Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recent 'MFA Bombing' Attacks Targeting Apple Users

krebsonsecurity.com

Post reply on HN
Print view View original

71–80 of 233 posts

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#71

Post by rjbwork »

nerdjon wrote: post #68
JKCalhoun wrote: post #38

Earlier quoted context omitted.

I was unsure what this Recovery Key was: https://support.apple.com/en-us/109345 It is kind of scary too — lose the key and no one can get you back in to your account.

You can setup a recovery contact incase you do loose the key. I just set that up with my partner and the chance of loosing the key and both of us losing all of our apple devices I think is fairly slim. I also stuck that key in 1Password (sure it's less safe, but if my 1Password was breached I have far bigger problems than this key being retrieved). Then keep a hard copy in a safe. Been contemplating sending my parent…

>Then keep a hard copy in a safe. Been contemplating sending my parents a safe (who live several states away) with keys on a sheet of paper without context that only I have the combination too. But not sure yet.

A friend of mine who was (maybe is? he knows I'm not a fan so we don't talk about it much) big into crypto stores his secrets in similar safes with trusted friends and family around the country. I think it's a good idea for things like this tbh.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#72

Post by nerdjon »

The lack of rate limiting is surprising, either on the server side or the OS side (or both).

I mean they already lock my iPhone after too many failed attempts with my passcode and it gets longer each time, I feel like the lock here should be the same.

A better prompt would also go a long way.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#73

Post by nerdjon »

rjbwork wrote: post #71
nerdjon wrote: post #68

Earlier quoted context omitted.

You can setup a recovery contact incase you do loose the key. I just set that up with my partner and the chance of loosing the key and both of us losing all of our apple devices I think is fairly slim. I also stuck that key in 1Password (sure it's less safe, but if my 1Password was breached I have far bigger problems than this key being retrieved). Then keep a hard copy in a safe. Been contemplating sending my parent…

>Then keep a hard copy in a safe. Been contemplating sending my parents a safe (who live several states away) with keys on a sheet of paper without context that only I have the combination too. But not sure yet. A friend of mine who was (maybe is? he knows I'm not a fan so we don't talk about it much) big into crypto stores his secrets in similar safes with trusted friends and family around the country. I think it's…

I think it is a good idea in theory also, there I just that voice that says "well now that key is out of my possession" and it scares me a bit.

I think I might need to look up to see if there is a known pattern to these keys that it could be easily figured out what it is even if it is just on a sheet with no context. Particularly 1Password which I think is a pattern if I remember correctly.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#74

Post by Klathmon »

alistairSH wrote: post #61
Klathmon wrote: post #58

Earlier quoted context omitted.

But you shouldn't ONLY store it in a box or in your house. That means you're one natural disaster away from losing everything. As much as it can "weaken" security, an electronic backup is still recommended for most

As much as it can "weaken" security, an electronic backup is still recommended for most Maybe I'm being dense (probably), but where would you save it? iCloud? No, that doesn't work - you need the key to access iCloud. Some other cloud storage service? No, that doesn't work - you need your phone to generate a token for access and your phone was destroyed in the same fire as the paper backup. Seems like the safe choice…

Personally, I encrypt my backup/recovery/setup keys in a CSV file using a password that I have memorized, and send them to family members to store in their accounts/cloud storage.

But safety deposit boxes are a good choice too, just be careful to balance your own convenience. If you can't easily update your backups, you're really unlikely to include new accounts in them

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#75

Post by robmccoll »

nerdjon wrote: post #73
rjbwork wrote: post #71

Earlier quoted context omitted.

>Then keep a hard copy in a safe. Been contemplating sending my parents a safe (who live several states away) with keys on a sheet of paper without context that only I have the combination too. But not sure yet. A friend of mine who was (maybe is? he knows I'm not a fan so we don't talk about it much) big into crypto stores his secrets in similar safes with trusted friends and family around the country. I think it's…

I think it is a good idea in theory also, there I just that voice that says "well now that key is out of my possession" and it scares me a bit. I think I might need to look up to see if there is a known pattern to these keys that it could be easily figured out what it is even if it is just on a sheet with no context. Particularly 1Password which I think is a pattern if I remember correctly.

You could split the key a few ways if you don't want to trust that one of your stores won't be compromised https://en.m.wikipedia.org/wiki/Shamir%27s_secret_sharing

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#76

Post by someguydave »

antihero wrote: post #46
lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

Also, buy some (at least three) YubiKeys and use them for your Apple ID verification instead of the dumb push MFA. https://support.apple.com/en-gb/HT213154

But is it the case that the Yubikey is essentially treated the same as a trusted device? What if I want to untrust my devices and only trust ubikeys (without removing the device from my icloud account?)

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#77

Post by ImPostingOnHN »

guappa wrote: post #27
yieldcrv wrote: post #14

Earlier quoted context omitted.

I think we should start doing product liability lawsuits to any organization capable of having user financial data affected from their account, that is using SMS one time codes as either default, enabled by default, and the heaviest legal remedies to financial organizations where that's the only option we should also update PCI DSS compliance or whatever relevant security standard to call SMS one time codes totally i…

I think the more urgent thing is to not use the social security number both as the ultimate secret, and also as a number you must give to hundreds of people.

I think the more urgent thing is to end world hunger.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#78

Post by aareet »

brookst wrote: post #65
chrisjj wrote: post #28

> even though I have my Apple watch set to remain quiet during the time I’m usually sleeping at night, it woke me up with one of these alerts. So... Apple Watch "quiet" is broken??

I find sleep focus mode much more reliable than the silent switch. It’s confusing they have both.

I think it is just a transition period until they can get rid of models with the switch in their lineup. Since the action button is now configurable, it could soon turn back into just focus modes as the configurable way to silence your phone

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#79

Post by someguydave »

antihero wrote: post #46
lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

Also, buy some (at least three) YubiKeys and use them for your Apple ID verification instead of the dumb push MFA. https://support.apple.com/en-gb/HT213154

From your apple doc:

“ When you use Security Keys for Apple ID, you’ll need a trusted device or a security key to:

Sign in with your Apple ID on a new device or on the web

Reset your Apple ID password or unlock your Apple ID

Add additional security keys or remove a security key”

Yubikeys do nothing except enlarge your attack surface.

Re: Recent 'MFA Bombing' Attacks Targeting Apple Users

#80

Post by fortran77 »

lloeki wrote: post #8

"recent"? This happened to me and my wife (each starting a few days apart) in 2021, or maybe 2022 but no later. It started with a couple requests a day, then ramped up to every hour or something. IIRC we also both got a couple SMS claiming to be from Apple. As soon as it ramped up I set up both accounts to use recovery keys, which is a move I had planned anyway on grounds that it should not be in Apple's (or someone…

Wow! You'd think they'd rate limit these! Once you've done it twice, go to once every 15 minutes, then hour, then 4 hours, than day, etc. Like bad logins.
Post reply on HN