Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recent 'MFA Bombing' Attacks Targeting Apple Users

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 233 posts

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#51

Post by rainbowzootsuit »

gruez wrote: post #37
_def wrote: post #15

I wonder how long it will take until another goal of these phone calls will be to gather enough samples to convincingly clone your voice.

You probably not going to get a voice clone from someone saying "hello?" 100 times. However, you don't really need to "MFA Bomb" people to clone their voice, just call them with a plausible sounding reason that will cause them to engage in an extended conversation (eg. "hey this is your uber/doordash driver/doctor/school/daycare).

I just really want to hear you say "passport" !

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#53

Post by vdddv »

lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

Interesting that using the recovery key stopped the issue for you, but does not seem to do its job now. From the article "Ken said he enabled a recovery key for his account as instructed, but that it hasn’t stopped the unbidden system alerts from appearing on all of his devices every few days.

KrebsOnSecurity tested Ken’s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices. "

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#54

Post by mcintyre1994 »

That message is horribly designed if it allows a password reset to happen on any other device after you click allow. It specifically says "Use this iPhone to reset". I'd have assumed it asks the person who clicked allow to set a new password, on the same device they clicked allow.

Then again if it shows on the watch too (and isn't just mirroring a phone notification, since it ignores quiet mode), I can't imagine the idea is you click allow on your watch and then type a password on its keyboard?

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#55

Post by [deleted] »

pmontra wrote: post #41
JKCalhoun wrote: post #38

Earlier quoted context omitted.

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

> A recovery key is an randomly generated 28-character code That's easy to backup. You can even print it and bury it in a sealed box in the garden or put it in a book or whatever. It depends who you are protecting against.

[deleted]

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#56

Post by m_a_g »

JKCalhoun wrote: post #38
lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

> When you set up a recovery key, you turn off Apple's standard account recovery process.

> However, if you lose your recovery key and can’t access one of your trusted devices, you'll be locked out of your account permanently.

I considered it before but I think it's just too much risk as I rely heavily on iCloud. On the other hand, I don't see the risk with the current method if you're smart enough not to fall for things like MFA bombing tactics.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#57

Post by millzlane »

AtNightWeCode wrote: post #25
WatchDog wrote: post #19

Earlier quoted context omitted.

The problem with adding rate limits, at least a global per user rate limit, is that you then create a new denial of service issue, preventing people from being able to recover their account.

Rate limiting per user is mostly a thing of the past. You set other rate limits and various rules and then get the rate limit per user for free.

> Rate limiting per user is mostly a thing of the past

Someone please tell this to fidelity. After 3 wrong password attempts they lock your account.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#58

Post by Klathmon »

pmontra wrote: post #41
JKCalhoun wrote: post #38

Earlier quoted context omitted.

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

> A recovery key is an randomly generated 28-character code That's easy to backup. You can even print it and bury it in a sealed box in the garden or put it in a book or whatever. It depends who you are protecting against.

But you shouldn't ONLY store it in a box or in your house.

That means you're one natural disaster away from losing everything.

As much as it can "weaken" security, an electronic backup is still recommended for most

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#59

Post by k8svet »

millzlane wrote: post #57
AtNightWeCode wrote: post #25

Earlier quoted context omitted.

Rate limiting per user is mostly a thing of the past. You set other rate limits and various rules and then get the rate limit per user for free.

> Rate limiting per user is mostly a thing of the past Someone please tell this to fidelity. After 3 wrong password attempts they lock your account.

Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. I can scrape Ameriprise fine, but no matter how creative I get Fidelity gives back a weird error on login.

(This is on top of them not sending any actionable email when changing my contributions to 0 in between pay periods)

I'm rolling my 401k out as often and fast as possible. I hate American banks so much.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#60

Post by mananaysiempre »

k8svet wrote: post #59
millzlane wrote: post #57

Earlier quoted context omitted.

> Rate limiting per user is mostly a thing of the past Someone please tell this to fidelity. After 3 wrong password attempts they lock your account.

Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. I can scrape Ameriprise fine, but no matter how creative I get Fidelity gives back a weird error on login. (This is on top of them not sending any actionable email when changing my contributions to 0 in between pay periods) I'm rolling my 401k out as often and fast as possible. I…

> us[e] Akamai to block scraping

Would https://github.com/lwthiker/curl-impersonate help? Haven’t tried with Akamai, but did help with another widely used CDN that shall remain unnamed (but has successfully infused me with burning hate for their products after a couple of years’ worth of using an always-on VPN to bypass Internet censorship and/or a slightly unusual browser).

Post reply on HN