Apple Responds to Report About Thieves Spying on iPhone Passcodes to 'Steal Your Entire Digital Life'

[CharlesShaw]

Maybe a good possible solution would be to have a 24 hr waiting period to be able to reset an Apple ID password on a iPhone with only a device passcode. That would give the victim a chance to sign-in to Apple and remove the iPhone from the Apple ID account and wipe it.

I‘m guessing a common scenario is someone wants to add a new device to their iCloud account, but have forgotten the password. 24 hours seems like a reasonable amount of time to make them wait until they can change the password using their passcode on a trusted device they are already logged into with 2FA.

Edit: another scenario I can think of is wanting to log out of a device and turn off Find My, but having forgotten their password. 24 hours seems reasonable for that too. So, when would it be a major inconvenience to have to wait 24 hours, if you already have access to your account on your logged in device, but where such a policy could cause harm?

 

[Mummugreat]

It's not a flaw, it's just tech illiterate iPhone users getting Shoulder Surfed because they were using a short passcode in public to unlock their phones. So just don't use your passcode in a public easily visible space.

Not really one guy records the passcode this also can be be done with collab with the security camera guy at a bar .

Real issue here is Apple letting users change account password without asking for old password. It just ask for phone passcode . In 3 minutes they change the Apple ID password and since your phone is trusted device lock you out of everything else. Setup two step authentication switch off find my phone. Since your email and everything there they can access or change any other passwords or view stored passwords.

Just more fear mongering and click baiting by tech journalists pretending that some problem is somehow unique to Apple. Explain to me what Android does to stop someone from shoulder surfing your PIN on those devices, stealing your phone out of your hands, and finding a picture of your SSN and using it to open credit cards in your name. Oh, nothing more than what Apple does? Ok, thanks.

hi you missing the point . Apple doesn’t ask old password to change the Apple ID password . It just asks passcode . In 3 minutes users can block you out of your own account and even your MacBook at home. It’s a flaw , android or google will ask your old password to reset the pass . Even Apple did until recently 16. Something. If your phone and passcode stolen you should be able to log into your account and block the phone . Not the other way around

 

[I7guy]

Not really one guy records the passcode this also can be be done with collab with the security camera guy at a bar .

Not if you have been made aware of this type of social engineering. You might be a lot more careful and cover the screen for at least one or two characters.

Real issue here is Apple letting users change account password without asking for old password.

If one forgets the old password how to proceed?

It just ask for phone passcode . In 3 minutes they change the Apple ID password and since your phone is trusted device lock you out of everything else.

My thought is to not allow changes to the recovery key or account for 24 hours after the password is changed. Also don't allow the screen time password to be reset without going to Apple.

Setup two step authentication switch off find my phone. Since your email and everything there they can access or change any other passwords or view stored passwords.

While we're proposing solutions, this brings up a good point. It would be great to be able to protect apps in some fashion. After a password change access to these apps would somehow be restricted.

hi you missing the point . Apple doesn’t ask old password to change the Apple ID password . It just asks passcode

Yes because you might not remember the old password.

. In 3 minutes users can block you out of your own account and even your MacBook at home. It’s a flaw , android or google will ask your old password to reset the pass . Even Apple did until recently 16. Something. If your phone and passcode stolen you should be able to log into your account and block the phone . Not the other way around

Not if you have a recovery key and apple disallows changing the recovery key for a period of time after you use the iphone password to force a password change of your apple id.

 

[dk001]

There’s security vs usability. Maybe the device passcode should be that powerful. Apple is not hiding that fact. Maybe users should carefully choose how they use their phone what apps are on their phones and ensure they protect the device password.

Maybe however that is a bit unrealistic in today’s society where the push is to do more and have more. Just look at what Apple espouses with the iPhone, what Samsung does with Android.

Most users look at the hype and what they can do not really thinking about the underlying security. I don’t see this article changing things. Apple does need to do something even if it is just “Enter current password”.

 

[sk1ski1]

Since we’re discussing possible solutions a better alternative is to not be able to modify the recovery key or account for a period of time.

That solution is far worse then having a 24hr delay for a Apple ID change using just a device passcode. Most people only keep their recovery key in one location. What if you are traveling or on vacation. You won't have the time to fetch your recovery key in any reasonable amount of time. But 24 hours is plenty of time to sign-in to your Apple ID on another device and remove/wipe the stolen iPhone from your Apple ID before you are locked out.

