Criminals are apparently currently abusing Apple's password reset process to gain access to iCloud accounts. Users report that they are suddenly receiving numerous password reset messages on their iPhones and other Apple devices. “Use this iPhone to reset your Apple ID password” is the content of the message, as KrebsonSecurity reports. Those affected can only respond to the message with “Reject” or “Allow”. Sometimes dozens of such messages arrive one after the other, say users from the USA.
Advertisement
Victims annoyed by push notifications
The scammers' actual trick follows with a call that pretends to come from a (real) Apple support number. The alleged support employees then ask for a one-time code that is sent to the victim when the password is reset. If you pass on the code, the attacker can apparently set a new password for the Apple ID or iCloud account and thus take it over.
The attack relies on the victim being annoyed by the many messages and then handing over the one-time code to the supposed support employee without thinking twice. Such attacks are also known as push-bombing attacks or “MFA Fatique” – exhaustion through multiple multi-factor authentication requests.
Bug in Apple's password reset method?
The method only works if the attacker knows both the victim's Apple ID and the mobile phone number stored for the Apple account. Accordingly, this is likely to be used primarily against individual people. A company founder described the process on X/Twitter, and the attacker also tried to access further information from commercial personal databases. It remains unclear whether the attacks will also take place on a larger scale in Germany or Europe. It is also still unclear whether there is a bug in Apple's password reset process on the web that makes the numerous, annoying push notifications possible in the first place.
(lbe)