iOS Flaw Makes it Easier than Ever to Steal Your Apple ID

Apple’s iOS is widely recognised as one of the most secure mobile operating systems on the market today but is that really true? Well, maybe it is, but what I can tell you for sure is that nothing is unhackable in today’s world.

A security researcher claimed that it is now easier than ever to get hold of any iPhone or iPad user’s Apple ID account with a simple HTML injection. The security specialist claims to have built a tool that would allow just about anyone to make use of a well-known flaw in an Apple’s iOS Mail app and trick the user into giving his or her Apple ID credentials.

The tool mentioned above is said to create an HTML popup that mimics Apple’s own popup that asks you to re-enter your Apple ID credentials. As a regular iPhone user, you are likely to be so used to it that you won’t notice the difference and just type in your credentials as usual.

Once you tap OK on the popup, the credentials are sent to the hacker’s remote server. This likely puts everyone using an iPhone or iPad at risk, so do take care and remember that the Apple ID prompt appears only when you perform an action that requires your authorisation and not just out of the blue.

The issue is said to have been filed and acknowledged by Apple, but no fix has been released just yet. So how worried are you? Will you think twice before entering your Apple ID credentials?

Thank you BGR for providing us with this information

Credentials May Become Compromised via Old Windows Vulnerability from the ’90s

Nobody wants their private information shared on the internet, but we live in an era where everything that’s connected to the internet may eventually become public. This is the case of an old Windows vulnerability from the ’90s, which still poses a security threat according to security specialists.

Brian Wallace, a security researcher from Cylance, has been reported to have found a new way to exploit a vulnerability that was previously found in 1997. He stated that the flaw can be used on any Windows OS-powered device, may it be a tablet, PC, server or laptop, and can be used to potentially exploit and compromise around 31 programs.

The vulnerability that goes by the name of Redirect to SMB is said to be exploited by intercepting communication with a Web server using the man-in-the-middle approach. This in turn redirects all traffic to the malicious SMB server, which supposedly collects sensitive information such as usernames, passwords, credit card information or other things users type in.

There are some limitations to the technique though, as Wallace pointed out. The attacker needs to be on the same network as his victims and the attack can easily be prevented by blocking outbound traffic to the 139 and 445 TCP ports. But let’s be honest, who is going to do that? I mean most people don’t even change their default router credentials, let alone go into its settings and block traffic to specific ports.

Microsoft is said to have not made an official statement regarding the matter, but Wallace’s findings have been revealed at the Computer Emergency Readiness Team at Carnegie Melon University. With all this snooping around that’s been going on lately, how secure do you feel? Or is that even a matter of concern at this point?

Thank you PCWorld for providing us with this information

Image courtesy of High Performance Laptops

Thousands of Uber Accounts Are Said to Be Selling on the Dark Web

At least two vendors on the dark web marketplace named AlphaBay are allegedly selling Uber accounts. The accounts are said to let buyers order trips using whatever payment method attached to the accounts, while also providing them with the full trip history, email addresses, phone numbers and even location information of people’s home and work address stored on the accounts.

The price for such an account is said to be as low as $1, but it could get to $5, a price that won’t even get you around the block with a taxi. One of the sellers is said to have sold over 100 accounts to other buyers, but a lot more accounts are estimated to have been sold by now.

“We investigated and found no evidence of a breach,” a Uber spokesperson told The Verge. “Attempting to fraudulently access or sell accounts is illegal and we notified the authorities about this report. This is a good opportunity to remind people to use strong and unique usernames and passwords and to avoid reusing the same credentials across multiple sites and services.”

The method used to acquire the accounts is not yet clear, but this comes after Uber disclosed the information about 50,000 of its drivers had been accessed by a third-party in May. The latter might indicate that a security breach might have been found in the company’s system and exploited to get access to user’s account credentials.

However, Uber stated that the breach did not affect user names and suggested that the information leaked to the third-party is unrelated to the stolen user credentials currently selling on the dark web.

Thank you The Verge for providing us with this information