-5

The Wall Street Journal has identified a novel form of bank password theft, that targets iPhones.

https://www.wsj.com/video/series/joanna-stern-personal-technology/an-iphone-thief-explains-how-he-steals-your-passcode-and-bank-account/C37B4009-E548-4459-8D0A-22B7400C3FEA

The attack comprises at least:

  1. Gaining physical access to the iPhone and keychain
  2. Quickly locking out owner from AppleID
  3. Taking control of accounts: email / banking / social media / photos

Assume that:

  1. Alice's cellular number is not used for banking 2FA
  2. Her email, associated with he bank is not been accessed from the iPhone
  3. Alice does not perform banking on her phone and limits it to her iPad & MacBook
  4. Bandito Bob surprises and incapacitates Alice: he opens Alice's iPhone with FaceID / TouchID
  5. All of Alice's passwords are saved in the Apple Keychain: social media / banking / email account

What countermeasures halt or slow down Bob's WSJ attack?

Improve this question
4
  • Don't type your passcode in public. That's why we have TouchID & FaceID.
    – Tetsujin
    Commented Jan 10 at 17:19
  • I get a 404 when accessing that link. Can you either provide an accessible source, or summarize the attack?
    – nohillside ♦
    Commented Jan 10 at 17:27
  • You should read this existing post that addresses this very issue.
    – Allan
    Commented Jan 10 at 18:13
  • 1
    I suppose this is preceded by a physical attack against the phone owner.
    – gnasher729
    Commented Jan 10 at 18:14

1 Answer 1

Reset to default
3

This issue relies on the thief gaining access by forcing a user to input their iPhone password while 'shoulder surfing' to get that phone password. So, the best prevention is to not type in a phone password in a very public situation. (Go to the restroom and type it in if you must).

This report has prompted Apple to aid in preventing this iPhone password and Apple ID password being changed by the thief. Apple is prepping iOS 17.3, which will feature Stolen Device Protection, that will prevent password changes in non-known locations, thus preventing a thief from changing a password before the user can report the iPhone as stolen.

For more information, read this article in The Verge.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .