Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recent 'MFA Bombing' Attacks Targeting Apple Users

krebsonsecurity.com

Post reply on HN
Print view View original

201–210 of 233 posts

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#201

Post by rsync »

mhdhn wrote: post #6
rvz wrote: post #4

Yet another reason why phone number verification is the most insecure way to verify users and it doesn't matter if a company like Apple is using it or your bank using so called 'Military grade encryption'. The point still stands [4] with countless examples [0] [1] [2] [3]. Unless you want your users to be SIM swapped, there is no reason to use phone numbers for logins, verification and 2FA. [0] https://news.ycombinat…

What's the recommended alternative for mere mortal hackers?

I host my phone number at twilio and have built an SMS firewall between my public phone number and my actual SIM number.

Flatten texts to ASCII-256, blacklists/whitelists, priority tagging, SMS cc'd to an email box, multi-number simul-receive, and so on.

Well, you asked ...

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#203

Post by zikduruqe »

0cf8612b2e1e wrote: post #162
dylan604 wrote: post #154

Earlier quoted context omitted.

What happens if there's a typo in the engraving? Who's doing the engraving? How much do you trust the people you are providing the key to do it? When does the paranoia kick in vs being diligent?

This was at least an innovation in the bitcoin community. Several assemble at home systems where you can build a physical manifestation of a secret. Metal cards you punch with a hammer and nail. Another is essentially a tube where you string along metal letters of the password.

You can use a beer can. https://bitcan.world

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#204

Post by ohmyiv »

toomuchtodo wrote: post #185
AnthonyMouse wrote: post #182

Earlier quoted context omitted.

This should not be required by law because many people specifically don't want it. I'm content to keep my own redundant copies of a recovery key and suffer the consequences of my own actions, rather than allowing someone to steal my account just because they made a convincing fake ID or hacked some government system. In general centralized identity systems are a single point of failure and hooking more things into th…

I argue for and advocate that this capability should exist, but not be mandatory. If you do not want to tie your personal identity to your digital identity, certainly, you should be able to not do so and rely solely on a cryptographic primitive, recovery key, or other digital mechanism to govern access of last resort. If your account access is lost forever, it's on you and that was a choice that was made. > Somehow y…

> If you need a driver's license, how do you get a driver's license? With a birth certificate? Okay, how do you get a copy of your birth certificate when you don't have a driver's license?

Using vitalchek, you can order a BC with a notarized document, using two people who have valid IDs as people to vouch for your identity. I've done it for multiple clients.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#205

Post by cozzyd »

nebula8804 wrote: post #159
ManBeardPc wrote: post #21

Earlier quoted context omitted.

There is already a variant where they try to get someone to say „yes“ and just use a recording of it to use as „proof“ that you agreed to some contract.

OMG that explains so much. I kept getting these calls where they would ask "Am I speaking with the head of the household?"...crap

Good thing for Google call screening ...

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#206

Post by chatmasta »

gnicholas wrote: post #200
chatmasta wrote: post #172

> he received a call on his iPhone that said it was from Apple Support (the number displayed was 1-800-275-2273, Apple’s real customer support line) This happened to me exactly once, and it was two days after I ordered a new MacBook from the online Apple Store. Since I was expecting a shipment, I almost picked it up. But instead I called Apple Support myself, and asked if they had called me, and they said they had no…

Did you order right after a new model was released (as many people do), or did they just get lucky in calling you soon after you placed an order?

It was in December 2020, so maybe? I can't remember. I had just incorporated an Inc. (and received seed funds, but those weren't publicly available or announced), so maybe some of that info was a trigger. But it was surprisingly well-timed, for sure. It was within three days of placing the order.

I suppose it could have also been as simple as "it's Christmas shopping time." I remember what was most surprising was seeing the caller ID, which I think was actually "Apple Inc," and which was saved as a contact in my phone.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#207

Post by snowwrestler »

rainbowzootsuit wrote: post #51
gruez wrote: post #37

Earlier quoted context omitted.

You probably not going to get a voice clone from someone saying "hello?" 100 times. However, you don't really need to "MFA Bomb" people to clone their voice, just call them with a plausible sounding reason that will cause them to engage in an extended conversation (eg. "hey this is your uber/doordash driver/doctor/school/daycare).

I just really want to hear you say "passport" !

Wait. A computer matched her with him? I don't think so.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#210

Post by paul_h »

The fatigue part: if you clicked allow, and the hackers called you for the second step, but you responded "I understand you're a hacker and are wanting to steal from me in some way, but I am only going to give you incorrect pin numbers, so please stop with the reset dialogs and update your database not to try it again with me" .. would they stop? /s
Post reply on HN