11 ms·

Apple Suspends Over-the-Phone AppleID Password Resets

130 points by derpenxyne 14y ago

X-Istence 14y ago
"After Epic Hack [...]". Sorry, not that epic. Yes, multiple steps were required but the biggest issue in security once again was the human element. Epic would be finding the flaws in SSL/TLS that allows you to generate a valid cert for any domain (Moxie Marlinspike) or a bug in DNS that is such cause for concern that people have to upgrade their infrastructure (Dan Kaminsky) or intercepting GSM calls (Chris Paget) while making the device believe it is on a legitimate network. This hack came down to social engineering and using flaws in two companies verification systems. That isn't epic. People have been calling companies and people on the phone for decades and having them hand over information without proper identification/verification. The guys stuff got remote erased, well damn, the system worked as it was supposed to work ... other than that the right person wasn't at the controls ... remote wipe worked as expected. Yes, changes have to be made, and yes security and verification of identity has to be made more secure when there is a lot at stake, but this hack was by no means epic.
- Xyzodiac 14y ago
  Agreed, epic is a definite overstatement.
- InclinedPlane 14y ago
  I think the title "Epic Hack" is justified. Not epic in terms of the skills and technologies used to pull it off but epic in terms of the impact on the hackee. Whether you gain access to someone's apartment by rappelling from the roof, disabling the electronic alarm system, and picking the lock on the balcony door or merely by using social engineering on the building supervisor the result is the same. I think that denigrating the significance of these "low sophistication" attacks is fundamentally the same error as venerating the importance of single-points of technological complexity independent of the end-to-end security of a system. It makes it easier to change the response from "oh crap, we got hacked so hard!" to "well, we just got socially engineered, ANYBODY can do that, no big deal". Social engineering is going to remain firmly in the "epic hack" category for the foreseeable future, even in a future age of quantum computers, synthetic consciousness, and ubiquitous use of one-time-pad encryption.
  - niels_olson 14y ago
    Agreed. When Katrina came ashore, it was technically down to a category 2. Should I be less concerned? No, more.
- notJim 14y ago
  I think the description of it as epic refers to the amount and nature of the damage done, not the technical accomplishment. We expect that someone might be able to hack our online accounts, but that they could hack our online accounts and then use that to reach into our homes to nuke data off of our hard drives is different.
  - taligent 14y ago
    Remember that you have to explicitly enable this feature. Remote wipe is NOT enabled by default.
    - kevingadd 14y ago
      It's too bad the feature is named 'Find My Mac' instead of 'Remote Wipe'.
      - taligent 14y ago
        I know. Remote Wipe is part of Find My Mac. And it's not enabled by default.
        cstejerean 14y ago
        You know. Many others don't, and some of those that do just want the finding without the wiping.
      - sirn 14y ago
        Perhaps Apple need to reword their warning message[1] to scare people away from enabling it. The only indication that user is going to enable Remote Wipe is a little "erase a lost Mac" text, which I guess most people will just ignore it. [1]: http://cl.ly/image/3u1D3F1W0m0B http://cl.ly/image/3u1D3F1W0m0B
      - codeka 14y ago
        I really do think these things should be separate, with separate enabled/disabled settings. Especially on the iPhone/iPad where a lost device (i.e. behind the couch or something) is far more common than a stolen one.
- stcredzero 14y ago
  > This hack came down to social engineering and using flaws in two companies verification systems. That isn't epic. Epic status is irrelevant. It was effective. It should not be. Full stop.
vm 14y ago
