We all know very well that all the iOS users are accustomed to receiving system notifications that, outside of the settings zone, ask the user to authenticate with their Apple ID, thereby again gaining access to the App Store, iCloud, or other Apple services. But, beware, this could be very dangerous.
Even with all the protections and precautions, many users are there who reveal sensitive data without the notion that they are delivering it to attackers or malicious programmers.
Most of the time, these phishing scams work surprisingly fast and users do not even realize they’ve been cheated. A new method of credential theft has now come to the public and affects iOS.
iOS users are accustomed to receiving system notifications that, outside of the settings zone, ask the user to authenticate with their Apple ID, thereby again gaining access to the App Store, iCloud, or other Apple services.
It is no wonder that they trust and put their passwords without questioning their origin. The truth is that, unknowingly, they may be providing data to attackers.
It was programmer Felix Krause who brought this to the public and demonstrated that within iOS is all that these attackers need to simulate a system notification box, which can then be used to request the password for the Apple ID account of the user.
According to Krause, 30 lines of code suffice to create this false authentication request, and Apple itself provides information in its documentation on how to do so. Given the sensitivity of this problem, Felix Krause chose not to reveal the code.
How this phishing attack comes
In fact, this way of using iOS notifications to attack users is not new and has been known for some years, with Apple having a very active validation in the new applications submitted to the App Store. However, it is important to alert users to this problem and especially to the risks they are exposed to.
Even with all the protections and precautions, many users are there who reveal sensitive data without the notion that they are delivering it to attackers or malicious programmers.
Most of the time, these phishing scams work surprisingly fast and users do not even realize they’ve been cheated. A new method of credential theft has now come to the public and affects iOS.
iOS users are accustomed to receiving system notifications that, outside of the settings zone, ask the user to authenticate with their Apple ID, thereby again gaining access to the App Store, iCloud, or other Apple services.
It is no wonder that they trust and put their passwords without questioning their origin. The truth is that, unknowingly, they may be providing data to attackers.
 |
| The phishing attack to steal access to Apple ID |
It was programmer Felix Krause who brought this to the public and demonstrated that within iOS is all that these attackers need to simulate a system notification box, which can then be used to request the password for the Apple ID account of the user.
According to Krause, 30 lines of code suffice to create this false authentication request, and Apple itself provides information in its documentation on how to do so. Given the sensitivity of this problem, Felix Krause chose not to reveal the code.
How this phishing attack comes
In fact, this way of using iOS notifications to attack users is not new and has been known for some years, with Apple having a very active validation in the new applications submitted to the App Store. However, it is important to alert users to this problem and especially to the risks they are exposed to.
How to protect against this attack?
Users can protect themselves very simply. Just press the Home button to close the app that is being used and if it disappears, it is false. If staying then it is real and reliable. It is also recommended that you close the notification and put the password in the Settings zone.
Users can protect themselves very simply. Just press the Home button to close the app that is being used and if it disappears, it is false. If staying then it is real and reliable. It is also recommended that you close the notification and put the password in the Settings zone.
Tags:
hack