iCloud Apple ID Brute Forcer
github.com
iCloud Apple ID Brute Forcer
1–10 of 42 posts
Re: iCloud Apple ID Brute Forcer
#2 "Why?
This bug is painfully obvious and was only a matter of time before it was
privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it."
I'm not a security expert but that does not sound like responsible disclosure to me. Granted, Apple is not easy to communicate with, but still…
Edit: This does indeed look like a really bad thing. At the very least one would hope that login attempts were rate limited.
Re: iCloud Apple ID Brute Forcer
#3How is it not rate limited? I don't understand why this is not a thing in every login activity everywhere. can someone explain one reason you might choose to NOT rate limit auth attempts? I don't understand :S
Re: iCloud Apple ID Brute Forcer
#4"Why? This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it." I'm not a security expert but that does not sound like responsible disclosure to me. Granted, Apple is not easy to communicate with, but still… Edit: This does indeed look like a really bad thing. At the very least one would hope that lo…
Having had to deal with apple and knowing quite a few other people who had a simmilar exprience i have a feeling that this was the only way of doing so. Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue.
This for some reason is much more prevelant for their services and mobile platform (especially when it comes to "design" flaws rather than a simple software bug) than the OSX team which while might simply not reply unless it gets enough traction on the the mailing list will atleast not send you threatening letters from their lawyers.
Re: iCloud Apple ID Brute Forcer
#5How is it not rate limited? I don't understand why this is not a thing in every login activity everywhere. can someone explain one reason you might choose to NOT rate limit auth attempts? I don't understand :S
Any effective rate limiting tends to cause major UX issues under many circumstances and opens the system to denial of service under some.
Probably the best way of dealing with such attacks these days is what Google and many other companies do and that's use huristics and progressive challenges, while not perfect these tend to be usually even more effective than rate limiting.
If the auth requests are comming for an unknown device, a foriegn IP address, at a suspicious time/rate etc. the user is challenged for additional information than just their passwords this can be some random secret question a secondary authentication (via phone, SMS, email etc) or even some anti scripting stuff.
Re: iCloud Apple ID Brute Forcer
#6"Why? This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it." I'm not a security expert but that does not sound like responsible disclosure to me. Granted, Apple is not easy to communicate with, but still… Edit: This does indeed look like a really bad thing. At the very least one would hope that lo…
Having had to deal with apple and knowing quite a few other people who had a simmilar exprience i have a feeling that this was the only way of doing so. Apple is notorious for not accepting certain discovered vulnerabilities at best, and at worst ciminilizing people who do try and report an issue. This for some reason is much more prevelant for their services and mobile platform (especially when it comes to "design"…
> at worst ciminilizing people who do try and report an issue […] will atleast not send you threatening letters from their lawyers
Wow. Citation needed, please.
Re: iCloud Apple ID Brute Forcer
#7How is it not rate limited? I don't understand why this is not a thing in every login activity everywhere. can someone explain one reason you might choose to NOT rate limit auth attempts? I don't understand :S
Because if you want to limit the number of attempts you have to code it into the login module. If you want to save time... By the way, if you're attempting a bruteforce don't use PHP.
Re: iCloud Apple ID Brute Forcer
#8... ... wait, wait, wait.
This is a tool which attempts to brute force a password by making HTTP POSTs to an API? And someone though the best way to write that was in in PHP, which is single threaded and thus cannot try multiple passwords in parallel?
Wow. Ok. Good luck with that.
Re: iCloud Apple ID Brute Forcer
#9Skip the link, but know it's out there.
Re: iCloud Apple ID Brute Forcer
#10... ... wait, wait, wait. This is a tool which attempts to brute force a password by making HTTP POSTs to an API? And someone though the best way to write that was in in PHP, which is single threaded and thus cannot try multiple passwords in parallel? Wow. Ok. Good luck with that.
You now know the payload and the endpoint, so feel feel to fork