Wired mentions Apple 46 times in the article (including twice in the title)... and Amazon 3 times. In fact, most of the public and HN outrage about this incident has been directed at Apple. That's the downside of Apple being so close to perfect. We expect perfection from them at all times. And when they make a mistake, it seems 100x more outrageous than if it were any other company. Don't get me wrong, they made a terrible mistake in this case, but Amazon has gotten off lightly in comparison.
- dman 14y ago
  Afaik amazon didnt run ads pointing out how insecure their competitors were - http://www.youtube.com/watch?v=GQb_Q8WRL_g http://www.youtube.com/watch?v=GQb_Q8WRL_g http://www.youtube.com/watch?NR=1&feature=endscreen&v=8TABhGdeGyM http://www.youtube.com/watch?NR=1&feature=endscreen&... The downside to selling people on the idea that your platform is secure and infallible is that people will hold you up to it.
  - shadesandcolour 14y ago
    I'm sorry I thought that you were going to link to ads where Apple touts the security of it's iCloud platforms and its over the phone support service. Claiming to be immune to viruses that ran on windows and claming to be secure against social engineering are two very different things. The first poster is correct, Amazon needed less information to do things over the phone than Apple did. All Amazon wanted was your billing address and they would let you add emails to the accounts and then who knows what you could do. Both companies are at fault here.
- pserwylo 14y ago
  Don't get me wrong, I agree with your sentiment. However, I think in this case, it is about the fact that the stakes were much higher with the iCloud account. Yes, I would be very annoyed if an account which had personal information, a history of purchases, and was linked to my credit got hacked (e.g. by social engineering). However, I would be even more annoyed if my laptop and phone got remote-wiped due to the same type of hacking. But to be honest, I haven't been following the story that closely, so I am happy to be proven wrong on the perceived difference between the social engineering of Amazon vs Apple support .
willfulwizard 14y ago
> In an earlier attempt on Tuesday to change an AppleID password (which is the same password used to log into iCloud and iTunes), Apple customer service offered up a different response, saying that passwords could only be changed over the phone if we were able to supply a serial number for a device linked to the AppleID in question — for example, an iPhone, iPad or MacBook computer. Adding (or worse, substituting) a serial number helps, but seems insecure in the event of a lost/stolen phone. A device serial number, plus all the already mentioned info: name, address, last 4 characters of a credit card, are all reasonably easy to extract from a stolen phone. Would be nice if some piece of info not usually stored on a phone were required. I suppose that a lost phone is already a security breach, but any containment would be an improvement.
- ryannielsen 14y ago
  On many Apple devices, the only way to access the serial is to actually log into the device and open Settings or About this Mac. If the attacker's able to do that then – in the majority of cases – they likely already have access to your mail and probably many other accounts as well. At that point, it's pretty much game over for you; containment's impossible. (Two big loopholes on the Mac side are guest accounts and the recovery partition. Both of those offer ways to get your machine's serial number which do not require the attacker to log into your account.)
  - lloeki 14y ago
    The serial is engraved/printed on the case of my Macbook Pro and iPhone 4.
    - ryannielsen 14y ago
      Ah, you're correct on the MacBook case. I didn't have any laptops nearby to confirm. I can't find anywhere on my phone where the serial number's printed, though. The numbers on the back are not the phone's serial number.
jsz0 14y ago
Does Apple do in-store password resets? I'm thinking with their retail presence this would be a good solution. If you want your password reset come into the store with a photo-ID and the physical credit card on your account. Doesn't get much better than that. I realize not everyone has an Apple Store nearby but many do.
- majormajor 14y ago
