Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

321–326 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#321

Post by a_t48 »

jaclaz wrote: post #320
gruez wrote: post #319

Earlier quoted context omitted.

but that requires a kernel mode component, and if you have kernel access all bets are off. for instance, you can directly patch out the login screen (which is in userspace) to steal the password for you.

Sure, but I bet that some clever folks may well "disguise" such a kernel component into (say) an update or a new install in such a way that the user is tricked as well to allow it. No idea anyway (since the topic is on iOS) how that OS would behave and what could be the equivalent of a Ctrl+Alt+Del key sequence on a keyboardless device such as a iPhone or iPad.

If you've got a kernel level hack already, just use a keylogger.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#322

Post by emmelaich »

jsjohnst wrote: post #314
emmelaich wrote: post #300

Earlier quoted context omitted.

I am only talking about what the app does when it is the foreground app. I should have addressed that in the previous comment. It's not a sidetrack, because that's what the actual article is about.

So if you really were talking about the foreground app and not just covering now, then why does one need to make a fake keyboard!? That makes no sense at all.

I was just making a more fundamental point (see my middle para) and decided to hang it off this thread rather than making it top level.

I didn't have a specific scenario in mind.

But to address your question ...

Say a user is reassured because he knows that only approved keyboard apps can accept passwords.

This malware app pops up a password prompt AND some images and input buttons that looks very much like a 'proper' keyboard.

The user enters his password.

Game over.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#323

Post by AstralStorm »

michrassena wrote: post #235
michrassena wrote: post #29

Earlier quoted context omitted.

I think the idea behind ctrl-alt-delete is that it generates a non-maskable interrupt that can't be hooked from user-mode. In days past, this sort of thing was called a secure attention key. https://en.wikipedia.org/wiki/Secure_attention_key And you're right, this needs to be a default part of any login handler. Why don't we use it when logging into a Linux console? The login prompt could easily be spoofed by a user-…

Altering the user's environment is a vector around security. I hadn't considered the sudo angle before, but there's a tradition of invoking binaries from their full path to mitigate the problem. So instead of sudo on its own, you would use /usr/sbin/sudo, and make sure your PATH variable never contains the current directory. Better mitigations disallow executables in users' home folders.

Not really. Attacker can execute their own shell from your profile script. Who knows how it will handle paths.

Depending on configuration, this can be prevented with noexec mount, selinux or SMACK. Grsecurity and RSBAC can prevent unwanted exec.

Systems like apparmor, or grsecurity MAC, TOMOYO or YAMA do not work against executing wrong executables.

IMA (signing and verifying files) can work too.

All bets are off in case there is a local root exploit in kernel or any setuid app.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#324

Post by zimpenfish »

bighi wrote: post #213
zimpenfish wrote: post #104

Earlier quoted context omitted.

"Then get yours out, you ain't touching my phone."

Easy to say when defending your point on Hacker News. We're already talking about security, and about someone with malicious intent having access to your phone. In the context of this conversation, you're already in simulated high security mental mode. It's completely different when you're relaxed (maybe having some fun), and the person asking for your phone is someone you know. In a relaxed social environment, you w…

> In a relaxed social environment, you will probably not be that rude

Perhaps I might phrase it slightly differently depending on who it was but the sentiment would be exactly the same[1] - a blanket refusal.

[1] Nowadays - back when I was on the Nokias or SE phones, sure, use my phone as a calculator, go nuts.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#325

Post by zimpenfish »

PascLeRasc wrote: post #273
bighi wrote: post #213

Earlier quoted context omitted.

Easy to say when defending your point on Hacker News. We're already talking about security, and about someone with malicious intent having access to your phone. In the context of this conversation, you're already in simulated high security mental mode. It's completely different when you're relaxed (maybe having some fun), and the person asking for your phone is someone you know. In a relaxed social environment, you w…

I think the person you're responding to isn't familiar with relaxed social environments. Seriously, it's so hard to find empathy in security research.

> Seriously, it's so hard to find empathy in security research.

If I ever get a job in that sphere, I'll let you know.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#326

Post by dboreham »

Someone wrote: post #298
dboreham wrote: post #288

Earlier quoted context omitted.

It was written in Bliss so not so hard if you understand BCPL or C. Also I was 17 and had a lot of time on my hands...

I think (s)he wonders how you read that. My guess would be that you did using the microfiche reader at your university or at a library. Before digitization, such devices were fairly common wherever people had a lot of text to archive. (Aside: https://en.wikipedia.org/wiki/Microform even has a photo of a “DuKane brand microfiche reader with source code printed on the films.”. I couldn’t read enough of the text on the…

Oh yeah. I worked at a defense contractor so we had facilities to read and print out Microfiche.

30 or so years later I bought a huge stack of DEC microfiche on eBay so I could still do it if I wanted. I don't have equipment to read it though.

Post reply on HN