iPhone thief explains how he breaks into phones [video](youtube.com)

19 pointsby saikatsgvor 3 Jahren35 comments

iPhone thief explains how he breaks into phones [video]

https://www.youtube.com/watch?v=gi96HKr2vo8

38 comments

> "I was homeless, started having kids, needed money"

> "I'm here [in prison] because I got too carried away"

Arrested for getting passcodes through trickery and violence.

That said, this report makes a good point:

* Johnson would quickly replace the passcode and then replace FaceID with his face

* He could then get into PayPal, Venmo, etc via (his) FaceID

* He could make ApplePay transactions at physical stores, again using FaceID

So, device PIN = all you need to get into all finance apps (if FaceID was enabled for them)

> "Johnson made $20,000 per weekend from selling the stolen phones"

> "I wish I had not been so greedy and just got what I got and changed my life"

> "When you get out, will you forget about this trick?"

> "There's gonna be new tricks out"

cassianolealvor 3 Jahren

Yeah this is pretty glaring.

Changing the biometrics should automatically invalidate all FaceID tokens and block falling back to device PIN. It should effectively log the device out of all services, perhaps even delete browser cookies etc. since it should mean the person holding the phone is not the one who logged on to those.

Of course, this could have other implications so a lot of care has to be taken when designing and implementing this.

snotrocketsvor 3 Jahren

It does get invalidated if the app use the right api call: https://developer.apple.com/documentation/localauthenticatio...

cassianolealvor 3 Jahren

Therein lies the problem, I guess. How is it left to the application developer to implement this properly? As a user of the device, I expect biometrics (a feature of my platform of choice) to behave consistently.

snotrocketsvor 3 Jahren

Not all threats scenarios are the same. The problem is that there's very little in the way of forcing the app developers to accept liability if they misjudge the threat scenario (a notable exception are banking apps in the US)

eastonvor 3 Jahren

Microsoft’s apps use this (although, sometimes it gets triggered even if I didn’t change my biometrics).

yunohnvor 3 Jahren

All banking and finance apps I use have this correctly setup.

Tommsteinvor 3 Jahren

Android appears to do something like this with fingerprints (or at least enable it). Whenever I add a new one, apps stop accepting fingerprints until I enter my password/passcode/whatever in each one.

cassianolealvor 3 Jahren

That's ok but in this case it won't help since the attacker already has the phone's passcode.

Tommsteinvor 3 Jahren

If each app has its own password/passcode that you can bypass with your fingerprint, and fingerprints suddenly stop working, it absolutely does shut down the thief, unless you also use the phone's passcode for all your accounts.

cassianolealvor 3 Jahren

Oh I see. On the iPhone though, FaceID / TouchID are the same as the passcode - at least in the sense that if the biometrics fail, they fall back to the passcode.

This means that if you enable log in with biometrics, you’re essentially enabling the fallback along even if the app has a separate PIN/passcode.

Shadowmistvor 3 Jahren

I just tried it on my iPhone with a banking app and it shows me the default login screen for the bank and then logs me in if my face is there, but without the face it just stays on the login screen waiting for me to enter the bank password, never asks for a PIN.

cassianolealvor 3 Jahren

Huh, I just tried this with a couple of my bank apps and they do the same. I guess either I'm misremembering this, or it got fixes along the way.

Wallet is still accessible with the device passcode as a fallback though, which means quite a lot of damage can still be done.

pestsvor 3 Jahren

The fallback is the service account password, not the local device PIN.

ajdudevor 3 Jahren

I have never enabled FaceID (or even TouchID) on my phone, primarily because I feel like a password should be something you know and biometric data is something you have (or something you are?)

I always wondered if I should do it for convenience every time I open one of my banking apps, which always requires me to login again.

This has convinced me never to use such a thing, and I'm glad I've stood my ground.

tropxyvor 3 Jahren

but how is that going to prevent it from happening?

if they can get the code from you, that is as good as having your face id and they can access everything..

ajdudevor 3 Jahren

Because having the code my phone still doesn't get them into my banking applications which have passwords that I have to sign into.

I also don't use Apple's password manager so they would have to know another master password to access the passwords for my apps

[deleted]vor 3 Jahren

pestsvor 3 Jahren

Banks have their own passwords and do not rely on secie PIN. If you change the auth settings the bank apps fall back to their own password.

akievor 3 Jahren

but he concludes with

> "...and I don't want nothing to do with it"

[deleted]vor 3 Jahren

ofrzetavor 3 Jahren

He "broke into the phones" by using social engineering to get the PIN.

c0piumvor 3 Jahren

And I bet it’s super effective. Adversary goals are not generally to do something cool, they’re to do the easiest possible thing that works.

noodlesUKvor 3 Jahren

There are a few things that I wish I could change which would improve my personal security posture massively:

1. When advanced data protection is turned on, it should not be possible to change the Apple ID password without the associated hardware tokens.

2. Again when advanced data protection is on, it should require the hardware tokens to add a Face ID appearance or change the device passcode.

slaynevor 3 Jahren

I mean, how Apple is letting someone change my Apple ID password just by knowing my iPhone pass code, that's insane.

What's the point of having an Apple ID password if you can change it with the phone pass code ? It just bother the regular users to have 2 passwords to remember, but adds no security whatsoever...

rawgabbitvor 3 Jahren

Apple says you are supposed to set a second PIN under screen time to prevent Account Changes.

fingerlocksvor 3 Jahren

Did you try this to confirm it’s even true? It takes 5 seconds, just try it. Because I did. My iPhone prompted me for my password in addition to the PIN.

Maybe we shouldn’t take this article at face value.

wannacboatmovievor 3 Jahren

In the time it took you to type out that snarky response I did in fact try it and it allows it under the following conditions:

1. you have a passcode set

2. you are logged into iCloud.

1 & 2 are true for nearly everyone so sounds like yes this is still a problem.

Tactical45vor 3 Jahren

Likely been already fixed as a result of issues like these.

asylteltinevor 3 Jahren

Anything actually technical here? I’m always skeptical of legacy media reporting on tech

mcgeezvor 3 Jahren

Well more of a product/security matter here. The amount of access that an unlocked device gets you is nuts. I didn't expect to be able to reset an apple id password with a device pin code.

xethosvor 3 Jahren

I'm not sure it matters - it's not a technical-heavy flaw in Apple's security. He either recorded people putting in their unlock codes, or straight up asked them what it was. The reporter doesn't have to be very technically-minded to follow.

asylteltinevor 3 Jahren

Ah well where’s the hack then? I assumed it was going to be their typical click bait and was right. Accessing someone’s data with an unlocked phone isn’t hacking at all.

sgerenservor 3 Jahren

I think most people wouldn’t expect it to be possible to disable iCloud and turn off remote wipe with just the device passcode.

[deleted]vor 3 Jahren

david_allisonvor 3 Jahren

Nothing

notzanevor 3 Jahren

https://xkcd.com/538

rational_indianvor 3 Jahren

Moral of the story buy Android when everybody else has an iPhone.