Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iCloud Apple ID Brute Forcer

github.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: iCloud Apple ID Brute Forcer

#31

Post by Artemis2 »

billyhoffman wrote: post #19
thaumaturgy wrote: post #14

Earlier quoted context omitted.

It's a proof-of-concept. Also, PHP does have support for multiple threads and/or forking. It's just not commonly used.

[sigh] Yes, I know PHP can use a standard fork() call. But if you fork, then you need to shard the attack space into different sections, and then pull all the results back together again. Or you manually use `split` on the wordlist and run them as parallel processes. Either way, you are going to have to go through that trouble to re-combining everything. At which point, you might as well use an actual threaded langua…

pthreads. You know them?

Re: iCloud Apple ID Brute Forcer

#32

Post by josephlord »

Y-bar wrote: post #22
Y-bar wrote: post #6

Earlier quoted context omitted.

> at worst ciminilizing people who do try and report an issue […] will atleast not send you threatening letters from their lawyers Wow. Citation needed, please.

So, I've been googling but can't find any single instance where Apple seems to have threatened a security researcher. I'm new here on HN, but I don't understand why I was down voted. Was it seen as passive-agressive to ask, I could understand that, but any actual source would be appreciated. We all know that anything that paints Apple in a bad light travels faster than the speed of said light and generally gets picke…

In general "citation needed" on its own is frowned on as it is lazy and negative adding little to the discussion. My guess is that this is the reason for downvotes.

Some claims do have to be called out and this might have be one of them. An indication that it doesn't match your experience and that you have done at least a cursory search before requesting the citation would be less likely to be downvoted.

Re: iCloud Apple ID Brute Forcer

#33

Post by jamescostian »

Has anyone looked at the wordlist? It's over here: https://raw.githubusercontent.com/Pr0x13/iDict/master/files/...

For those who don't want to bother clicking on that link, it's only 500 lines long. In other words, if your password is not one of the 500 listed in that file, you'll be fine. My password is not listed in the file, and the same goes for almost all of us. There are literally 500 passwords in that file! If you only use letters and numbers for your password and your password is 8 characters long, there are more than 2 * 10^14 possibilities

This thing has got to be a joke

Re: iCloud Apple ID Brute Forcer

#34

Post by sp0rk »

jamescostian wrote: post #33

Has anyone looked at the wordlist? It's over here: https://raw.githubusercontent.com/Pr0x13/iDict/master/files/... For those who don't want to bother clicking on that link, it's only 500 lines long. In other words, if your password is not one of the 500 listed in that file, you'll be fine. My password is not listed in the file, and the same goes for almost all of us. There are literally 500 passwords in that file! If…

Small wordlists are generally used with long username lists to get the low-hanging fruit. Obviously somebody using this tool to target a specific account is going to swap out the default wordlist for something much larger and potentially customized.

Re: iCloud Apple ID Brute Forcer

#35

Post by ZitchDog »

A quick skim of the source shows that appears to be using the iCloud auth device setup workflow which does not have any rate limiting or account lockout guards in place.

I'm guessing the author noticed that, when setting up a new device for iCloud, that they didn't get locked out when authenticating their iCloud credentials. They then reverse engineered this authentication process and created a script to brute force it. Not an earth shattering attack, but an astute one.

Expect apple to add rate limiting soon. I'm not sure if they'd be able to implement lockout without breaking the login process with existing devices.

Re: iCloud Apple ID Brute Forcer

#36

Post by ZitchDog »

madeofpalk wrote: post #27

Slightly side note, I found it interesting looking through the HTML UI for the iCloud account creation ( https://setup.icloud.com/setup/create_account_ui , sourced from a URL the brute forcer script hits). One oddity I found is different length requirements for regular email and recovery email EmailTooLong: "Email address must be less than 320 characters.", RecoveryEmailTooLong: "Email address must be less than 256 c…

Probably just different field lengths in the DB.

Re: iCloud Apple ID Brute Forcer

#37

Post by cryowaffle »

billyhoffman wrote: post #19
thaumaturgy wrote: post #14

Earlier quoted context omitted.

It's a proof-of-concept. Also, PHP does have support for multiple threads and/or forking. It's just not commonly used.

[sigh] Yes, I know PHP can use a standard fork() call. But if you fork, then you need to shard the attack space into different sections, and then pull all the results back together again. Or you manually use `split` on the wordlist and run them as parallel processes. Either way, you are going to have to go through that trouble to re-combining everything. At which point, you might as well use an actual threaded langua…

I really think you are missing the point here. And why are you so exasperated? Take a break man.

Re: iCloud Apple ID Brute Forcer

#38

Post by lovelettr »

I have tried this script on my own account to see what it looks like when it succeeds and all of that. While it does appear to succeed and not be rate limited. The outcome is that the account will have been disabled as a result running the script. Even if it succeeded and found the password it would be no good to the attacker anymore.

> This Apple ID has been locked for security reasons. Visit iForgot to reset your account (https://iforgot.apple.com).

I'm no security expert but that must reduce at least some of the vulnerability.

Though it seems like this could be weaponized to be a hassle. I only point this out because I have 2-factor auth and have locked my account and cannot seem to find my recovery key. /facepalm

Re: iCloud Apple ID Brute Forcer

#39

Post by EC1 »

lovelettr wrote: post #38

I have tried this script on my own account to see what it looks like when it succeeds and all of that. While it does appear to succeed and not be rate limited. The outcome is that the account will have been disabled as a result running the script. Even if it succeeded and found the password it would be no good to the attacker anymore. > This Apple ID has been locked for security reasons. Visit iForgot to reset your a…

Could also be used to just grab the password and try it against other accounts. Most people have one password for everything.

Re: iCloud Apple ID Brute Forcer

#40

Post by colinbartlett »

jamescostian wrote: post #33

Has anyone looked at the wordlist? It's over here: https://raw.githubusercontent.com/Pr0x13/iDict/master/files/... For those who don't want to bother clicking on that link, it's only 500 lines long. In other words, if your password is not one of the 500 listed in that file, you'll be fine. My password is not listed in the file, and the same goes for almost all of us. There are literally 500 passwords in that file! If…

It's just a proof of concept.
Post reply on HN