Apple Online Store Security Flaw Exposed PINs of T-Mobile Customers

Discussion in ' News Discussion' started by MacRumors, Aug 24, 2018.

  1. MacRumors macrumors bot


    Apr 12, 2001

    A security flaw in Apple's online store exposed the account PINs of more than 72 million T-Mobile customers, reports BuzzFeed News.

    The vulnerability was discovered by security researchers Phobia and Nicholas "Convict" Ceraolo, who also found a similar flaw in the website for phone insurance company Asurion that exposed AT&T account PINs.

    Both Apple and Asurion fixed the website flaws that left the PINs vulnerable after learning about them from BuzzFeed News. Apple opted not to provide further comment on the situation, but told BuzzFeed News that it is "very grateful to the researchers who found the flaw."

    The page on Apple's site that let hackers brute force PINs, via BuzzFeed News​

    PINs, or passcodes, are numbers that are used as an additional account security measure by many carriers in the United States. Mobile device PINs are typically a last line of defense for a cellular account as both carrier websites and support staff will ask for the PIN for confirmation before making account changes.

    SIM hacking, which uses social engineering to get carrier support staff to transfer a person's phone number to a new SIM, has become increasingly prevalent due to the number of accounts (bank, email, social media, etc.) that are tied to a person's phone number. A PIN is used as a defense mechanism against SIM hacking, which means exposed PINs can be particularly dangerous.

    Accessing the T-Mobile PINs on Apple's website involved a brute force attack where a hacker used software to input multiple different numeric combinations to guess the proper one.

    As BuzzFeed News explains, after initiating a T-Mobile iPhone purchase on the Apple online store and selecting monthly payment options through T-Mobile, Apple's site directs users to an authentication form asking for a T-Mobile number and account PIN or last four digits of a social security number (which most carriers use in place of a PIN when one has not been set).

    The page allowed for infinite entry attempts into the PIN field, enabling the brute force attack that let hackers guess PINs associated with a T-Mobile phone number.

    The security vulnerability appears to have been limited to T-Mobile accounts, as the same validation page for other carriers on Apple's site uses a rate limit that locks access to the form for 60 minutes after five to 10 incorrect entries. Given that the other carrier pages had rate limiting enabled, it's likely Apple made an error on the T-Mobile page.
    A similar vulnerability on Asurion's website exposed an unspecified number of AT&T account PINs. An AT&T spokesperson said that it is working with Asurion to investigate the issue and will "take any additional action that may be appropriate."

    A phone number was required for both of these attacks, limiting the number of people who may have been impacted, but AT&T and T-Mobile customers who are concerned about their account safety should choose a new PIN.

    Article Link: Apple Online Store Security Flaw Exposed PINs of T-Mobile Customers
  2. mistasopz macrumors 6502

    Apr 14, 2006
    But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.
  3. oliversl macrumors 65816

    Jun 29, 2007
  4. zakarhino macrumors demi-god


    Sep 13, 2014
    Security issue after security issue for T-Mobile and many carriers in general. Remember when T-Mo Germany said they don't need to salt their passwords because their security is "that good"? Or when it was discovered that it's very easy to get access to a T-Mo account AND clone people's sims because T-Mo doesn't have very good security practices beyond asking for the last 4 of your SSN? I've heard stories of people phoning up carriers under the guise of being a store employee and they get access to all sorts of information without thorough identity verification!

    I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.
  5. iapplelove, Aug 24, 2018
    Last edited: Aug 24, 2018

    iapplelove macrumors 601


    Nov 22, 2011
    East Coast USA
    Pin for what?

    I just have a username and password for AT&T.

    Edit/ AT&T calls it a passcode.
  6. Doctor Q, Aug 24, 2018
    Last edited: Aug 24, 2018

    Doctor Q Administrator

    Doctor Q

    Staff Member

    Sep 19, 2002
    Los Angeles
    Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.

    It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.

    If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.
  7. nvmls macrumors 6502a


    Mar 31, 2011
  8. Naraxus macrumors 6502a


    Oct 13, 2016
    Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.
  9. RoobyRoobyRoo macrumors member

    Oct 3, 2016
    Having the best security =/= flawless security. No tech company is completely flawless. But go ahead and chastise Apple for not being absolutely perfect, because that's so productive.
  10. BasicGreatGuy Contributor


    Sep 21, 2012
    In the middle of several books.
    Even though the fix is in place, I went ahead and changed my PIN again.

    Things like this are frustrating. At the same time, most of us informed nerds and geeks realize that any time one creates an account online, there are security risks. As noted earlier, nothing in the tech world is 100% safe forever.
  11. ghostface147 macrumors 68030


    May 28, 2008
    Except they had the right security for the other carriers, but forgot to apply it to T-Mobile.
  12. Darmok N Jalad macrumors 68000

    Darmok N Jalad

    Sep 26, 2017
    Since it only affects T-Mobile, couldn’t that mean it’s a them problem and not Apple? Seems like both companies would need to collaborate in this situation—Apple’s site would have to reference a T-Mobile server, right? And T-Mobile just got hacked a few days ago.
  13. dilbert99 macrumors 68020

    Jul 23, 2012
    I though Apple didn't share your private information with anyone :D

    Remember the kind of scandal when Yahoo! or any high street shop lost 78million records...

