Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recent 'MFA Bombing' Attacks Targeting Apple Users

krebsonsecurity.com

Post reply on HN
Print view View original

61–70 of 233 posts

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#61

Post by alistairSH »

Klathmon wrote: post #58
pmontra wrote: post #41

Earlier quoted context omitted.

> A recovery key is an randomly generated 28-character code That's easy to backup. You can even print it and bury it in a sealed box in the garden or put it in a book or whatever. It depends who you are protecting against.

But you shouldn't ONLY store it in a box or in your house. That means you're one natural disaster away from losing everything. As much as it can "weaken" security, an electronic backup is still recommended for most

As much as it can "weaken" security, an electronic backup is still recommended for most

Maybe I'm being dense (probably), but where would you save it?

iCloud? No, that doesn't work - you need the key to access iCloud.

Some other cloud storage service? No, that doesn't work - you need your phone to generate a token for access and your phone was destroyed in the same fire as the paper backup.

Seems like the safe choice is a lock box at a bank or similar. Or a fireproof safe at home.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#62

Post by hx833001 »

vdddv wrote: post #53
lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

Interesting that using the recovery key stopped the issue for you, but does not seem to do its job now. From the article "Ken said he enabled a recovery key for his account as instructed, but that it hasn’t stopped the unbidden system alerts from appearing on all of his devices every few days. KrebsOnSecurity tested Ken’s experience, and can confirm that enabling a recovery key does nothing to stop a password reset p…

A password reset prompt is sent to the devices, but unfortunately the article leaves out that the prompt only enables you to reset the password on the device that receives the prompt. So it is not a security issue, just an annoyance.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#63

Post by woadwarrior01 »

Quite shocking how oblivious a lot of ostensibly tech savvy people are to the existence of hardware security tokens. Yubikeys have been around for over 15 years now, although Apple only added support for hardware tokens recently.

https://support.apple.com/en-us/HT213154

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#64

Post by forgotmyinfo »

pmontra wrote: post #41
JKCalhoun wrote: post #38

Earlier quoted context omitted.

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

> A recovery key is an randomly generated 28-character code That's easy to backup. You can even print it and bury it in a sealed box in the garden or put it in a book or whatever. It depends who you are protecting against.

Never underestimate the security and safety of a hidden piece of paper! If it's good enough for wills for the last 500 years, it's good enough for a password.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#65

Post by brookst »

chrisjj wrote: post #28

> even though I have my Apple watch set to remain quiet during the time I’m usually sleeping at night, it woke me up with one of these alerts. So... Apple Watch "quiet" is broken??

I find sleep focus mode much more reliable than the silent switch. It’s confusing they have both.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#66

Post by bombcar »

alistairSH wrote: post #61
Klathmon wrote: post #58

Earlier quoted context omitted.

But you shouldn't ONLY store it in a box or in your house. That means you're one natural disaster away from losing everything. As much as it can "weaken" security, an electronic backup is still recommended for most

As much as it can "weaken" security, an electronic backup is still recommended for most Maybe I'm being dense (probably), but where would you save it? iCloud? No, that doesn't work - you need the key to access iCloud. Some other cloud storage service? No, that doesn't work - you need your phone to generate a token for access and your phone was destroyed in the same fire as the paper backup. Seems like the safe choice…

Get it tattooed on a (normally not seen) part of your body. Like under your hair! ;)

Of course, a code like that can be in multiple places, possibly where it won’t be recognized as such.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#67

Post by asd4 »

m_a_g wrote: post #56
JKCalhoun wrote: post #38

Earlier quoted context omitted.

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

> When you set up a recovery key, you turn off Apple's standard account recovery process. > However, if you lose your recovery key and can’t access one of your trusted devices, you'll be locked out of your account permanently. I considered it before but I think it's just too much risk as I rely heavily on iCloud. On the other hand, I don't see the risk with the current method if you're smart enough not to fall for th…

The security researcher in the article was concerned about accidently confirming the prompt on his watch.

I don't think its a matter of being "smart enough". Human error can easily creep in when dismissing 10's or 100's of prompts.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#68

Post by nerdjon »

JKCalhoun wrote: post #38
lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

You can setup a recovery contact incase you do loose the key. I just set that up with my partner and the chance of loosing the key and both of us losing all of our apple devices I think is fairly slim.

I also stuck that key in 1Password (sure it's less safe, but if my 1Password was breached I have far bigger problems than this key being retrieved).

Then keep a hard copy in a safe. Been contemplating sending my parents a safe (who live several states away) with keys on a sheet of paper without context that only I have the combination too. But not sure yet.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#69

Post by pinebox »

standing_user wrote: post #49
mavamaarten wrote: post #47

I've been getting these on my LinkedIn account since a couple of days. Every few hours I get an email with a magic login link. They seem legitimate, originating from various locations around the globe.

Happened to me yesterday, I was baffled but then I found that you can request the one time password just using the email associated with the LinkedIn account, so the password wasn't compromised I have changed the password, main mail and in the privacy settings of LinkedIn removed the visibility of the email

Linkedin will silently change your visibility settings without your consent.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#70

Post by ryandrake »

k8svet wrote: post #59
millzlane wrote: post #57

Earlier quoted context omitted.

> Rate limiting per user is mostly a thing of the past Someone please tell this to fidelity. After 3 wrong password attempts they lock your account.

Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. I can scrape Ameriprise fine, but no matter how creative I get Fidelity gives back a weird error on login. (This is on top of them not sending any actionable email when changing my contributions to 0 in between pay periods) I'm rolling my 401k out as often and fast as possible. I…

> Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping.

What’s funny/sad is they probably pat themselves on their back thinking their security is so advanced and awesome. Financial services web integrations are all total clown shows.

Post reply on HN