Yesterday, The Verge uncovered a security breach that allowed malicious users to reset Apple ID passwords with nothing but an email and the user’s birthday. Luckily, the process didn’t leak out in full before the whole thing was patched up, but now iMore was able to reproduce the hack step by step and now it’s sharing details on how the whole thing worked.
As iMore explains:
Normally the password reset process has 6 steps:
1. On iforgot.apple.com, enter your Apple ID to begin the process.
2. Select an authentication method – “Answer security questions” is the one we would use.
3. Enter your date of birth.
4. Answer two security questions.
5. Enter your new password.
6. Be taken to a success page saying your password has been reset.What should happen in a process like this is that each step can only be performed once all of the steps before it have successfully been completed. The security hole was a result of this not being properly enforced in Apple’s password reset process.
It turns out that step four, when properly completed, would generate a complex URL something along the lines of:
https://iforgot.apple.com/iForgot/resetPassword.html?forceBetterPlusPasswordRules=true&password=NEWPASSWORD&aolParameter=false&borderValue=true&confirmPassword=NEWPASSWORD&findAccount=false&myAppleIdImageURL=https%3A%2F%2Fappleid.apple.com%2Fcgibin%2FWebObjects%2FMyAppleId.woa%3Flocalang%3Den_US&appendingURL=&urlhit=false&accountName=johnny%40apple.com
And while these URLs are supposed to be generated only after answering security questions, they could be effectively hacked together by performing a reset on your own password, collecting the data and tweaking it just slightly for someone else’s account, thereby letting hackers skip straight from step three to step five.
The security hole is all patched up now, and there’s no evidence to suggest it was ever exploited in the wild, but it’s always fascinating to see how these kind of breaches work. And if you needed just one more reason to go turn on two-step verification, this ought to be it. Let’s hope it’s a long time before something like this pops up again. You can check out iMore to learn more about the specifics. [iMore]