News for hackers. Stuff that matters.

A comment on How my brother's iCloud account was stolen. Parent comment

Re:How my brother's iCloud account was stolen by lstamour on Monday January 16, 2023 @07:44PM (#34407683)
I can’t confirm right now if it works today, but I remember previously inserting a new SIM and having Apple ask me if I want to update my iMessage number to the new number? Actually, never mind, easier than that. All you need is unlocked access to a device that already has 2FA, it seems: https://support.apple.com/en-ca/guide/iphone/iphd709a3c46/io... (see section to add or remove a new phone number)

Feels like there’s a missing password prompt there. And maybe confirmation on a second device, if you have one.

[ Parent | on HN ]
Re:How my brother's iCloud account was stolen by collectedparts on Monday January 16, 2023 @08:12PM (#34407917)
I have to enter my password every 15 minutes that I buy something from the App Store. The change felt recent, maybe after high-profile cases of toddlers spending $$$ on in app purchases?

The fact that "I'm going to change my phone number, which is an important credential to this account" has less security than "I want to buy an app for $0.99" just goes to show you that sometimes, particular emergent properties of a system are not what any logical person would come up with deliberately.

That or someone just needs to make a big enough stink and try to get the liability shifted to Apple for negligence here on account takeovers, and they'll figure out how to change.

[ Parent | on HN ]
Re:How my brother's iCloud account was stolen by pohuing on Monday January 16, 2023 @10:19PM (#34408755)
I'm probably being too cynical. But charge backs and customer support because some kid is falling for predatory IAPs cost apple money. This? Idk
[ Parent | on HN ]
Re:How my brother's iCloud account was stolen by limitedsupply on Monday January 16, 2023 @11:36PM (#34409192)
Have you verified this information? Other comments in this thread have and are saying that changing any phone number connected to iCloud requires a password.
[ Parent | on HN ]