Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

231–240 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#231

Post by mmjaa »

vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

Back in the day, we used to train operators to use 'type sudo' before every use of the sudo command, to be sure they weren't surreptitiously using an alias ..

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#232

Post by jon889 »

ecesena wrote: post #110

On iOS the test of pressing the home button and see if the app goes in background seems a pretty strong one. Perhaps in a future Apple can make you press the home button as part of the verification, so it’s kind of implicit.

Perhaps when you put your finger on the home button it would read your fingerprint and authenticate you like that and the user wouldn't have to enter their password into a box that might steal it..

I can spend thousands using just my fingerprint, but authorising my Apple ID so I can buy a 99p app or login into iMessage requires my Apple ID password...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#233

Post by balls187 »

arrty88 wrote: post #153

How does the phishing app know my apple ID email address already?

I thought that too, but further in the article, it explains some official dialogs don't have the AppleID.

One way to get the email:

At the start of the phishing app, ask the user to enter in their AppleID, then store it.

Sometime later, present the user asking for their AppleID password.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#234

Post by rconti »

vortico wrote: post #225
cisanti wrote: post #208

Earlier quoted context omitted.

Most of the people have girlfriends and friends.

Believe me, it is possible to have a security-conscious, trustworthy girlfriend who respects your privacy if you do the same to her.

And I've never given my wife a single password or passcode or PIN. But she can still use my damn phone or computer if she wants, as can my friends. Worst case scenario, I get a 55 gallon drum of lube ordered on my Amazon account.

For me, the principle is I never divulge credentials, but I trust people I know. Therefore I see no conflict with adding my wife's fingerprint to TouchID, for example. (though it's not worth the effort of re-enrolling her every time I get a new device or a new screen or reinstall from scratch, so that's long lost).

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#235

Post by michrassena »

michrassena wrote: post #29
vbezhenar wrote: post #11

Earlier quoted context omitted.

There are many solutions. First is requiring un-catchable keyboard shortcut to enter the password. Something like "ctrl-alt-delete" for Windows (I'm not sure if it's un-catchable, but you got an idea) or even better some unused key like pause/break. User will be trained to press this shortcut and app can't replicate it, so user won't be tricked. Second is using fingerprint. iOS should just use fingerprint always inst…

I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-…

Altering the user's environment is a vector around security. I hadn't considered the sudo angle before, but there's a tradition of invoking binaries from their full path to mitigate the problem. So instead of sudo on its own, you would use /usr/sbin/sudo, and make sure your PATH variable never contains the current directory. Better mitigations disallow executables in users' home folders.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#236

Post by dragontamer »

ryanlol wrote: post #220
jlgaddis wrote: post #149

Earlier quoted context omitted.

> iOS should just use fingerprint always ... Some of us don't want to use TouchID so, no, it shouldn't.

Do you not have fingers? Or is there some other good reason not to use TouchID outside of the lock screen?

If your password gets compromised, you can change your passwords.

If your fingerprint gets compromised, you CANT change your finger (erm... probably. I dunno of any easy way in any case)

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#237

Post by slrz »

seiferteric wrote: post #197
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

Ya there are some solutions, like you can prefix a '\' before a command to make sure you are running the real command and not a alias, so in your example running: \sudo would defeat your attack. But few are in the practice of doing that.

> But few are in the practice of doing that.

Because there's no point. If I'm able to manipulate your shell environment to set aliases, I can also change your search path so that \sudo picks up the program I want. And no, you can't defeat that by only running /usr/bin/sudo because there are a million other nasty things to do once an attacker has reached this level of control.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#239

Post by Gaelan »

recursive wrote: post #211
Gaelan wrote: post #190

Earlier quoted context omitted.

Is there any reason you can’t watch for control-alt and assume that delete will be pressed soon and react to that?

You could, but then when the delete actually gets pressed, you'll get pre-empted by the real thing.

Back on XP I recall C-A-D not showing the task manager on malware-infested machines. Not sure if that's changed since then (is the full-screen c-a-d in 7/8/10 related)?

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#240

Post by ProfessorLayton »

tolmasky wrote: post #212

When the iPhone X notch was first announced I thought it would be a fantastic security UI opportunity: What if the top of the screen was only writable by the system? It would normally be black or show the time, but whenever there is a password dialog, it turns green with a security lock. This is something I've wanted on all computers for a while: fundamentally, any computer where you can get access to the whole scree…

This would also make sense on the MBP's touchbar
Post reply on HN