  "I realize not everyone has an Apple Store nearby but many do." That could be a handy additional service to offer, but they'd still have to provide a non-in-store method for all the people who don't, so it wouldn't be any more secure.
  - Kadrith 14y ago
    Facetime?
    - minikites 14y ago
      You need an Apple ID for FaceTime.
- josteink 14y ago
  If your solution to a technical problem is an Apple store, you have been drinking too much juice.
- 7952 14y ago
  Whenever you do a password reset their is a possibility that it was performed by an attacker. However much you check their identity this will always be a risk. Therefore it makes sense for Apple to try and contact the user via several different methods. Call them on the phone, send a letter etc to inform them of the password reset. It must originate from apple, and be out of band. Having people go to the apple store does not achieve this.
craz 14y ago
I think having to re-enable remote wipe on each device after a password reset would be a reasonable compromise.
- lparry 14y ago
  I also find it strange this isn't the case. I changed my apple password and instantly my phone started complaining that it was wrong for iMessage and other services. Why is it still fine to remote wipe the device?
- Zenst 14y ago
  Would be nice if they offered the option to remote encrypt and you can only decrypt with a visit to a Apple store. But nomatter what you offer, there will always be a way to offer a little more. Your approach does leae users open to there own hindsight and if you lost a device you might in some situations reset the password first and then thing about remotely wiping the device and in those situations you will be a bit erked. That said it would be nice to at least have that option, options are nice as they allow the user to pick the level of control they want, more options more choice. Still be nice if a device being remote wiped checked its location and went - oi hang on your at home I need to verify this first, scary but doable.
aufreak3 14y ago
I see no reason not to use a password manager (ex: keychain on macos) to keep different usernames and passwords for each account. It is very little overhead (at least with keychain). And yes I mean different user names even if it is required to be a valid email id. If you use gmail, you can use "yourid+RandomNumberOrAnything@gmail.com" as the email address. This is additional protection against remote hackers since guessing the account name of one account doesn't get you the names of accounts on other services. And yes ABSOLUTELY NO reason to not have 2 factor auth for your google account.
- shadesandcolour 14y ago
  You didn't really read the article about what happened did you? It didn't really come down to the email address especially since part of it was concealed. This came down to both companies letting you do things over the phone with minimal personal information.
  - aufreak3 14y ago
    This is merely things that I practice that I think may be useful to some. I did read the full article and not just this one all the others including Matt Cuts post on 2fa. The companies are to blame, yes, but the "victim" is also responsible to some extent. "Only the paranoid survive." (I think that's by Andy Grove). Honan owned up to not backing up, for example. Would it have been an "epic hack" if he could restore up to date data because he had a time machine backup?
- xentronium 14y ago
  Please, take your time to understand what happened before blaming the victim.
yalogin 14y ago
Interestingly Google will not get into this situation because they do not offer over the phone support. That is the advantage of being a free service I guess! People do not expect customer service beyond a point. Of course they offer two factor authentication.
- sigkill 14y ago
  Google have their own problems with Youtube's aggressive Content ID system and pulling down of public domain NASA videos on the grounds of (wtf?) copyright infringement.
nileshtrivedi 14y ago
Wouldn't it be much better if video calls (or Facetime) became ubiquitous (and mandated for auth)? The mere fact that the attacker needs to show his face for getting the password reset should improve things a lot because it would make detection as well as post-facto investigation much easier.

