Developer Demonstrates iOS Phishing Attack That Uses Apple-Style Password Request

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Oct 10, 2017.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    Developer Felix Krause today shared a proof of concept phishing attack that's gaining some traction as it clearly demonstrates how app developers can use Apple-style popups to gain access to an iPhone user's Apple ID and password.

    As Krause explains, iPhone and iPad users are accustomed to official Apple requests for their Apple ID and password for making purchases and accessing iCloud, even when not in the App Store or iTunes app.

    [​IMG]

    Using a UIAlertController that emulates the design of the system request for a password, developers can create an identical interface as a phishing tool that can fool many iOS users.
    Though some of the system alerts would require a developer to have a user's Apple ID email address, there are also popup alerts that do not require an email and can recover a password.

    [​IMG]

    The phishing method that Krause describes is not new, and Apple vets apps that are accepted to the App Store, but it's worth highlighting for iOS users who may not be aware that such a phishing attempt is possible.

    As Krause says, users can protect themselves by being wary of these popup dialogues. If one pops up, press the Home button to close the app. If the popup goes away, it's tied to the app and is a phishing attack. If it remains, it's a system request from Apple.

    Krause also recommends users dismiss popups and enter their credentials directly within the Settings app.

    Krause has reported the issue to Apple and recommends a fix that would include Apple asking customers to enter their credentials into the Settings app rather than directly through a popup that can be easily mimicked. Alternatively, he suggests credential requests could include an app icon to indicate that an app is asking rather than the system.

    As extra protection from attacks like this, Apple customers should enable two-factor authentication as it prevents attackers from being able to log into an Apple ID account without a code from a verified device.

    Article Link: Developer Demonstrates iOS Phishing Attack That Uses Apple-Style Password Request
     
  2. alex00100 macrumors regular

    Joined:
    Mar 17, 2011
    Location:
    Moscow, Russia
    #2
    This is very smart actually... I'm surprised this isn't massively used by shady apps already.
     
  3. appleguy123 macrumors 603

    appleguy123

    Joined:
    Apr 1, 2009
    Location:
    15 minutes in the future
    #3
    I’ve actually had a pop up ad on a shady site do this to me before. It didn’t take me out of Safari though so it wasn’t hard to detect. This was about 9 months ago though, it’s been around awhile.
     
  4. nutmac macrumors 68040

    Joined:
    Mar 30, 2004
    #4
    Similarly, macOS's Authorization Service dialog box is also easily spoofed.
    [​IMG]
    Similar to Windows' Control-Alt-Delete, Apple's iOS and macOS should make it impossible to spoof these dialog boxes.
     
  5. thisisnotmyname macrumors 65816

    thisisnotmyname

    Joined:
    Oct 22, 2014
    Location:
    known but velocity indeterminate
    #5
    Fair point about our social conditioning on these dialogs. I don't know of a good way to address this though.
     
  6. BMcCoy macrumors 65816

    BMcCoy

    Joined:
    Jun 24, 2010
    #6
    Yup, I’d fall for this.
    And I’m paranoid.

    Cunning.
    And a bit frightening.
     
  7. ignatius345 macrumors 6502a

    Joined:
    Aug 20, 2015
    #8
    I think this one is on Apple. A user gets legitimately asked for his/her password enough times and fatigue sets in, and they stop really thinking about it.

    Ultimately it's a UX problem that needs to be solved so that entering one's iCloud password is 1) hard to fake and 2) doesn't happen any more often than necessary.
     
  8. jclo Editor

    jclo

    Staff Member

    Joined:
    Dec 7, 2012
    Location:
    California
    #9
    I've never heard of this actually being used within an app before, so Apple must be pretty vigilant about finding and preventing apps that try to do it.
     
  9. MonkeyDavid macrumors newbie

    Joined:
    Aug 5, 2011
    #10
    Apple needs to fix the bug(s) that ask for the password at random times (I also have one where occasionally the request pops up then disappears before I can type anything).
     
  10. fairuz, Oct 10, 2017
    Last edited: Oct 10, 2017

    fairuz macrumors 6502

    fairuz

    Joined:
    Aug 27, 2017
    Location:
    /usr/bin/
    #11
    Not so clever. Old trick from the 90s. The old solution that still works: Give security-related system popups some obvious indication of legitimacy that can't be spoofed, like something in the bezel.

    Hard part is sandboxing apps so they can't spoof it. TouchID in iOS is one good solution.
     
  11. Basic75 macrumors regular

    Joined:
    May 17, 2011
    #12
    I had been wondering when this would be brought up, there’s really nothing that sets apart legitimate system requests on either iOS or macOS. Let’s hope that Apple finally does something about it.
     
  12. b11051973 macrumors regular

    Joined:
    Apr 8, 2006
    #13
    Always enter an incorrect password first. If it doesn't complain you entered the wrong password, you know it is a phishing thingie.
     
  13. mikecorp macrumors 6502

    mikecorp

    Joined:
    Mar 20, 2008
    #14
    hey it happened to me too, but only since I upgraded to ios 11, but the pop up had wrong address which I do not use to sign in. I dismissed it as I thought it was strange especially, I did not do anything that would require password.
     
  14. Solomani macrumors 68030

    Solomani

    Joined:
    Sep 25, 2012
    Location:
    Alberto, Canado
    #15
    But with hundreds of apps being approved on a monthly basis…. it only takes 1 or 2 rogue app devs to sneak through to exploit the massive userbase to their advantage. I think that the concept of Apple "screening" the apps/devs is not foolproof enough. Apple also needs to add some kind of built-in iOS security barrier to prevent *any* dev from doing anything that can do this (should they attempt it). Just IMHO
     
  15. iosuser macrumors 6502a

    Joined:
    Mar 12, 2012
    #16
    I knew it’s just a matter of time, what’s surprising is it took this long. Sometimes when I get prompted, I purposely enter some gibberish as my password to make sure that it was recognized as wrong password. Not just on my i-devices but on the computer browser as well. Yeah I wear a tinfoil hat around the house :p
     
  16. thisisnotmyname macrumors 65816

    thisisnotmyname

    Joined:
    Oct 22, 2014
    Location:
    known but velocity indeterminate
    #17
    Your "hard to fake" comment got me thinking, there are areas of the screen (banner) that web and app developers don't have full control over. They could do something like the padlock icon on browsers up there.
     
  17. jdillings macrumors 65816

    Joined:
    Jun 21, 2015
    #18
    Another day, another security issue for Apple
     
  18. fairuz macrumors 6502

    fairuz

    Joined:
    Aug 27, 2017
    Location:
    /usr/bin/
    #19
    Haha, what if the phishing thing always rejects the first password and only works when you enter the same password twice? Like in Rick and Morty...
     
  19. macTW macrumors 65816

    Joined:
    Oct 17, 2016
    #20
    A non-worry event with Apple vetting each app. But interesting it can happen nonetheless.
     
  20. fairuz macrumors 6502

    fairuz

    Joined:
    Aug 27, 2017
    Location:
    /usr/bin/
    #21
    It's easy to fix in iOS since apps are sandboxed, so they could lock some part of the screen, but I know apps can access the entire screen currently. Dunno how it could be fixed in macOS for unsandboxed apps.
     
  21. inscrewtable macrumors 68000

    inscrewtable

    Joined:
    Oct 9, 2010
    Location:
    Australia
    #22
    Wouldn't work for me because I don't know my Apple ID password. When one of these pops up I have to leave the app and open up one password.
     
  22. fairuz macrumors 6502

    fairuz

    Joined:
    Aug 27, 2017
    Location:
    /usr/bin/
    #23
    The Windows security dialogs don't require control-alt-delete, which I think I understand is a sacred system-only input. They seem to have the same problem. They just have complicated full-screen animations and stuff that I'm guessing are to make it harder to spoof just from a practical standpoint.

    Problem is so many things ask for permission for stupid things like "outgoing network connections" that people are used to blindly approving.
     
  23. 960design macrumors 68020

    Joined:
    Apr 17, 2012
    Location:
    Destin, FL
    #24
    I'm not the only developer to have thought of this back in 2008. Pretty sure, Apple will shut you down forever, if you try something like this. The good news is that you could do it on Android and no one would ever shut you down.
    I do agree that with Apple's many legitimate popups, conditioning does come into effect. Apple should probably make a red border or red characters or something unique for legitimate password requests.
     
  24. deanthedev macrumors 6502

    deanthedev

    Joined:
    Sep 29, 2017
    Location:
    Vancouver
    #25
    “The phishing method that Krause describes is not new, and Apple vets apps that are accepted to the App Store”

    So just another non-story about some supposed security flaw in iOS.
     

Share This Page