Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

21–30 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#21

Post by vortico »

zeitg3ist wrote: post #20
dx034 wrote: post #13

Earlier quoted context omitted.

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

There's a toggle (in Settings > App Store, iirc) to ask for auth only on non-free (as in beer) apps/IAPs. Edit: apparently there's no toggle if you have Touch ID enabled. You have to disable it for the App Store for this to work, but I think Touch ID is fast enough anyway...

True, but those savvy enough to find that will probably notice when an application requests a password artificially.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#22

Post by mcphage »

dx034 wrote: post #13
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

You need to enter your password when downloading a free app so that if someone finds your phone they can’t install a malicious hacking or key logging app on to your phone. Installing apps is a security risk, not just a financial issue.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#23

Post by EGreg »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/

Dear Steve,

There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password.

I wanted to write and suggest an easy fix, that would make the next version of MacOS and iOS much more secure. Why not have the users set a personal phrase, that MacOS will store and show them in every native MacOS dialog, to prove that it's really coming from MacOS? Of course, you'd have to prevent apps from screen-capturing that portion of the screen for the entire time the dialog is up, and capturing the keystrokes that are being sent to the dialog, but that shouldn't be too much of a problem. You can do something similar for the iPhone.

I really hope this finds its way into MacOS. After MacOS X came out I switched from the PC and haven't looked back. It's awesome.

Sincerely, Greg ...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#24

Post by spydum »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI's is pretty common though, tons of ads/malware made themselves to look like windows alerts.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#26

Post by krausefx »

silentOpen wrote: post #8

To the author: the double quote characters in your phishing dialog are straight ASCII " but the quotes in the official dialog are Unicode open/close double quote characters.

Yeah, thanks for the note, I noticed that but was too lazy to re-do the screenshots.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#27

Post by tyingq »

vortico wrote: post #18
icebraining wrote: post #9

Earlier quoted context omitted.

Right, but in Windows can't any application reproduce that behavior?

Yup. And I'm sure there's some implementation of this in the form of a sketchy library.

Powershell script to do something similar: https://raw.githubusercontent.com/enigma0x3/Invoke-LoginProm...

Blog post with screenshots: http://enigma0x3.net/2015/01/21/phishing-for-credentials-if-...

There's probably some browser based equivalent somewhere too.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#28

Post by iamben »

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box.

"If the words below do not match your unique phrase, do not enter your password."

If I see "Green eggs and ham", I know it's safe to put in my password.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#29

Post by michrassena »

vbezhenar wrote: post #11
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key.

https://en.wikipedia.org/wiki/Secure_attention_key

And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-mode program.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#30

Post by eli »

iamben wrote: post #28

Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box. "If the words below do not match your unique phrase, do not enter your password." If I see "Green eggs and ham", I know it's safe to put in my password.

It's a good idea, but a security solution that relies on users noticing when something is absent is not exactly airtight.
Post reply on HN