Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recent 'MFA Bombing' Attacks Targeting Apple Users

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 233 posts

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#31

Post by yieldcrv »

guappa wrote: post #27
yieldcrv wrote: post #14

Earlier quoted context omitted.

I think we should start doing product liability lawsuits to any organization capable of having user financial data affected from their account, that is using SMS one time codes as either default, enabled by default, and the heaviest legal remedies to financial organizations where that's the only option we should also update PCI DSS compliance or whatever relevant security standard to call SMS one time codes totally i…

I think the more urgent thing is to not use the social security number both as the ultimate secret, and also as a number you must give to hundreds of people.

non sequitur, make a different thread for that cause

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#32

Post by klabb3 »

guappa wrote: post #27
yieldcrv wrote: post #14

Earlier quoted context omitted.

I think we should start doing product liability lawsuits to any organization capable of having user financial data affected from their account, that is using SMS one time codes as either default, enabled by default, and the heaviest legal remedies to financial organizations where that's the only option we should also update PCI DSS compliance or whatever relevant security standard to call SMS one time codes totally i…

I think the more urgent thing is to not use the social security number both as the ultimate secret, and also as a number you must give to hundreds of people.

> both as the ultimate secret, and also as a number you must give to hundreds of people

Don’t forget the final nail in the coffin, which completes the trifecta: it’s entirely immutable - damage radius = infinite.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#33

Post by ThePowerOfFuet »

dm wrote: post #29
type_Ben_struct wrote: post #2

I’m still disappointed by Apples implementation of security keys. I want to be able to prevent all 2FA methods other than security keys, but it still seems possible in certain flows to authorise a new login with another iOS device making it vulnerable to this attack.

What flows have you found not to use security keys?

All of them.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#35

Post by _def »

rvz wrote: post #20
_def wrote: post #15

I wonder how long it will take until another goal of these phone calls will be to gather enough samples to convincingly clone your voice.

Exactly this. Another reason to not to use phone (or the numbers) calls to verify users even with so called 'voice identification or voice ID' which can easily be broken with advanced voice cloning.

Recently I was baffled how far we've come with this. It doesn't work perfectly, but could be enough to fool someone. Just one pip install and a short voice sample away: https://github.com/coqui-ai/TTS

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#36

Post by gruez »

prmoustache wrote: post #34

I have hated Push MFA since it was introduced. How hard is it to just type a code really. In the end to fight against push bombing you end up with push notification that ask you for a code anyway.

At least on for icloud sign ins (not sure about password resets, too lazy to check), clicking "allow" doesn't allow the sign in, it only displays a 6 digit code that you have to enter to log in.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#37

Post by gruez »

_def wrote: post #15

I wonder how long it will take until another goal of these phone calls will be to gather enough samples to convincingly clone your voice.

You probably not going to get a voice clone from someone saying "hello?" 100 times. However, you don't really need to "MFA Bomb" people to clone their voice, just call them with a plausible sounding reason that will cause them to engage in an extended conversation (eg. "hey this is your uber/doordash driver/doctor/school/daycare).

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#38

Post by JKCalhoun »

lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345

It is kind of scary too — lose the key and no one can get you back in to your account.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#39

Post by gruez »

jasode wrote: post #9
saagarjha wrote: post #5

Earlier quoted context omitted.

This has nothing to do with SIM swapping or phone numbers.

>phone numbers. On the official Apple reset form, the "phone number" is one of the id options the hackers can use to MFA bomb the target: https://iforgot.apple.com/password/verify/appleid The gp proposes a different "private identification string" that's not public. Public IDs such as "email address" or "phone number" are susceptible to what this article is talking about.

Given that the gp was talking about victims being "SIM swapped", I strongly suspect he's referring to the classic sim swap attack where you sim swap, then use the newly registered sim to receive a password reset code. If it just involves discovering your phone number, you wouldn't need to sim swap at all.

>The gp proposes a different "private identification string" that's not public. Public IDs such as "email address" or "phone number" are susceptible to what this article is talking about.

This is a non-starter for the general public. If they can barely remember their password what are the chances they'll remember a "private identification string" or whatever?

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#40

Post by guappa »

yieldcrv wrote: post #31
guappa wrote: post #27

Earlier quoted context omitted.

I think the more urgent thing is to not use the social security number both as the ultimate secret, and also as a number you must give to hundreds of people.

non sequitur, make a different thread for that cause

Well if you fine companies for using SMS for security… you should put the CEO in jail for authenticating with social security number… if we go by just the number of people who get affected by skimmed SMS and by stolen ssn.
Post reply on HN