Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

81–90 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#81

Post by hnlmorg »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I think the best way to resolve this is a hardware button that the user has to press.

So the dialog pops up and says "please press button then enter your password". User needs to press the button for the textbox to appear. This hardware button auto-closes whatever the active application if the active application is not the system dialog.

This way you have a hardware control verifying the dialog isn't a phishing attack.

Of course, attackers could mimic the dialog after the button had been pressed if it were a genuine dialog. But as long as you can train your users into only entering their password after they've pressed the button then hopefully most might realise something was amiss if requested for a password without the button press.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#82

Post by TheCoreh »

astura wrote: post #77
dx034 wrote: post #13

Earlier quoted context omitted.

A solution is to only ask for the password when absolutely necessary. I still don't understand why I need to enter a password (or use touchID) to download a free app. Shouldn't it be enough to login when I want to buy something for the first time in-app? AFAIK that's how android handles it.

What if the phone/iPad belongs to your kid and you don't want her to be installing apps without vetting them beforehand? That's a legitimate reason to ask for prompts. Should be a setting though (if it's not already)

Then you can enable parental controls

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#83

Post by jsjohnst »

Apple does have one mitigation I’m surprised not to see listed. The keyboard changes color when it’s a system dialog asking for your password. That’s not something an App can do to my knowledge, but I could be wrong. Any idea why it wasn’t mentioned?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#84

Post by greggman »

This is also an issue with in app web browsers. AFAIK an in app broswer's data can one way or another be completely accessed by the app containing the browser.

as an example, Tinder requires Facebook login. To do this it launches a WebView. it could be faking that view to get your Facebook credientials. it could also just get them direct from the WebView .

I know tons of apps depend on WebViews but I kind of wish there was a solution . maybe Apple only allowing the WebView to access certain domains and no 3rd party domains and then requiring the app to actually launch safari not use a WebView. Of course I suppose that doesn't help as the app can still display a fake Facebook login.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#85

Post by coldtea »

rightos wrote: post #39
michrassena wrote: post #29

Earlier quoted context omitted.

I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-…

> I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. Keyloggers can still enter the winlogon session and log all keystrokes there, they need to run as a SYSTEM service, but it's very possible to do. I'm surprised this isn't better documented, but it's pretty much as simple as copying the token from the existing Winlogon process, adjusting the pri…

>they need to run as a SYSTEM service, but it's very possible to do.

That makes their threat a moot point...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#86

Post by rightos »

lmz wrote: post #78
rightos wrote: post #39

Earlier quoted context omitted.

> I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. Keyloggers can still enter the winlogon session and log all keystrokes there, they need to run as a SYSTEM service, but it's very possible to do. I'm surprised this isn't better documented, but it's pretty much as simple as copying the token from the existing Winlogon process, adjusting the pri…

If you have keyloggers running as SYSTEM you've already lost.

True, the scenario in which ctrl+alt+del would help is one in which only a limited account had been compromised, but the SYSTEM level winlogon keylogger allows you to do things like turn local admin into network admin and it certainly doesn't require kernel mode access. I was more commenting on the requirement of kernel mode access or hijacking of special interrupts than on the usefulness in general.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#87

Post by ballenf »

EGreg wrote: post #23
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/ Dear Steve, There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password. I wanted to write and suggest an easy fix, that would ma…

Prescient of you!

Although I’m skeptical that users will really be alerted by the absence of a thing. The users I work with wouldn’t. But I would prefer it.

The inability to use the home button on the dialogues has become second nature to me out of healthy distrust/ paranoia.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#88

Post by Ajedi32 »

jsjohnst wrote: post #83

Apple does have one mitigation I’m surprised not to see listed. The keyboard changes color when it’s a system dialog asking for your password. That’s not something an App can do to my knowledge, but I could be wrong. Any idea why it wasn’t mentioned?

You sure about that? The screenshots in the article don't show the keyboard being a different color with a legitimate pop-up.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#89

Post by scosman »

greggman wrote: post #84

This is also an issue with in app web browsers. AFAIK an in app broswer's data can one way or another be completely accessed by the app containing the browser. as an example, Tinder requires Facebook login. To do this it launches a WebView. it could be faking that view to get your Facebook credientials. it could also just get them direct from the WebView . I know tons of apps depend on WebViews but I kind of wish the…

Facebook changed their SDK login behaviour to open the Facebook app, or Safari if it's not installed. If you see an in-app webview login for Facebook, you are being phished. However, 99% of users wouldn't know to check for this.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#90

Post by EGreg »

ballenf wrote: post #87
EGreg wrote: post #23

Earlier quoted context omitted.

I wrote this email to sjobs@apple.com back in 2011. Never heard back :-/ Dear Steve, There's one thing that's always bothered me about MacOS security. When a MacOS dialog pops up (e.g. to ask you for your password), there'sno way to tell for sure that it's MacOS that owns the dialog. A similar problem exists on the iPhone when I am asked for my iTunes password. I wanted to write and suggest an easy fix, that would ma…

Prescient of you! Although I’m skeptical that users will really be alerted by the absence of a thing. The users I work with wouldn’t. But I would prefer it. The inability to use the home button on the dialogues has become second nature to me out of healthy distrust/ paranoia.

I guess since writing that email, I would have preferred the option of taking a photo (and not storing it anywhere except here). You get used to system dialogs "looking like this" with the photo. If something is wrong, most humans pick it up easily. Only for blind users do you need the text.
Post reply on HN