Exploit Allows Users to Continue to Compromise Apple Users' Passwords
March 22, 2013 3:32 PM
comment(s) - last by
All that's needed to reset a password is a user's AppleID, date of birth, and email
Apple, Inc. (
), a company
infamous for weak security
brazen arrogance regarding its safety
, has been in the spotlight for the wrong reasons of late. Its policies last year allowed
a huge hack
on Gizmodo blogger and prize-winning journalist Mat Honan, whose Apple accounts were compromised via lax password recovery features.
The hack caused Apple to embark on
a series of security changes
, which made it harder for remote users to retrieve a password that possibly wasn't theirs. The latest step was to install two-step verification, a new process that sends a code to your device.
Apple began rolling out the new two-step authentication (
users' Apple IDs
this week. Users can
Apple's 2-step ID verification.
But unfortunately Apple's own "
" tool remains online, which allows you to reset a user's password that hasn't upgraded to enable two-step validation. All that is needed is a user's Apple ID, email, and date of birth (the Apple ID arguably being the hardest to obtain, but potentially gained through phishing or other methods).
If you have a list of a person's past addresses (freely available via a variety of private investigator databases), you can get a user's Apple ID via a secondary recovery form on the page.
Use the first and last name, plus past addresses to recover the AppleId.
Use the email, recovered AppleID, and birth date to reset the password.
[Image Source: 9 to 5 Mac]
The exploit was
9 to 5 Mac
with the above description of the exploit, pointing curious folks on where to go to try it out.
In an update
reveals more bad news. The site's Chris Welch writes:
Yesterday a number of users were told they'd need to wait three days before enabling two-step verification. As a result, these accounts are fully vulnerable to the exploit. As of right now, the only surefire way these individuals can avoid the security threat is by change their birthdate on Apple's account settings page.
Changing your birthdate to a fake date would stymie users who snagged your birthdate from various public databases or social media sites like Facebook, Inc. (
9 to 5 Mac
This article is over a month old, voting and posting comments is disabled
RE: Pot calls kettle black
3/24/2013 2:54:20 PM
"there is nothing wrong with trying to rebalance the discourse around Apple which is all I am trying to do with my comments "
LOL... That sentence from you is beyond just ironic, it is a straight up
bold faced lie
(underlined because to simply call it a "bold face lie" seems far too weak of a description). Yes, thank you Tony for bring a balanced debate to the table /facepalm
If you don't like the reporting on the site, maybe you shouldn't be one of the primary people clicking on it eh? I just did a quick google and found a site that would be much more suited to your type of
"This week I got an iPhone. This weekend I got four chargers so I can keep it charged everywhere I go and a land line so I can actually make phone calls." -- Facebook CEO Mark Zuckerberg
Apple, Amazon Change Security Policies After Hack Attack on Journalist
August 8, 2012, 12:00 PM
Apple, Amazon's Weak Security Allows Huge Hack of Gizmodo Reporter
August 7, 2012, 12:28 PM
Apple to Update iTunes with iCloud Integration, Music Sharing
June 28, 2012, 5:07 PM
Kaspersky Labs: Apple's Security 10 Years Behind Microsoft
April 26, 2012, 7:39 AM
Mac Gets The Girl In New Anti-Microsoft Ad
May 13, 2009, 9:33 AM
Microsoft Gives Away iPhones to Promote Cortana's Little Sister in China
March 30, 2015, 9:59 PM
HTC's One E9+ ("A55") Unveiled, Packs Quad-HD; 1080p One E9 ("A53") Nears
March 30, 2015, 3:20 PM
HTC One M9 Plus ("Hima Ultra") w/ QHD, Duo Camera May Launch April 8
March 30, 2015, 12:36 PM
ESPN Continues to Give Windows Phone Special Attention w/ New App Makeover
March 26, 2015, 1:59 PM
NVIDIA's Latest Windows 10 Drivers: Still Too Unstable For Primetime
March 24, 2015, 4:45 PM
Samsung, Dell, Pegatron to Preinstall Microsoft Office 365 on Android Devices
March 23, 2015, 4:02 PM
Most Popular Articles
WSJ Report Implies That Google Leveraged Lobbying to Kill Antitrust Abuse Probe
March 25, 2015, 5:37 PM
Food Chemists at Italy's Barilla Claim to Have Perfect Instant Noodles w/out Frying
March 26, 2015, 4:25 PM
Apple CEO's Pledge to Give Away His Fortune is Worth More Than Face Value
March 27, 2015, 5:08 PM
Church of Scientology Buys Twitter, Facebook Space to Attack HBO Documentary
March 30, 2015, 4:27 PM
Google Readies Gmail "Pony Express" to Combat Facebook's Messenger Payments
March 25, 2015, 11:43 AM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information