Slashdot Mirror
Security Researcher Finds a Fundamental Flaw in iOS (krausefx.com)
Felix Krause writes: Do you want a user's Apple ID password to get access to their Apple account or to try the same email/password combination on different web services? Just ask your users politely, they'll probably just hand over their credentials, as they're trained to do so. This is just a proof of concept, phishing attacks are illegal! Don't use this in any of your apps. The goal of this blog post is to close the loophole that has been there for many years, and hasn't been addressed yet. For moral reasons, I decided not to include the actual source code of the popup, however it was shockingly easy to replicate the system dialog.
Phishing attacks that are well crafted don't count as flaws.
If it involves social engineering, you can't call it fundamental. For context, Android has been plagued by this "fundamental" flaw for a decade.
But this isn't a flaw in IOS. It's like saying Android is insecure because of fake emails I get asking me to reset my gmail password
This article is the stupid.
...that if someone tricks me into giving out my passcode, they can get into my IPhone? True fact. Tim Cook needs to fix this flaw NOW!
This is where having a visual indicator that only the OS and user know about could help? It could be an image or a phrase, but the idea is that an application couldnâ(TM)t forge the OS dialogue, because it doesnâ(TM)t have access to that info.
At the same time, there are probably still limitations arising from an app asking for permissions it shouldnâ(TM)t need. This easier to vet for anything going through the App Store and possibly signed applications, but for anything else it is still user beware.
Jumpstart the tartan drive.
If you tell someone that you're from the IT department, most users will gladly tell you their password even though corporate policy says not to tell anyone your password. Some people have their password on a Post-It note underneath their keyboard or on the side of their monitor.
For this lady. ExPostFacto!
Lots of people use their Google account, or their Facebook account, to log into various sites and services. I'm not sure how Facebook works, because I rarely use it. Google makes you type in your password once per month, so Google users are also trained to enter their password more-or-less at random, when asked. It would be dead easy to fake the password dialog.
Users trading of security for convenience, yet again. The stupid thing is that companies encourage this behavior. If some service really wants you to login again, it should ask you to go log in, not present you with some dialog to type in your password.
Enjoy life! This is not a dress rehearsal.
This is old as stones. We used this ages ago to make fun of unsuspecting uni dinosaurs. Just run a program printing "login:" and you're done.
So ,what's new?
Will they install control, alt and delete keys on iPhones?
Am I the only one that shakes my head every time I see this term used to describe a hacker/cracker/black hat that doesn't actually do research except to unlawfully break into other peoples stuff just to brag about it?
And to stay slightly on topic, this is just social engineering, not an OS flaw. Clickbait garbage.
I can simulate a real terror threat and people will believe it! -get a new brain?!
How the fuck is this a flaw in iOS? What a load of rubbish.
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Why title it "Security Researcher" when you clearly submitted a post about yourself? Why not instead title it "I find what I personally think is a fundamental flaw in iOS"?
Microsoft wrote that over 30 years ago so that an application is not able to impersonate or trap that signal - it goes right to the OS.
I'm asked for my Apple password at least once a week, and it happens absolutely randomly. I might be doing anything, and suddenly "hey re-authenticate please!". I've absolutely been trained to not question it and just punch the password in so my phone continues to work. This is even worse than the whole "constant UAC prompt trains users to just say yes", because it has absolutely zero context. I don't know what triggered it, I don't know how not putting the password in limits me exactly, I have no way of knowing it's really the system asking for the credential, and I'm not just pressing yes, I'm inputting my golden key. Just bad design all around.
Honestly I think this does count as a fundamental flaw--but a flaw in the design of the user interface flow used to obtain credentials for iTunes (or for other applications).
It's a flaw for two reasons. First, any process which interrupts your current actions with a modal dialog is a flaw in that if you are not paying attention, you may accidentally tap the accept or cancel button without realizing what you are doing. (This is worse on a desktop environment, where a pop-up may appear while you are typing. If you are a fast touch-typest like I am, you may accidentally press 'enter' or 'space' before realizing what you're typing has gone into the dialog box that just randomly appeared.)
Second, the design is a flaw because it does not give a mechanism by which the context of the dialog box cannot be brought forward and examined for validity. That is, with the iTunes login prompt, all you are permitted to do is to enter the password or not--but you have no way to know that it indeed is coming from iTunes.
I personally would consider fixing this user interface flaw by doing three things.
First, provide a notification mechanism which is clearly visible to the user (such as a flashing bar at the top of the screen), but which does not directly interrupt the user's interaction with the device. If, for some reason a password is necessary before the user can continue his interaction with the device, I would propose a dialog box come up with stops the user interaction with an accept/cancel button but which does not ask for information.
Second, in response to the notification mechanism, I would switch to the application that is asking for the information. (This is easier now that iOS supports multiple concurrent applications and a method for going 'back' in the upper-left corner of the screen.) This gives the user the opportunity to examine the application which is asking for the information. (If this is in response for an iTunes password prompt, I would switch to the Settings app and to the iTunes password screen within settings.)
Third, I would explicitly prohibit (either by changing the OS or through the review process) modal dialogs not belonging to an application from appearing over another application. This includes built-in OS modal dialogs.
All of this is designed to force the user to examine the context in which their sensitive information is being requested, rather than blindly handing it over. Because this sort of interaction is relatively rare, forcing the user to switch to the settings page (rather than just grabbing the password on the go) is not an unreasonable price to pay here.
...the article title was a kind of phishing itself. When will you learn there is a difference between bait and chum? In the least iOS should be removed from the title - the issues described can happen to most any device OS.
Wow, congratulations on discovering social engineering! Seriously slashdot, we've had posts where people supposedly discover things that have been around for years. The other day it was vending machines, now it's social engineering.
We'll make great pets
It's a *design* flaw though, not the usual half-assed implementation flaw. Yes, there's a social engineering component, but the design of the OS makes the job of the social engineer all too easy.
This attack is like a hybrid Trojan/phishing/MITM attack: your evil app puts up a bogus dialog box that looks like an iOS dialog box asking for Apple credentials. It then harvests this information and transmits it to the bad actor. And it isn't just Apple that's vulnerable to this; Windows does this so often that users are effectively trained to hand over their credentials without thinking.
I've been concerned about this mode of attack for years; which is why when I do run Windows I always do so from an unprivileged account. This also, by the way, keeps the administrator credentials for my machine firmly on my hardware; Microsoft really wants you to log in using your Microsoft credentials and does its best to encourage (sometimes trick) you into doing this when you install, for example, Skype. This is a perfect storm scenario for this kind of attack: users are trained that handing over the credentials to both their network and administrator accounts is a normal part of operating their computers.
I've often thought there should be a hardware solution to this. The obvious solution is some kind of hardware token; but it could be as simple as an LED on the device that can only be lit by the genuine OS routine for asking the user for his credentials; this routine would insulate those credentials from any unprivileged process.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Anyone with a minimum of dev background ( hopefully that means a lot of people here ) knows that kind of "trick".
Slashdot, fix the reply notifications... You won't get away with it...
This is not theoretical, these exploits are live and active. A week ago my not-so tech savvy father-in-law was visiting me in the USA and asked me to help "clean up" his iPhone 6. He kept getting these "please enter you apple ID" credential popups for no known reason. Also, he was getting odd printer setup popups and knew of no printer software on his phone. He lives in Switzerland travels the world and had installed several apps to communicate with friends in China and various European countries. A couple of the China pointing apps I researched looked to be created by "China, Inc" which I immediately told him to purge from the phone and from use - forever. There were a couple of communication apps installed on his phone which he was unaware of how they got there and I could not find reference to them anywhere in the Apple Store - so much for the myth that only Apple-certified/Apple-Store approved apps can be installed on your iPhone. After deleting about 10 suspect apps off his phone and power cycling twice the popups ceased.
Designed and marketed to stupid people. The flaw is between your ears!
I use my fingerprint from the fingerprint reader which is at level 0.
Witness BitZtream getting pwned!... twice.....three times!
How's life in the hypocrite lane?