Print 43 comment(s) - last by MaulBall789.. on Mar 29 at 9:56 AM

All that's needed to reset a password is a user's AppleID, date of birth, and email

Apple, Inc. (AAPL), a company infamous for weak security and brazen arrogance regarding its safety, has been in the spotlight for the wrong reasons of late.  Its policies last year allowed a huge hack on Gizmodo blogger and prize-winning journalist Mat Honan, whose Apple accounts were compromised via lax password recovery features.  

The hack caused Apple to embark on a series of security changes, which made it harder for remote users to retrieve a password that possibly wasn't theirs.  The latest step was to install two-step verification, a new process that sends a code to your device.

Apple began rolling out the new two-step authentication (FAQ) for users' Apple IDs this week.  Users can go here to apply.

Apple two step
Apple's 2-step ID verification.

But unfortunately Apple's own "iForgot" tool remains online, which allows you to reset a user's password that hasn't upgraded to enable two-step validation.  All that is needed is a user's Apple ID, email, and date of birth (the Apple ID arguably being the hardest to obtain, but potentially gained through phishing or other methods).  

If you have a list of a person's past addresses (freely available via a variety of private investigator databases), you can get a user's Apple ID via a secondary recovery form on the page.

Step 1: Use the first and last name, plus past addresses to recover the AppleId.

Step 2: Use the email, recovered AppleID, and birth date to reset the password.
[Image Source: 9 to 5 Mac]

The exploit was first reported/validated on by The Verge.  9 to 5 Mac went live with the above description of the exploit, pointing curious folks on where to go to try it out.

In an update The Verge reveals more bad news.  The site's Chris Welch writes:

Yesterday a number of users were told they'd need to wait three days before enabling two-step verification. As a result, these accounts are fully vulnerable to the exploit. As of right now, the only surefire way these individuals can avoid the security threat is by change their birthdate on Apple's account settings page.

Changing your birthdate to a fake date would stymie users who snagged your birthdate from various public databases or social media sites like Facebook, Inc. (FB).

Sources: Apple, 9 to 5 Mac, The Verge

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

By kmmatney on 3/22/2013 4:06:43 PM , Rating: 2
Wouldn't they still need access to your email account to get the reset password? And wouldn't you be notified that the password has been reset?

RE: ??
By Shadowself on 3/22/2013 4:47:02 PM , Rating: 2
Not really. If you are an user with an Apple ID account (iCloud, iTunes, etc.) and have not yet set up the two stage verification, then no code will be sent to you so you can do the reset. You still fall under the old system. If you can convince an Apple help desk employee to reset the password or you have the information outlined above you can independently reset anyone's password. The owner of the account still gets an email to the setup email address (until you change that too!).

The thing Apple needs to do is make the sign up simpler and eliminate any lag between starting the setup and completion (three days to complete the process is truly asinine). Then Apple needs to advertise this to ALL Apple ID users -- over and over and over again. I'd bet that less than 10% of the people with Apple IDs even know that this two stage process exists and has a potential benefit to them.

I'm not sure I'd go so far as to say Apple needs to give users XX days and then lock them out until they set up their two stage authentication, but that wouldn't be a bad idea.

RE: ??
By CeriseCogburn on 3/23/2013 2:47:16 AM , Rating: 1

The ship is sinking...

LOL - the next product will be a good joke.

The appletards are "demoralized" and getting kicked when they're down...

Maybe they should build a state of the art mega million dollar hacking "antenna feeler" facility to see whose fingers are getting in the way... oh wait... they surely did that now we just need the ghost of Steve Jobs to explain all that and how cracked accounts are not really that because they spent so much special money in a gigantic super superior way to make it the most secure eva' !

"You can bet that Sony built a long-term business plan about being successful in Japan and that business plan is crumbling." -- Peter Moore, 24 hours before his Microsoft resignation

Latest Headlines
Inspiron Laptops & 2-in-1 PCs
September 25, 2016, 9:00 AM
The Samsung Galaxy S7
September 14, 2016, 6:00 AM
Apple Watch 2 – Coming September 7th
September 3, 2016, 6:30 AM
Apple says “See you on the 7th.”
September 1, 2016, 6:30 AM

Most Popular ArticlesAre you ready for this ? HyperDrive Aircraft
September 24, 2016, 9:29 AM
Leaked – Samsung S8 is a Dream and a Dream 2
September 25, 2016, 8:00 AM
Inspiron Laptops & 2-in-1 PCs
September 25, 2016, 9:00 AM
Snapchat’s New Sunglasses are a Spectacle – No Pun Intended
September 24, 2016, 9:02 AM
Walmart may get "Robot Shopping Carts?"
September 17, 2016, 6:01 AM

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki