Sci-tech

Phishing attack dupes iPhone users into revealing their Apple ID password

Phishing attack dupes iPhone users into revealing their Apple ID password”

But what if that pop-up hasn't come from Apple, and has instead been created to look like an official request in an attempt by hackers to steal your credentials?

The proof-of-concept was detailed by Felix Krause, founder of the open-source app-building tool fastlane. From there, the app could send that popup and subsequently log the Apple ID and password.

But developer Felix Krause discovered that an app only needs about 30 lines of code to include a fraudulent "Enter your Apple ID password" popup that can be used to steal user data. Reporting potentially fraudulent apps to Apple is also advisable. As his pictures show, this can be designed by a developer to look identical to a "Sign into iTunes Store" pop-up. It would be hard for users to make out the difference, leading them to enter their credentials and being none the wiser. No word on when it will be offered to the rest of the iOS users.

If you are an iOS user, you would definitely have come across the pop up dialog above at some point.

For most users, it's impossible to differentiate between system dialogs and the phishing prompt. He also thinks that Apple should have some sort of prompt or indicate when a dialog is a system-generated one and when it is an app-generated one. Users, however, are really left with little recourse than a few tricks, like pressing the home button to see if the popoup is an official system one, in which case it will remain on screen, or a phishing attempt, in which case it should disappear. All of that using the official tools that Apple provides developer to make popups and dialog boxes. If this closes the app and the dialog, then it was a phishing attack. This freedom can be abused by showing a UIAlertController which looks just like a regular system dialog.

It's also worth noting that this type of attack would hinge on the malicious app making it through the App Store review process, and the code then being activated by the developer. Krause does however note that "organisations with bad intent will always find a way to somehow work around the limitations of a platform".



Like this

Latest


11 October 2017
How to Watch Honduras vs. Mexico
USA head coach Bruce Arena calls his team's failure to qualify for the World Cup "a blemish and a disappointment". The USA went down 2 - 1 and are not going to Russian Federation for the World Cup next year.

11 October 2017
Steady Movements: Pioneer Natural Resources Co. (PXD)
Mitchell Capital Management Co sold 19,636 shares as the company's stock declined 8.01% while stock markets rallied. The company had a trading volume of 190,896 shares. 785 are held by Cubist Systematic Strategies Ltd Liability Com.

11 October 2017
Super Mario Odyssey: Ranking All 8 Revealed Kingdoms So Far
The game is out on October 27 for the Nintendo Switch, and will be a holiday must-buy for Switch owners. Even though the hard mode was not unlocked behind the toys, Fusion Mode was the one that was unlocked.

11 October 2017
Qatar says its hosting of World Cup 'not up for discussion'
Bahrain, Egypt, Saudi Arabia and the UAE began their boycott of Qatar on June 5. Gargash's twitter attack is the second so far this week by an UAE official.

11 October 2017
IShares Trust - iShares Russell 2000 ETF (ARCA:IWM) Technicals at a Glance
Checking in on some valuation rankings, iShares Trust - iShares Russell 2000 ETF (ARCA:IWM) has a Value Composite score of 45. Narrowing in a bit closer, the 5 month price index is 1.01016, the 3 month is 1.05139, and the 1 month is now 1.02089.

11 October 2017
Alpha Cubed Investments LLC Buys 42320 Shares of Coca-Cola Company (The) (KO)
More notable recent The Coca-Cola Co (NYSE:KO) news were published by: Fool.com which released: "Best Buy: The Coca-Cola Co vs. Saybrook Cap Nc reported 0.38% stake. $3.81 million worth of The Coca-Cola Co (NYSE:KO) shares were sold by SMITH BRIAN JOHN .

11 October 2017
Red Sox manager John Farrell won't return in 2018
They were swept out of the Division Series by the Indians last season and lost 3-1 to the Astros this year. In total, his record as the manager stands at 432-378, earning three division titles (2013, 2016, 2017).

11 October 2017
United Kingdom government considers social media levy to combat online abuse
Among the options is an "industry-wide levy" that would be used to fund schemes that "raise awareness and counter internet harms". No financial figure has been mentioned and would involve consultation with the industry and other stakeholders.

11 October 2017
BMW X5 Special Edition and X6 M Sports Edition Revealed
Just like the X6 M Sport you can have the "SPecial Edition" option right across the X5 range, apart from on the M50d. Courtesy of BMW Individual, customers can opt for the Merino leather upholstery available in five color choices.

11 October 2017
BlackRock Beats Q3 Views As Investors Keep Pouring Money Into ETFs
The firm's share price was up 0.75 per cent in premarket trading at 2pm United Kingdom time. Fees from the company's index-tracking iShares rose 38 percent to $1.07 billion.



Recommended