There is a phishing to steal a password by issuing a fake dialog of iOS, measures for not being deceived are



A survey by experts has revealed that a dialogue "occasionally appearing on iPhone and other screens" Please enter your password "can actually be imitated by a third party with a very simple method. If this method is exploited, there is a high risk that the user's iCloud password will be easily stolen at the same time, but at the same time it is clear how to find a fake dialog in a simple way.

iOS Privacy: steal.password - Easily get the user's Apple ID password, just by asking - Felix Krause
https://krausefx.com/blog/ios-privacy-stealpassword-easily-get-the-users-apple-id-password-just-by-asking

Watch Out! Difficult-to-Detect Phishing Attack Can Steal Your Apple ID Password
https://thehackernews.com/2017/10/apple-id-password-hacking.html

This issue was released as an iOS developer, and the application creation support tool "fastlane"Felix Krause of the start upper who developed". The following captured image is a sample of the password confirmation dialog created by Mr. Krause, but it can be totally at the real dialog displayed by iOS (left) and the dialog of fake imitated by a certain method (right) You can see that there is no difference as much.


This dialog can be interrupted even on the home screen or the screen during application start up.


Also, you can see that the pattern dialogue in which the e-mail address of the account is not displayed is also displayed as if it is genuine.


The dialog for asking for the password of the account is often displayed often when updating iOS or when changing the password, and for iPhone users there should be some people who have been experiencing losing the word "come back again" . As you can tell, "Okay, I understood (anger)" as you tend to enter your password, but you also need to know that there is a possibility that a dialog will be displayed with such a signature. This behavior can be reproduced by using the iOS class "UIAlertController", but Krause makes the technique of actually displaying this dialog for security reasons undisclosed.

It is a fake dialogue that seems to be very difficult to judge from the exterior probably even by experts because it is too genuine and so sorry but in reality Mr. Krause will also disclose a method to find out that it is a fake in a simple way It is. that is,"When the dialog is displayed, try pressing the Home button"something like. If it is a dialog displayed by iOS, it will be displayed on the screen as it is, but if it is a fake dialogue, pressing the home button will disappear and return to the home screen. This seems to be a difference that is caused by different internal processes of the dialog display, but if such a confirmation dialog is displayed in the future, it seems good to push the home button first.

in Mobile,   Software,   Security, Posted by darkhorse_log