130 points by derpenxyne 14y ago

"After Epic Hack [...]". Sorry, not that epic. Yes, multiple steps were required but the biggest issue in security once again was the human element. Epic would be finding the flaws in SSL/TLS that allows you to generate a valid cert for any domain (Moxie Marlinspike) or a bug in DNS that is such cause for concern that people have to upgrade their infrastructure (Dan Kaminsky) or intercepting GSM calls (Chris Paget) while making the device believe it is on a legitimate network. This hack came down to social engineering and using flaws in two companies verification systems. That isn't epic. People have been calling companies and people on the phone for decades and having them hand over information without proper identification/verification. The guys stuff got remote erased, well damn, the system worked as it was supposed to work ... other than that the right person wasn't at the controls ... remote wipe worked as expected. Yes, changes have to be made, and yes security and verification of identity has to be made more secure when there is a lot at stake, but this hack was by no means epic.

Xyzodiac 14y ago
Agreed, epic is a definite overstatement.
InclinedPlane 14y ago
I think the title "Epic Hack" is justified. Not epic in terms of the skills and technologies used to pull it off but epic in terms of the impact on the hackee. Whether you gain access to someone's apartment by rappelling from the roof, disabling the electronic alarm system, and picking the lock on the balcony door or merely by using social engineering on the building supervisor the result is the same. I think that denigrating the significance of these "low sophistication" attacks is fundamentally the same error as venerating the importance of single-points of technological complexity independent of the end-to-end security of a system. It makes it easier to change the response from "oh crap, we got hacked so hard!" to "well, we just got socially engineered, ANYBODY can do that, no big deal". Social engineering is going to remain firmly in the "epic hack" category for the foreseeable future, even in a future age of quantum computers, synthetic consciousness, and ubiquitous use of one-time-pad encryption.
- niels_olson 14y ago
  Agreed. When Katrina came ashore, it was technically down to a category 2. Should I be less concerned? No, more.
notJim 14y ago
I think the description of it as epic refers to the amount and nature of the damage done, not the technical accomplishment. We expect that someone might be able to hack our online accounts, but that they could hack our online accounts and then use that to reach into our homes to nuke data off of our hard drives is different.
- taligent 14y ago
  Remember that you have to explicitly enable this feature. Remote wipe is NOT enabled by default.
  - kevingadd 14y ago
    It's too bad the feature is named 'Find My Mac' instead of 'Remote Wipe'.
    - taligent 14y ago
      I know. Remote Wipe is part of Find My Mac. And it's not enabled by default.
      - cstejerean 14y ago
        You know. Many others don't, and some of those that do just want the finding without the wiping.
    - sirn 14y ago
      Perhaps Apple need to reword their warning message[1] to scare people away from enabling it. The only indication that user is going to enable Remote Wipe is a little "erase a lost Mac" text, which I guess most people will just ignore it. [1]: http://cl.ly/image/3u1D3F1W0m0B http://cl.ly/image/3u1D3F1W0m0B
    - codeka 14y ago
      I really do think these things should be separate, with separate enabled/disabled settings. Especially on the iPhone/iPad where a lost device (i.e. behind the couch or something) is far more common than a stolen one.
stcredzero 14y ago
> This hack came down to social engineering and using flaws in two companies verification systems. That isn't epic. Epic status is irrelevant. It was effective. It should not be. Full stop.

vm 14y ago

Wired mentions Apple 46 times in the article (including twice in the title)... and Amazon 3 times. In fact, most of the public and HN outrage about this incident has been directed at Apple. That's the downside of Apple being so close to perfect. We expect perfection from them at all times. And when they make a mistake, it seems 100x more outrageous than if it were any other company. Don't get me wrong, they made a terrible mistake in this case, but Amazon has gotten off lightly in comparison.

dman 14y ago
Afaik amazon didnt run ads pointing out how insecure their competitors were - http://www.youtube.com/watch?v=GQb_Q8WRL_g http://www.youtube.com/watch?v=GQb_Q8WRL_g http://www.youtube.com/watch?NR=1&feature=endscreen&v=8TABhGdeGyM http://www.youtube.com/watch?NR=1&feature=endscreen&... The downside to selling people on the idea that your platform is secure and infallible is that people will hold you up to it.
- shadesandcolour 14y ago
  I'm sorry I thought that you were going to link to ads where Apple touts the security of it's iCloud platforms and its over the phone support service. Claiming to be immune to viruses that ran on windows and claming to be secure against social engineering are two very different things. The first poster is correct, Amazon needed less information to do things over the phone than Apple did. All Amazon wanted was your billing address and they would let you add emails to the accounts and then who knows what you could do. Both companies are at fault here.
pserwylo 14y ago
Don't get me wrong, I agree with your sentiment. However, I think in this case, it is about the fact that the stakes were much higher with the iCloud account. Yes, I would be very annoyed if an account which had personal information, a history of purchases, and was linked to my credit got hacked (e.g. by social engineering). However, I would be even more annoyed if my laptop and phone got remote-wiped due to the same type of hacking. But to be honest, I haven't been following the story that closely, so I am happy to be proven wrong on the perceived difference between the social engineering of Amazon vs Apple support .

willfulwizard 14y ago

> In an earlier attempt on Tuesday to change an AppleID password (which is the same password used to log into iCloud and iTunes), Apple customer service offered up a different response, saying that passwords could only be changed over the phone if we were able to supply a serial number for a device linked to the AppleID in question — for example, an iPhone, iPad or MacBook computer. Adding (or worse, substituting) a serial number helps, but seems insecure in the event of a lost/stolen phone. A device serial number, plus all the already mentioned info: name, address, last 4 characters of a credit card, are all reasonably easy to extract from a stolen phone. Would be nice if some piece of info not usually stored on a phone were required. I suppose that a lost phone is already a security breach, but any containment would be an improvement.