    How will the fanboys spin this one?
    --- Post Merged, Aug 24, 2018 ---
    It did happen, its just the bigger you get, the more scrutiny you get. Not detecting it didn't mean the bugs/flaws were not there, just that not as many people were looking.
  14. Starfyre macrumors 68030


    Nov 7, 2010
    It's like it would have been better to just not set any passcode at all.
  15. DailySlow macrumors regular


    Aug 5, 2015
    Northern Virginia
    Thanks I like numbers
  16. citysnaps, Aug 24, 2018
    Last edited: Aug 24, 2018

    citysnaps macrumors 601

    Oct 10, 2011
    San Francisco
    Nice... You clearly believe that *perfection* and unbeatable security is the norm across the full breadth of a company's products and services. Similar to what other large companies such as Microsoft, Adobe, Samsung, Motorola, Google, Facebook, and thousands of other large companies afford their customers. Right? Because you freely trash other companies for similar incidents, right?

    Perhaps you can list just one or two companies that have such a wide breath of software the public interacts with in some manner, likely amounting to billions of lines of code collectively, that you believe have verifiable track records of 100% security perfection?
  17. bruinsrme, Aug 24, 2018
    Last edited: Aug 26, 2018

    bruinsrme macrumors 603


    Oct 26, 2008
    ATT customers are far from safe.
    Strongly recommend you verify the following;
    authorized users
    Notification of account changes enabled.

    This stuff is big business. Those invovled are not amateurs and the network to get their hands on phones is huge.

    If I am not mistaken, the interface Apple uses is an extension of the carrier approved interface. I believe when you select tHe carrier the the proceeding information is driven by the carrier.
  18. bgro macrumors 65816

    Jul 6, 2010
    South Florida
  19. Elwe macrumors regular

    Dec 30, 2006
    True. However, as someone who has had to put some policies in place around passwords and PINs, I would say two things: first, you describe is no real barrier for a very targeted attack. It is not practical for hundreds of thousands or millions of users. Every carrier that I know of already has a "VIP" policy for certain individuals, if you know what and how to ask for it, to address this. It usually involves having to go into a store and prove a couple of things before your are allowed to make certain changes. Definitely not scaleable.

    Second, and perhaps more important . . . recently when I forced a key platform I oversee to change to longer and more complex secrets, I got so much push back you would not believe. Some from people who should know better. Three from the most senior people in the organization. I am not saying I did not push it through anyway, but there is a very real issue of security vs ease-of-use that anyone dealing with such will eventually have to deal with. Since only one person in the organization could overrule me, I had more power than most in this situation. And that person really does not see the need beyond theory, though happens to trust me that I know my area, and my people do not make such changes just "because".

    Funny, though sad . . . we knew we would see something like this pushback, but on the PIN side, we made it six digits like Apple's minimum on the phone. We told people if they could get use to it on their phones, they should stop complaining. We really wanted eight digits or to have six with enforced alphanumberic combination. . . At the end of the day, though, one of the senior admins . . . who knows our people well, it seems . . . just told everyone she worked with to use their cell phone numbers. She publicly admitted to telling people to do this. She did not see it as an issue, and when one of my people spoke with her, she said that it was either do this or just have to accept that people are going to write it down. Six digits minimum (without allowing certain repeat patterns) was just too much to ask of people. I then decided to speak to her myself and I told her I would enforce rotation, and she just said "good luck with that". She is intelligent, so she knew there was some risk--she just did not think the risk was high enough to inconvenience people. And since there is no financial penalty that will directly accrue to most people, so most just cannot be bothered to care in the least.
    --- Post Merged, Aug 24, 2018 ---
    To end the above "old man rant" about security . . . I am becoming quite the fan of good facial recognition being on a lot more devices. I'll accept that, or that plus a short PIN for the vast majority of things.
  20. mi7chy macrumors 603


    Oct 24, 2014
    Apple don't care about security because even after several security incidents customers are brain washed into thinking Apple is flawless.
  21. alien3dx macrumors 6502a


    Feb 12, 2017
    as software developer sometimes jumping job , you will know how horrible company handle security and cheapskate to paid salary.

    if you pay peanuts, you get monkeys:p
  22. Marekul macrumors 6502

    Jan 2, 2018
  23. FelixDerKater macrumors 68030


    Apr 12, 2002
    Nirgendwo in Amerika
  24. DeepIn2U macrumors 603


    May 30, 2002
    Toronto, Ontario, Canada
    But but ...

    Lol. In my opinion the person, specific team, and definitely te head of OSX should’ve been CANNED for such a blatant pathetic oversight and mistake! The head of OSX’s sole responsibility other than leading the team is to check for significant holes in the OS and then sign off.

    Should’ve shaved Federighi’s head bald just before WWDC!

    Harsh but would’ve been funny to have 2 baldies in the executive staff lol.
  25. 69Mustang macrumors 604


    Jan 7, 2014
    In between a rock and a hard place
    Are you really serious? You typed a hundred and sixty+ words and dedicate 10 of those words to the culpable party. Not only that, you try to cast doubt on that culpability with "purportedly". Apple acknowledged the issue, fixed it quickly, and said thanks for bringing it to their attention. That's fairly cut and dried. What you did there... yeah, not a good look. TMo has it's own issues that deserve scrutiny and criticism. They're not to blame on this issue and Apple doesn't need you to deflect the blame for their mistake onto TMo. Apple owned it and fixed it PDQ... without the whataboutism.

Share This Page

109 August 24, 2018