 

[dk001]

I‘m guessing a common scenario is someone wants to add a new device to their iCloud account, but have forgotten the password. 24 hours seems like a reasonable amount of time to make them wait until they can change the password using their passcode on a trusted device they are already logged into with 2FA.

Edit: another scenario I can think of is wanting to log out of a device and turn off Find My, but having forgotten their password. 24 hours seems reasonable for that too. So, when would it be a major inconvenience to have to wait 24 hours, if you already have access to your account on your logged in device, but where such a policy could cause harm?

Have to really disagree.
Aside from buying a new device, I have had to “emergency” replace my device due to loss or damage. Having any kind of a waiting period would be detrimental IMO.

There needs to be a simple solution. Waiting periods, multiple security layers, will either irritate users or they won’t use them.

 

[sk1ski1]

Have to really disagree.
Aside from buying a new device, I have had to “emergency” replace my device due to loss or damage. Having any kind of a waiting period would be detrimental IMO.

There needs to be a simple solution. Waiting periods, multiple security layers, will either irritate users or they won’t use them.

If you lost your device and need an emergency replacement, then that would not be the scenario where someone is trying to reset the Apple ID password via just a device passcode.

 

[Mummugreat]

Have to really disagree.
Aside from buying a new device, I have had to “emergency” replace my device due to loss or damage. Having any kind of a waiting period would be detrimental IMO.

There needs to be a simple solution. Waiting periods, multiple security layers, will either irritate users or they won’t use them.

simple solution is asking for your old password to reset it , people keep saying what if you forget your password. I say if you forget uour password and password reset security questions then have a waiting period. While signing up Apple should put more emphasis on how important password reset questions are and chose the right answer that you will never forget . Using just passcodes to reset your Apple ID and entire security is a flaw . Even google and android asks for the old password to change it .

 

[msvadi]

An in-depth report published today by The Wall Street Journal's Joanna Stern and Nicole Nguyen highlights instances of thieves spying on a victim's iPhone passcode before stealing the device in order to gain access to the device, data, and money.

All of the victims interviewed said their iPhones were stolen while they were out socializing at bars and other public places at night. Some victims said the iPhones were grabbed out of their hands by strangers, while others said they were physically assaulted and intimidated. The report provides specific examples of these instances.

With knowledge of the iPhone's passcode, a thief can easily reset the victim's Apple ID password in the Settings app, even if Face ID or Touch ID is enabled. Subsequently, the thief can turn off Find My iPhone on the device, preventing the owner of the device from tracking its location or remotely erasing the device via iCloud. The thief can also remove other trusted Apple devices from the account to further lock out the victim.

The thief can also change an Apple ID's contact information and set up a recovery key in order to prevent a victim from recovering the account.

To make matters worse, knowing an iPhone's passcode allows a thief to use Apple Pay, send Apple Cash, and access banking apps using passwords stored in iCloud Keychain. Even if Face ID or Touch ID is enabled on the iPhone, thieves can simply bypass these authentication methods and an option to input the device's passcode is presented. In some cases, the report claims that thieves even opened an Apple Card by finding the victim's last four digits of their Social Security number in photos stored in apps like Photos or Google Drive.

Access to other passwords stored in iCloud Keychain allows the thief to further wreak havoc, as it could give them access to email accounts and other sensitive information. All in all, the report says thieves can essentially "steal your entire digital life."

Apple Responds

In response to the report, an Apple spokesperson said "security researchers agree that iPhone is the most secure consumer mobile device, and we work tirelessly every day to protect all our users from new and emerging threats."

"We sympathize with users who have had this experience and we take all attacks on our users very seriously, no matter how rare," the spokesperson added. "We will continue to advance the protections to help keep user accounts secure." Apple did not provide any specific details about any next steps it might take to increase security.

In a tweet, Stern recommended that Apple add extra protections to iOS and introduce additional Apple ID account recovery options.

How to Stay Protected

In a tweet, Stern recommended that users switch from a four-digit passcode to an alphanumeric passcode, which would be more difficult for thieves to spy on. This can be done in the Settings app under Face ID & Passcode → Change Passcode.

iPhone users can also use Face ID or Touch ID as much as possible when in public to prevent thieves from spying on their passcode. In situations where entering the passcode is necessary, users can hold their hands over their screen to hide passcode entry.

To protect a bank account, consider storing the password in a password manager that does not involve the device's passcode, such as 1Password.

Article Link: Apple Responds to Report About Thieves Spying on iPhone Passcodes to 'Steal Your Entire Digital Life'

Such a BS response. How hard is it to require the current password instead of the passcode? If someone gets to that stage, it’s almost guaranteed that they know the passcode

 

[msvadi]

It's not a flaw, it's just tech illiterate iPhone users getting Shoulder Surfed because they were using a short passcode in public to unlock their phones. So just don't use your passcode in a public easily visible space.

Yes, blame the victim. I'm afraid the majority of iPhone users are in that cathegory

 

[msvadi]

This article and the fact that apple needed to even respond just shows how brain dead our society is. If you let your password get “stolen” by someone watching you enter it, that is completely on the user. Doesn’t matter what device they have. how is that at all Apple or any device makers issue? NEWs ALERT. Secuity researchers determine that passwords are not secure if someone watches you enter it. Really? How long did that study take

and the irony is they recommend 1password that was recently hacked.

Apple could allow for identity verification and then let people back into their Cloud accounts. As far as I understand, most of the victims were able to get their money back - banks protect against fraud, but they are still locked out from their devices and iCloud data. Once thieves are in, Apple protects them and not the victims.

 

[Realityck]

I hope someone at Apple reads this entire thread for all the varied thoughts of a users digital profile being too easily compromised by clever 3rd parties. Sounds perfect for a focus group to improve iPhone security.

 

[msvadi]

That's my take. If you get robbed of your car keys and a ne'er do well steals your car, is Ford responsible?

If Ford could track your stolen car and easily get it back to you, you would expect Ford to help, wouldn’t you?

Also, it’s not just your “car”. Imagine if your car keys could easily lock and unlock your bank accounts and all your data? Wouldn’t you want some extra protection?

 

[I7guy]

If Ford could track your stolen car and easily get it back to you, you would expect Ford to help, wouldn’t you?

Assuming you have that optional feature on your car. But yeah, Apple should help -- that doesn't mean they can help on the spot though.

Also, it’s not just your “car”. Imagine if your car keys could easily lock and unlock your bank accounts and all your data? Wouldn’t you want some extra protection?

That extra protection will cause somebody some headaches and it's not for me to say whether it's worth it not. If my car keys have a 1 in a billion chance of being hijacked and that extra protection means I cant get help for weeks, then no...I don't want extra protection.

 

[I7guy]

That solution is far worse then having a 24hr delay for a Apple ID change using just a device passcode. Most people only keep their recovery key in one location. What if you are traveling or on vacation. You won't have the time to fetch your recovery key in any reasonable amount of time. But 24 hours is plenty of time to sign-in to your Apple ID on another device and remove/wipe the stolen iPhone from your Apple ID before you are locked out.

I disagree. I have my recovery key on me. Of course someone could point a gun to my head, but eliminating that scenario means I can get to my phone with any computer anywhere. Anyway I don't believe it's productive to debate the feasibility of hypothetical rescue scenarios until and if Apple announces some change.

 

[Mummugreat]

This article and the fact that apple needed to even respond just shows how brain dead our society is. If you let your password get “stolen” by someone watching you enter it, that is completely on the user. Doesn’t matter what device they have. how is that at all Apple or any device makers issue? NEWs ALERT. Secuity researchers determine that passwords are not secure if someone watches you enter it. Really? How long did that study take

and the irony is they recommend 1password that was recently hacked.

But the password isn’t the one that’s stolen , it’s the passcode. Issue is you don’t need your old password to change it. It’s like someone stole your house keys and changed it but also were able to change the house ownership. Even the two factor authentication method is flawed because the device itself can receive it. Imagine you have password recovery as your own phone number . But in this case immediately can change the phone recovery number as well. Any secondary recovery methods too just instantly. If recovery phone number cannot be instantly changed you could atleast get your SIM card and regain access to your account a day or two later.

People keep saying that’s because what if you forgot your Apple ID password. Well in that case it’s your responsibility to remember that. Atleast it’s your own fault you forgot the password and recovery questions. Sometimes it’s not even shoulder surfing , guy handling the security cameras at any place can zoom in and see your passcode.

 

[I7guy]

Maybe however that is a bit unrealistic in today’s society where the push is to do more and have more. Just look at what Apple espouses with the iPhone, what Samsung does with Android.

What a smartphone has the capability to do in 2023 is independent of ones' individual use case.

Most users look at the hype and what they can do not really thinking about the underlying security. I don’t see this article changing things. Apple does need to do something even if it is just “Enter current password”.