ryannielsen 14y ago
On many Apple devices, the only way to access the serial is to actually log into the device and open Settings or About this Mac. If the attacker's able to do that then – in the majority of cases – they likely already have access to your mail and probably many other accounts as well. At that point, it's pretty much game over for you; containment's impossible. (Two big loopholes on the Mac side are guest accounts and the recovery partition. Both of those offer ways to get your machine's serial number which do not require the attacker to log into your account.)
- lloeki 14y ago
  The serial is engraved/printed on the case of my Macbook Pro and iPhone 4.
  - ryannielsen 14y ago
    Ah, you're correct on the MacBook case. I didn't have any laptops nearby to confirm. I can't find anywhere on my phone where the serial number's printed, though. The numbers on the back are not the phone's serial number.

jsz0 14y ago

Does Apple do in-store password resets? I'm thinking with their retail presence this would be a good solution. If you want your password reset come into the store with a photo-ID and the physical credit card on your account. Doesn't get much better than that. I realize not everyone has an Apple Store nearby but many do.

majormajor 14y ago
"I realize not everyone has an Apple Store nearby but many do." That could be a handy additional service to offer, but they'd still have to provide a non-in-store method for all the people who don't, so it wouldn't be any more secure.
- Kadrith 14y ago
  Facetime?
  - minikites 14y ago
    You need an Apple ID for FaceTime.
josteink 14y ago
If your solution to a technical problem is an Apple store, you have been drinking too much juice.
7952 14y ago
Whenever you do a password reset their is a possibility that it was performed by an attacker. However much you check their identity this will always be a risk. Therefore it makes sense for Apple to try and contact the user via several different methods. Call them on the phone, send a letter etc to inform them of the password reset. It must originate from apple, and be out of band. Having people go to the apple store does not achieve this.

craz 14y ago

I think having to re-enable remote wipe on each device after a password reset would be a reasonable compromise.

lparry 14y ago
I also find it strange this isn't the case. I changed my apple password and instantly my phone started complaining that it was wrong for iMessage and other services. Why is it still fine to remote wipe the device?
Zenst 14y ago
Would be nice if they offered the option to remote encrypt and you can only decrypt with a visit to a Apple store. But nomatter what you offer, there will always be a way to offer a little more. Your approach does leae users open to there own hindsight and if you lost a device you might in some situations reset the password first and then thing about remotely wiping the device and in those situations you will be a bit erked. That said it would be nice to at least have that option, options are nice as they allow the user to pick the level of control they want, more options more choice. Still be nice if a device being remote wiped checked its location and went - oi hang on your at home I need to verify this first, scary but doable.

aufreak3 14y ago

I see no reason not to use a password manager (ex: keychain on macos) to keep different usernames and passwords for each account. It is very little overhead (at least with keychain). And yes I mean different user names even if it is required to be a valid email id. If you use gmail, you can use "yourid+RandomNumberOrAnything@gmail.com" as the email address. This is additional protection against remote hackers since guessing the account name of one account doesn't get you the names of accounts on other services. And yes ABSOLUTELY NO reason to not have 2 factor auth for your google account.

shadesandcolour 14y ago
You didn't really read the article about what happened did you? It didn't really come down to the email address especially since part of it was concealed. This came down to both companies letting you do things over the phone with minimal personal information.
- aufreak3 14y ago
  This is merely things that I practice that I think may be useful to some. I did read the full article and not just this one all the others including Matt Cuts post on 2fa. The companies are to blame, yes, but the "victim" is also responsible to some extent. "Only the paranoid survive." (I think that's by Andy Grove). Honan owned up to not backing up, for example. Would it have been an "epic hack" if he could restore up to date data because he had a time machine backup?
xentronium 14y ago
Please, take your time to understand what happened before blaming the victim.

yalogin 14y ago

Interestingly Google will not get into this situation because they do not offer over the phone support. That is the advantage of being a free service I guess! People do not expect customer service beyond a point. Of course they offer two factor authentication.

sigkill 14y ago
Google have their own problems with Youtube's aggressive Content ID system and pulling down of public domain NASA videos on the grounds of (wtf?) copyright infringement.

nileshtrivedi 14y ago

Wouldn't it be much better if video calls (or Facetime) became ubiquitous (and mandated for auth)? The mere fact that the attacker needs to show his face for getting the password reset should improve things a lot because it would make detection as well as post-facto investigation much easier.