs notes that the recovery form does have some form of CAPTCHA on them, which mostly just goes to show that CAPTCHA systems are a poor and increasingly deficient rate limiter. ETA: Also from a user experience even once a week between attempts is still enough to deeply annoy a user getting popups on their devices. This is one of those cases where rate limits probably still can't solve the user irritation.
deleted 3y ago
[deleted]
viraptor 3y ago
It's not a recent approach, but this is a recent campaign using it against many people. Someone likely got a list of hacked passwords from some recent dump and is going through the apple accounts from it.
- lloeki 3y ago
  I ventured as much. Given the amount of messages and the personal details gathered, I also guess attacker tools have significantly been improved or streamlined.
- criddell 3y ago
  How would that explain Chris’ experience at the Genius Bar?
JKCalhoun 3y ago
I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.
- josephcsible 3y ago
  Such a high risk of being locked out permanently is more than most people can stomach. Why can't they offer a last-resort option like showing up in person at an Apple Store with government-issued photo ID?
  - toomuchtodo 3y ago
    Because they aren’t required to by law. I have filed comments with the FTC that this recovery path should be legally mandated for digital accounts, I encourage others to do the same. It doesn’t have to be an Apple Store (insider risk, see SIM swapping analogy); could be USPS or another government identity proofer they partner with. Login.gov uses USPS for in person identity proofing, for example. Your data and account ownership interest doesn’t disappear because of failure to possess the right sequence of bytes or a string. Can you imagine if your real estate or securities ownership evaporated because you didn't have the right password? Silliness.
    - kccqzy 3y ago
      Well previously when stock trades involved exchanging physical certificates, I could imagine that ownership could evaporate if you lost that piece of paper. Or just think about cash: you do lose that ownership when you lose that magical piece of paper. It's a simpler world when what you have physically determines what you own.
      - josephcsible 3y ago
        If the deed to land or the title to a car gets destroyed, what happens? It doesn't suddenly forever become unownable.
antihero 3y ago
Also, buy some (at least three) YubiKeys and use them for your Apple ID verification instead of the dumb push MFA. https://support.apple.com/en-gb/HT213154 https://support.apple.com/en-gb/HT213154
- someguydave 3y ago
  But is it the case that the Yubikey is essentially treated the same as a trusted device? What if I want to untrust my devices and only trust ubikeys (without removing the device from my icloud account?)
  - antihero 3y ago
    I don’t seem to have the push option now
    - someguydave 3y ago
      Yes but my understanding is that you can remove the Yubikey without possessing it, just with a “trusted device”. I want to mark all of my devices untrusted (wrt icloud account changes) and rely only on Yubikeys
- someguydave 3y ago
  From your apple doc: “ When you use Security Keys for Apple ID, you’ll need a trusted device or a security key to: Sign in with your Apple ID on a new device or on the web Reset your Apple ID password or unlock your Apple ID Add additional security keys or remove a security key” Yubikeys do nothing except enlarge your attack surface.
vdddv 3y ago
Interesting that using the recovery key stopped the issue for you, but does not seem to do its job now. From the article "Ken said he enabled a recovery key for his account as instructed, but that it hasn’t stopped the unbidden system alerts from appearing on all of his devices every few days. KrebsOnSecurity tested Ken’s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices. "
- hx833001 3y ago
  A password reset prompt is sent to the devices, but unfortunately the article leaves out that the prompt only enables you to reset the password on the device that receives the prompt. So it is not a security issue, just an annoyance.

by lloeki 3y ago

fortran77 3y ago

Wow! You'd think they'd rate limit these! Once you've done it twice, go to once every 15 minutes, then hour, then 4 hours, than day, etc. Like bad logins.

nilsherzig 3y ago
That would allow me to log you out of your accounts
- prepend 3y ago
  No, it would affect login status. Just a delay between reset attempts. No reset actually occurs until one prompt is accepted.
WorldMaker 3y ago
Krebs notes that the recovery form does have some form of CAPTCHA on them, which mostly just goes to show that CAPTCHA systems are a poor and increasingly deficient rate limiter. ETA: Also from a user experience even once a week between attempts is still enough to deeply annoy a user getting popups on their devices. This is one of those cases where rate limits probably still can't solve the user irritation.

deleted 3y ago

[deleted]

viraptor 3y ago

It's not a recent approach, but this is a recent campaign using it against many people. Someone likely got a list of hacked passwords from some recent dump and is going through the apple accounts from it.

lloeki 3y ago
I ventured as much. Given the amount of messages and the personal details gathered, I also guess attacker tools have significantly been improved or streamlined.
criddell 3y ago
How would that explain Chris’ experience at the Genius Bar?

JKCalhoun 3y ago

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

josephcsible 3y ago
Such a high risk of being locked out permanently is more than most people can stomach. Why can't they offer a last-resort option like showing up in person at an Apple Store with government-issued photo ID?
- toomuchtodo 3y ago
  Because they aren’t required to by law. I have filed comments with the FTC that this recovery path should be legally mandated for digital accounts, I encourage others to do the same. It doesn’t have to be an Apple Store (insider risk, see SIM swapping analogy); could be USPS or another government identity proofer they partner with. Login.gov uses USPS for in person identity proofing, for example. Your data and account ownership interest doesn’t disappear because of failure to possess the right sequence of bytes or a string. Can you imagine if your real estate or securities ownership evaporated because you didn't have the right password? Silliness.
  - kccqzy 3y ago
    Well previously when stock trades involved exchanging physical certificates, I could imagine that ownership could evaporate if you lost that piece of paper. Or just think about cash: you do lose that ownership when you lose that magical piece of paper. It's a simpler world when what you have physically determines what you own.
    - josephcsible 3y ago
      If the deed to land or the title to a car gets destroyed, what happens? It doesn't suddenly forever become unownable.

antihero 3y ago

Also, buy some (at least three) YubiKeys and use them for your Apple ID verification instead of the dumb push MFA. https://support.apple.com/en-gb/HT213154 https://support.apple.com/en-gb/HT213154

someguydave 3y ago
But is it the case that the Yubikey is essentially treated the same as a trusted device? What if I want to untrust my devices and only trust ubikeys (without removing the device from my icloud account?)
- antihero 3y ago
  I don’t seem to have the push option now
  - someguydave 3y ago
    Yes but my understanding is that you can remove the Yubikey without possessing it, just with a “trusted device”. I want to mark all of my devices untrusted (wrt icloud account changes) and rely only on Yubikeys
someguydave 3y ago
From your apple doc: “ When you use Security Keys for Apple ID, you’ll need a trusted device or a security key to: Sign in with your Apple ID on a new device or on the web Reset your Apple ID password or unlock your Apple ID Add additional security keys or remove a security key” Yubikeys do nothing except enlarge your attack surface.

vdddv 3y ago

Interesting that using the recovery key stopped the issue for you, but does not seem to do its job now. From the article "Ken said he enabled a recovery key for his account as instructed, but that it hasn’t stopped the unbidden system alerts from appearing on all of his devices every few days. KrebsOnSecurity tested Ken’s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices. "

hx833001 3y ago
A password reset prompt is sent to the devices, but unfortunately the article leaves out that the prompt only enables you to reset the password on the device that receives the prompt. So it is not a security issue, just an annoyance.