I think fix is simple. Just show the icon of app showing the prompt as part of prompt. I am surprised such apps made through from review process.
iOS Privacy: Easily get a user's Apple ID password, just by asking
151–160 of 326 posts
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#152Earlier quoted context omitted.
I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-…
>The login prompt could easily be spoofed by a user-mode program. On the VT100 terminals in the computer lab in college (back in the early 90s) someone was doing this. A shell script to harness logins, print it was unsuccessful and log out. . There was a key at the top of the vt-100 keyboard that would reset it. The "key" part was often pried off (accidental pressing was bad), but you could still press the nub left b…
In my misspent youth I wrote a login trojan for VAX/VMS. It circumvented the "break" key trick that you are alluding to above. I had to drop down to Bliss-32 and use the $QIO syscall but it can be done. Once I had captured the sysadmin password and logged in once to prove my achievement I never ran it again. Learned many interesting things though. My task was made easier because DEC published the source code for the OS, albeit as Microfiche. I was therefore able to study the terminal handler code and figure out how to make a trojan that perfectly emulated the regular login behavior including all its timeouts and responses to various control keys.
Oh, and the VAX-11/780 I had hacked into crashed due to a memory board fault in the minute after I had logged in with my snagged admin password. I spent the remainder of the weekend sweating that I had broken the VAX since I had no idea what had happened. I had just given myself all 32 of the VMS account privileges when it went down.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#153How does the phishing app know my apple ID email address already?
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#154This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…
MacOS with the new TouchID is pretty bad on this as well. I thought all user password prompts would be replaced with Touch ID but it's very much hit and miss and varies greatly.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#155This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…
There's already something in iOS to handle this: The overlay for apple pay. It slides up from the bottom and is easily distinguishable from the app you're using. If they had something similar for the iTunes password it would work really well
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#156There are so many random popups in iOS to authenticate to itunes, app store, facetime, icloud, etc that I am amazed widespread phishing strategies don't already target them
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#157I think fix is simple. Just show the icon of app showing the prompt as part of prompt. I am surprised such apps made through from review process.
That assumes that a phisher would use the system API for creating a prompt. It's possible for them to draw a dialog that looks just like the system dialog on top of the regular application chrome. Once Apple has trained a user that it is ever okay to type this information in, the cat is really out of the bag.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#158Android already has a decent fix for this. When a Google app needs a password entered, it shows a notification. An example I run into is when Chrome wants its Sync Passphrase. I remember long ago seeing something similar when I changed my account password, but I haven't seen it recently so I don't know if they're still doing it.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#159How does the phishing app know my apple ID email address already?
AFAIK there is no way to obtain the apple id being used, as it would work as an excellent cross-device persistent identifier. However many people would just use their email address which you could get asking them to register, connecting with facebook and other legitimate use cases.
Re: iOS Privacy: Easily get a user's Apple ID password, just by asking
#160Can anyone parse this sentence? I have no idea what it's trying to say:
Nope, actually, that's how the system dialog looks like, the . is within the "string notation, so I designed the phishing dialog to also include this little, but very important design detail