The Scary New iPhone Scam You NEED to Know About

Brandon Butch

28 Mar 202408:07

Summary

TLDRA new phishing attack targeting Apple users is on the rise, known as multiactor bombing, which overwhelms victims with legitimate-looking Apple notifications. Scammers may also spoof Apple Support calls, tricking users into revealing security codes. To protect oneself, users should remove personal information from people search websites, consider using email aliases, and be aware that Apple Support will rarely initiate contact unless requested by the user.

Takeaways

🚨 A new phishing attack is targeting Apple users, exploiting a bug to hijack accounts.
🔍 The attack, known as multiactor bombing, overwhelms users with legitimate-looking Apple authentication requests.
📞 Scammers use spoofed caller IDs displaying Apple's real customer support number to trick users into revealing security codes.
🔄 Victims report continuous attacks even after changing devices, email addresses, and iCloud accounts.
🛑 Apple has acknowledged the issue and states that enabling a security key can help, but it is not a foolproof solution.
🔍 Security researcher Matt Johansson suggests the attackers are bypassing rate limits on Apple's 'forgot password' page.
🛠️ Users can protect themselves by removing personal information from people search websites and using email aliases for their Apple accounts.
📱 Changing the phone number associated with an Apple ID to a VoIP number can deter scammers, though it may disable iMessage and FaceTime.
📧 Consider using a unique email address for Apple services to avoid being affected by database leaks.
☎️ Apple support will rarely initiate contact unless requested by the user; any unsolicited communication should be treated with suspicion.
📢 Sharing information about these attacks can help others, especially those who may be less informed about online security.

Q & A

What is the new phishing attack targeting Apple devices?
-The new phishing attack is called a multiactor bombing attack. It aims to overwhelm the target with numerous authentication requests, causing them to mistakenly accept one, leading to potential account hijacking.
How do the scammers initiate contact with their targets?
-Scammers use a spoofed caller ID displaying Apple's real customer support phone number, calling the target and claiming that their account is under attack. They request a one-time code for verification, which if given, allows them to reset the password and lock the victim out.
What is the significance of the legitimate Apple alerts during the attack?
-The legitimate Apple alerts are part of the attack, sent in large numbers to pressure the target into action. These alerts are system-level notifications from Apple, which the scammers exploit to create a sense of urgency and confusion.
Victims have reported being overwhelmed by the number of notifications, sometimes over a hundred, and feeling compelled to interact with them. Some have tried to secure their accounts by changing devices or contact Apple support directly.
-One victim reported that even after taking extensive measures like getting a new iPhone, changing their email, and creating a new iCloud account, the attack persisted. Another received password reset requests even after enabling a recovery key for their Apple ID.
What is Apple's official stance on outbound calls to customers?
-Apple has stated that it will never initiate outbound calls to customers unless the customer has specifically requested to be contacted. This means any incoming call claiming to be from Apple support should be treated with suspicion.
How do the attackers bypass the rate limit on the 'Forgot Apple ID password' page?
-Attackers appear to have found a way to bypass the rate limit on the 'Forgot Apple ID password' page, which normally has a captcha to prevent mass requests. They use this vulnerability to trigger the notification attack by inputting the target's email or phone number associated with an iCloud account.
What precautions can Apple users take to protect themselves from such phishing attacks?
-Users can protect themselves by removing their information from people search websites, using email aliases, changing their account's phone number to a VoIP number, and being cautious about接听 calls or responding to messages from numbers claiming to be Apple support.
Why is it recommended to use a unique email address for Apple ID?
-Using a unique email address for Apple ID reduces the risk of it being included in any database leaks, thus minimizing the chances of being targeted by phishing attacks.
How can one verify the legitimacy of an Apple support call?
-If you receive a call claiming to be from Apple support, do not engage immediately. Instead, look up the official Apple support number and call them back to verify the legitimacy of the call.
What should you do if you suspect an Apple phishing attack?
-If you suspect an attack, deny any requests for personal information or one-time codes. Do not answer or engage with the call or message, and report the incident to Apple or the relevant authorities.
Who is most at risk from this multiactor bombing phishing attack?
-Public figures, especially those involved with cryptocurrency or hedge funds, are most at risk due to their high-profile status and the potential financial gains for attackers. However, any individual with easily accessible information or compromised passwords is potentially vulnerable.

Outlines

00:00

🚨 Apple Device Security Warning 🚨

This paragraph discusses a new phishing attack targeting Apple device users, exploiting a bug on Apple's end. The attack, known as multiactor bombing, overwhelms users with authentication requests, leading them to accept one under duress or to cease the notifications. Scammers use a spoofed caller ID displaying Apple Support's real number, tricking users into revealing a one-time code, which allows them to reset passwords, lock users out, and wipe devices. The paragraph shares real-life experiences of victims and emphasizes that these alerts are legitimate Apple system-level notifications, making the scam particularly deceptive.

05:02

🛡️ Protecting Yourself from Phishing Attacks 🛡️

The paragraph offers strategies for Apple users to protect themselves from phishing attacks. It advises removing personal information from people search websites to enhance privacy and prevent attackers from gathering data. It also suggests using email aliases and changing the phone number associated with the Apple ID to a VoIP number to reduce the risk of successful phishing attempts. The speaker shares personal experience recommending the use of a unique email for the Apple ID and emphasizes that Apple Support will rarely initiate contact unless requested by the user. The advice to verify the legitimacy of any supposed Apple support communication is highlighted, concluding with a call to action to share this information and sign up for the speaker's newsletter for further details.

Mindmap

Keywords

💡phishing attack

A phishing attack is a type of cybercrime in which attackers attempt to deceive users into revealing sensitive information, such as passwords or financial details, by posing as a trustworthy entity. In the context of the video, this attack targets Apple users, exploiting a bug to hijack accounts through overwhelming authentication requests.

💡multiactor bombing attack

A multiactor bombing attack, as detailed in the video, is a sophisticated phishing technique where the attacker overwhelms the target with a high volume of authentication requests, leading the target to mistakenly accept one and provide access to their account. This method is particularly dangerous as it leverages the user's trust in the system's notifications and the pressure to resolve the situation.

💡Apple ID

An Apple ID is a unique account identifier used by Apple users to access various Apple services such as iCloud, App Store, iTunes, and more. In the video, the new phishing attack specifically targets Apple ID accounts, exploiting a vulnerability to gain unauthorized access and control over the user's devices and personal data.

💡spoofed caller ID

A spoofed caller ID is a manipulated display of a phone number on the recipient's caller ID display, often used by scammers to impersonate a legitimate entity. In the video, attackers use a spoofed caller ID to display Apple's real customer support number, tricking users into believing the call is from official Apple Support.

💡one-time code

A one-time code is a temporary security credential that is used only once for authentication purposes, often sent to a user's device or provided by a service during account recovery processes. In the video, the attackers' goal is to obtain this code from users to reset passwords and take over accounts.

💡security researcher

A security researcher is an expert in the field of cybersecurity who investigates and analyzes potential threats, vulnerabilities, and attacks to enhance the security of digital systems and networks. In the context of the video, security researchers are studying the new phishing attack and providing insights into how it operates and how users can protect themselves.

💡rate limit

A rate limit is a restriction set on the number of requests a user or system can send to a server within a specific time frame. It is a common measure to prevent abuse or overloading of systems. In the video, the attackers have apparently found a way to bypass the rate limit on Apple's system, allowing them to send a large number of notifications to potential victims.

💡VoIP number

A VoIP (Voice over Internet Protocol) number is a phone number that is used to route calls over the internet rather than traditional phone lines. VoIP numbers can be obtained from various services such as Skype or Google Voice and offer features like call forwarding and lower costs. In the video, it is suggested as a potential security measure to change the phone number associated with an Apple ID to a VoIP number to protect against phishing attacks.

💡email alias

An email alias is an additional email address that is linked to a primary email account, allowing users to manage multiple email addresses from one inbox. In the context of the video, creating email aliases can enhance security by allowing users to create unique email addresses for different purposes without revealing their primary email address.

💡online security

Online security refers to the measures taken to protect digital systems and personal information from unauthorized access, theft, or damage. In the video, the importance of online security is emphasized as a crucial aspect of protecting oneself from phishing attacks and maintaining the integrity of one's digital presence.

💡public figures

Public figures are individuals who are widely recognized and have a high profile in society, often due to their profession, achievements, or involvement in significant events. In the context of the video, public figures are considered to be at a higher risk of phishing attacks, especially if they are involved in areas like cryptocurrency or hedge funds, where the potential financial gain for attackers is significant.

Highlights

A new phishing attack is targeting Apple users, exploiting a bug on Apple's end.

The attack, known as multiactor bombing, overwhelms the target with numerous authentication requests.

Scammers use a spoofed caller ID displaying Apple's real customer support number to trick users.

Victims are coerced into sharing a one-time code, allowing attackers to reset passwords and lock users out of their accounts.

A user reported being targeted even after changing their iPhone, email, and iCloud account.

Despite using Apple's security key for recovery, users are still vulnerable to this advanced phishing technique.

Cryptocurrency hedge fund owners are particularly at risk due to the value of their assets.

Attackers use the 'forgot Apple ID password' page to trigger the notification attack, bypassing rate limits.

The vulnerability lies in the ability to send alerts without being detected through mass request attempts.

Users are advised to remove personal information from people search websites to protect themselves.

Apple's password reset system accepts email aliases, allowing users to create unique addresses tied to one account.

Changing the account phone number to a VoIP number can offer additional protection, though with some service limitations.

Using a unique email address for Apple services can prevent inclusion in database leaks.

Apple support will rarely initiate outbound calls unless specifically requested by the customer.

Users should verify the legitimacy of calls claiming to be from Apple support by looking up the official number and calling back.

This phishing attack is particularly dangerous and evolving, affecting a broad range of potential targets.

Public figures involved in cryptocurrency are especially at risk due to the high value of their accounts.

Anyone with freely available information on people search websites or included in a database leak could be targeted.

Online security is crucial for everyone, and this phishing attack serves as a reminder to take precautions seriously.