Apple Online Store Security Flaw Exposed PINs of T-Mobile Customers

[MacRumors]

A security flaw in Apple's online store exposed the account PINs of more than 72 million T-Mobile customers, reports BuzzFeed News.

The vulnerability was discovered by security researchers Phobia and Nicholas "Convict" Ceraolo, who also found a similar flaw in the website for phone insurance company Asurion that exposed AT&T account PINs.

Both Apple and Asurion fixed the website flaws that left the PINs vulnerable after learning about them from BuzzFeed News. Apple opted not to provide further comment on the situation, but told BuzzFeed News that it is "very grateful to the researchers who found the flaw."

The page on Apple's site that let hackers brute force PINs, via BuzzFeed News​

PINs, or passcodes, are numbers that are used as an additional account security measure by many carriers in the United States. Mobile device PINs are typically a last line of defense for a cellular account as both carrier websites and support staff will ask for the PIN for confirmation before making account changes.

SIM hacking, which uses social engineering to get carrier support staff to transfer a person's phone number to a new SIM, has become increasingly prevalent due to the number of accounts (bank, email, social media, etc.) that are tied to a person's phone number. A PIN is used as a defense mechanism against SIM hacking, which means exposed PINs can be particularly dangerous.

Accessing the T-Mobile PINs on Apple's website involved a brute force attack where a hacker used software to input multiple different numeric combinations to guess the proper one.

As BuzzFeed News explains, after initiating a T-Mobile iPhone purchase on the Apple online store and selecting monthly payment options through T-Mobile, Apple's site directs users to an authentication form asking for a T-Mobile number and account PIN or last four digits of a social security number (which most carriers use in place of a PIN when one has not been set).

The page allowed for infinite entry attempts into the PIN field, enabling the brute force attack that let hackers guess PINs associated with a T-Mobile phone number.

The security vulnerability appears to have been limited to T-Mobile accounts, as the same validation page for other carriers on Apple's site uses a rate limit that locks access to the form for 60 minutes after five to 10 incorrect entries. Given that the other carrier pages had rate limiting enabled, it's likely Apple made an error on the T-Mobile page.

According to Ceraolo, the vulnerability is likely due to an engineering mistake made when connecting T-Mobile's account validation API to Apple's website.

A similar vulnerability on Asurion's website exposed an unspecified number of AT&T account PINs. An AT&T spokesperson said that it is working with Asurion to investigate the issue and will "take any additional action that may be appropriate."

A phone number was required for both of these attacks, limiting the number of people who may have been impacted, but AT&T and T-Mobile customers who are concerned about their account safety should choose a new PIN.

Article Link: Apple Online Store Security Flaw Exposed PINs of T-Mobile Customers

 

[mistasopz]

But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.

 

[oliversl]

And so it begins ...

 

[zakarhino]

Security issue after security issue for T-Mobile and many carriers in general. Remember when T-Mo Germany said they don't need to salt their passwords because their security is "that good"? Or when it was discovered that it's very easy to get access to a T-Mo account AND clone people's sims because T-Mo doesn't have very good security practices beyond asking for the last 4 of your SSN? I've heard stories of people phoning up carriers under the guise of being a store employee and they get access to all sorts of information without thorough identity verification!

I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.

 

[iapplelove]

Pin for what?

I just have a username and password for AT&T.

Edit/ AT&T calls it a passcode.

 

[Doctor Q]

Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.

It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.

If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.

 

[nvmls]

Squeeze that privacy/security coin Timo!

 

[Naraxus]

Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.

 

[RoobyRoobyRoo]

But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.

Having the best security =/= flawless security. No tech company is completely flawless. But go ahead and chastise Apple for not being absolutely perfect, because that's so productive.

 

[Apple_Robert]

Even though the fix is in place, I went ahead and changed my PIN again.

Things like this are frustrating. At the same time, most of us informed nerds and geeks realize that any time one creates an account online, there are security risks. As noted earlier, nothing in the tech world is 100% safe forever.

 

[ghostface147]

Having the best security =/= flawless security. No tech company is completely flawless. But go ahead and chastise Apple for not being absolutely perfect, because that's so productive.

Except they had the right security for the other carriers, but forgot to apply it to T-Mobile.

 

[Darmok N Jalad]

Since it only affects T-Mobile, couldn’t that mean it’s a them problem and not Apple? Seems like both companies would need to collaborate in this situation—Apple’s site would have to reference a T-Mobile server, right? And T-Mobile just got hacked a few days ago.

 

[dilbert99]

I though Apple didn't share your private information with anyone

Remember the kind of scandal when Yahoo! or any high street shop lost 78million records...

How will the fanboys spin this one?
[doublepost=1535157037][/doublepost]

Smh. Another day another Micro, I mean Apple software security bug. Wtf is Craig Federighi getting paid for? I can actively remember when these types of Apple software screwups didn't happen.

It did happen, its just the bigger you get, the more scrutiny you get. Not detecting it didn't mean the bugs/flaws were not there, just that not as many people were looking.

 

[Starfyre]

It's like it would have been better to just not set any passcode at all.

 

[DailySlow]

Thanks I like numbers

Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.

It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.

If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.

Y

 

[citysnaps]

But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.

Nice... You clearly believe that *perfection* and unbeatable security is the norm across the full breadth of a company's products and services. Similar to what other large companies such as Microsoft, Adobe, Samsung, Motorola, Google, Facebook, and thousands of other large companies afford their customers. Right? Because you freely trash other companies for similar incidents, right?

Perhaps you can list just one or two companies that have such a wide breath of software the public interacts with in some manner, likely amounting to billions of lines of code collectively, that you believe have verifiable track records of 100% security perfection?

 

[bruinsrme]

ATT customers are far from safe.
Strongly recommend you verify the following;
authorized users
Pin
Notification of account changes enabled.

This stuff is big business. Those invovled are not amateurs and the network to get their hands on phones is huge.

If I am not mistaken, the interface Apple uses is an extension of the carrier approved interface. I believe when you select tHe carrier the the proceeding information is driven by the carrier.

 

[bgro]

“It Just Works”

 

[Elwe]

Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.

It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.

If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.

True. However, as someone who has had to put some policies in place around passwords and PINs, I would say two things: first, you describe is no real barrier for a very targeted attack. It is not practical for hundreds of thousands or millions of users. Every carrier that I know of already has a "VIP" policy for certain individuals, if you know what and how to ask for it, to address this. It usually involves having to go into a store and prove a couple of things before your are allowed to make certain changes. Definitely not scaleable.

Second, and perhaps more important . . . recently when I forced a key platform I oversee to change to longer and more complex secrets, I got so much push back you would not believe. Some from people who should know better. Three from the most senior people in the organization. I am not saying I did not push it through anyway, but there is a very real issue of security vs ease-of-use that anyone dealing with such will eventually have to deal with. Since only one person in the organization could overrule me, I had more power than most in this situation. And that person really does not see the need beyond theory, though happens to trust me that I know my area, and my people do not make such changes just "because".

Funny, though sad . . . we knew we would see something like this pushback, but on the PIN side, we made it six digits like Apple's minimum on the phone. We told people if they could get use to it on their phones, they should stop complaining. We really wanted eight digits or to have six with enforced alphanumberic combination. . . At the end of the day, though, one of the senior admins . . . who knows our people well, it seems . . . just told everyone she worked with to use their cell phone numbers. She publicly admitted to telling people to do this. She did not see it as an issue, and when one of my people spoke with her, she said that it was either do this or just have to accept that people are going to write it down. Six digits minimum (without allowing certain repeat patterns) was just too much to ask of people. I then decided to speak to her myself and I told her I would enforce rotation, and she just said "good luck with that". She is intelligent, so she knew there was some risk--she just did not think the risk was high enough to inconvenience people. And since there is no financial penalty that will directly accrue to most people, so most just cannot be bothered to care in the least.
[doublepost=1535160282][/doublepost]To end the above "old man rant" about security . . . I am becoming quite the fan of good facial recognition being on a lot more devices. I'll accept that, or that plus a short PIN for the vast majority of things.

 

[mi7chy]

Apple don't care about security because even after several security incidents customers are brain washed into thinking Apple is flawless.

 

[alien3dx]

Four digits isn't a very long PIN. Even if the software now locks access to the form for 60 minutes after five to 10 incorrect entries, it doesn't block the exploit, just slow it down.

It seems to me that a bot could try 10 guesses for one phone number, which would lock the form for that phone number, then immediately switch to another phone number. If the phone number is locked for the IP address, it could use another IP address too.

If so, let's try a little math here: Rather than a bot trying one phone number and 10,000 different PINs in rapid succession to break it, it could try five to ten PINs for every phone number it's working on in the first hour, then try another five to ten PINs for every phone number in the second hour, and so on. In as few as 42 days it could crack every phone number. If it was trying to crack 10,000 phone numbers, it would succeed on an average of 238 phone numbers per day. That's still pretty vulnerable.

as software developer sometimes jumping job , you will know how horrible company handle security and cheapskate to paid salary.

Conclusion
if you pay peanuts, you get monkeys

 

[Marekul]

Since it only affects T-Mobile, couldn’t that mean it’s a them problem and not Apple? Seems like both companies would need to collaborate in this situation—Apple’s site would have to reference a T-Mobile server, right? And T-Mobile just got hacked a few days ago.

 

[FelixDerKater]

Doubling down on pins...and needles.

 

[DeepIn2U]

Squeeze that privacy/security coin Timo!

But but ...

But forum members told me that Apple had the best security. Well except for those times when they didn't. Like the root password gate where you didn't have to put a password in to gain root access.

Lol. In my opinion the person, specific team, and definitely te head of OSX should’ve been CANNED for such a blatant pathetic oversight and mistake! The head of OSX’s sole responsibility other than leading the team is to check for significant holes in the OS and then sign off.

Should’ve shaved Federighi’s head bald just before WWDC!

Harsh but would’ve been funny to have 2 baldies in the executive staff lol.

 

[69Mustang]

Security issue after security issue for T-Mobile and many carriers in general. Remember when T-Mo Germany said they don't need to salt their passwords because their security is "that good"? Or when it was discovered that it's very easy to get access to a T-Mo account AND clone people's sims because T-Mo doesn't have very good security practices beyond asking for the last 4 of your SSN? I've heard stories of people phoning up carriers under the guise of being a store employee and they get access to all sorts of information without thorough identity verification!

I know Apple are the guys that purportedly screwed up here but when you look at T-Mobile's security in general, it doesn't have a very good track record, it should have never been possible for the Tmo verification API to allow unlimited requests without a time limit. These carriers need to seriously update their security practices. Just accepting the last 4 digits of your social security number is no longer a viable option.

Are you really serious? You typed a hundred and sixty+ words and dedicate 10 of those words to the culpable party. Not only that, you try to cast doubt on that culpability with "purportedly". Apple acknowledged the issue, fixed it quickly, and said thanks for bringing it to their attention. That's fairly cut and dried. What you did there... yeah, not a good look. TMo has it's own issues that deserve scrutiny and criticism. They're not to blame on this issue and Apple doesn't need you to deflect the blame for their mistake onto TMo. Apple owned it and fixed it PDQ... without the whataboutism.