Enter current password will lock out those who forget their password. Apple wants product the majority of folks can successfully and easily use.

 

[I7guy]

But the password isn’t the one that’s stolen , it’s the passcode. Issue is you don’t need your old password to change it. It’s like someone stole your house keys and changed it but also were able to change the house ownership. Even the two factor authentication method is flawed because the device itself can receive it. Imagine you have password recovery as your own phone number . But in this case immediately can change the phone recovery number as well. Any secondary recovery methods too just instantly. If recovery phone number cannot be instantly changed you could atleast get your SIM card and regain access to your account a day or two later.

People keep saying that’s because what if you forgot your Apple ID password. Well in that case it’s your responsibility to remember that. Atleast it’s your own fault you forgot the password and recovery questions. Sometimes it’s not even shoulder surfing , guy handling the security cameras at any place can zoom in and see your passcode.

Stuff happens. The reason when ios safari is used to go to appleid.apple.com and your apple id is displayed is because people forget theirs. Not everybody is a tech savvy, business savvy, law savvy, type of MacRumors reader and folks to forget their apple id and password.

 

[windowsblowsass]

It seems that the short 4-digit passcodes are not very secure so maybe best to use alphanumeric and/or long passcodes (12 or more digits) ?

iPhones default to 6 digits now but people can change it to 4 or make it longer, lots of people change to keep it 4

 

[Realityck]

There is always more to the story

Apple kept asking 'have you tried Find My iPhone?' after a woman got locked out of her Apple account and had thousands taken from her bank account when a thief grabbed her iPhone

Reyhan Ayas was standing outside a bar in New York when a man snatched her iPhone and ran off. She said that was only the start of her Apple ordeal.

www.yahoo.com

During her most recent conversation with an Apple representative, the representative told Ayas that there was no way to regain access to her iCloud account.

"Apple takes a lot of pride in being, like, a closed-security environment. But they rarely talk about if someone gets into that closed-security environment; it is also closed to the people who own the account," Ayas said. "It can absolutely turn against you."

Alex Argiro, who was an NYPD detective before retiring in 2022, told The Journal that there had been hundreds of similar crimes committed in New York in the past two years: "Once you get into the phone, it's like a treasure box."

 

[kagharaht]

I'm starting to re-think what my iPhone should have and have not. If only Apple will enable constant Face ID verification while in use. Soon as you sign in even with just the passcode, when the home screen opens, Face ID should still auto check that you are the user. Right now, it seems like this is a huge hole in security.

 

[I7guy]

There is always more to the story

Apple kept asking 'have you tried Find My iPhone?' after a woman got locked out of her Apple account and had thousands taken from her bank account when a thief grabbed her iPhone

Reyhan Ayas was standing outside a bar in New York when a man snatched her iPhone and ran off. She said that was only the start of her Apple ordeal.

www.yahoo.com

Your device passcode is the equivalent of your ssn, birthday name and address.

 

[buddyhilton]

Apple needs to change the Password Reset security hole on the iPhone. It would be better if you needed your Device Passcode AND your current iCloud Password in order to change the password.

That would cut off a lot of exposure. Yes, ApplePay would still be an exposure, but at least you could save your iCloud account and find a way to remote wipe the device.

I agree. I didn’t even realize that was an option until I just tried it. Enter passcode and you’re good to go to reset your Apple ID password. It can be done within a few seconds.

A thief would:
1) use passcode to reset apple ID
2) remove other apple devices from Apple account
3) turn off find my iPhone using new Apple ID password
4) use known passcode to access all saved passwords
5) take over other accounts such as Gmail using known saved passwords
6) thief has phone, so once Gmail password is changed, you can’t use the phone as 2FA to get back into that account
7) reset Apple recovery code and encrypt Apple data to further lock person out of account
8) go through photos to find other information such as social security numbers, passport copies etc

Crazy!!! All with a 6 digit passcode!

 

[NetMage]

Crazy!!! All with a 6 digit passcode!

Perhaps Apple doesn’t make it clear enough how important your passcode is (arguably more important than your Apple password) but it is on you if you use a 6 digit passcode.

 

[JakeRocket]

...what, exactly, was the point of the 'report'?

"If someone steals your house keys, they could get in your house and take your stuff!" - Joanna Stern later today, probably.

I think her point is if someone steals your house key, that same key shouldn’t allow them to gain access to your safe, your bank accounts, be able to lock you out of your own house forever, and sell your house too.