Security loophole leaves Apple IDs, passwords vulnerable to easy attack

By Anna Washenko March 22, 2013

Image used with permission by copyright holder

If you haven’t already jumped on Apple’s new two-step verification system for protecting your Apple ID and iCloud, your account is at serious risk. A hole in the company’s security could let somebody change your password with just your email address and birthdate, The Verge reported. Unless you have already updated your ID to the stronger security system, you should log on as soon as possible to protect your account from hijacking. You can do so here.

Adding fuel to the fire, some Apple IDs will not be able to switch to the two-step verification for three days. That may be the case for you if you’ve recently made any significant changes to your account information, according to Apple’s FAQ on the two-step system. The Verge recommended that those people who must postpone the security upgrade change their birthdate as a stopgap measure. To do so, log in to the Password and Security section of Apple’s account settings page.

The security hole allows a hacker to paste a modified URL into the date of birth question on Apple’s iForgot page for resetting a forgotten or lost password.

This isn’t the first time this year that Apple has been targeted with security problems. Just last month, the company acknowledged that it was hacked by people who also hit Facebook. Representatives from Apple said no data appeared to have left the company in that attack. The vulnerability should serve as a reminder that no tech security system has proven unbreakable.

We assume (read “hope”) Apple is currently working on the issue, and we’ll update you when we know more.

Image via Brett Weinstein

Editors' Recommendations

Former Digital Trends Contributor

Anna is a professional writer living in Chicago. She covers everything from social media to digital entertainment, from tech…

Computing

Data recoverers finally crack the highly secure Apple M1 chip

Apple M1 chip on a motherboard.

Apple's highly secure M1 chip is a tough nut to crack, but it appears the experts at DriveSavers have finally done it. The company announced they "may be the first" to recover data from the M1 in a recent press release.

DriveSavers is confident in this because the company's engineers successfully transplanted an M1 chip from a faulty logic board to a functional one, which enables them to access the data.

Computing

The M1 has a major security loophole that Apple can’t patch

Apple M1 processor on a mainboard.

Researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) have discovered a new security vulnerability that targets Apple's popular M1 processor. The attack, dubbed PACMAN, is capable of bypassing the last line of defense against software bugs on the M1 and potentially other ARM-based processors.

PACMAN attacks pointer authentication, which is the final stop for most software vulnerabilities. Pointer authentication confirms that a program hasn't been changed in any malicious way, serving as a "safety net ... in the worst case scenario," as MIT PhD student Joseph Ravichandran put it. MIT's researchers developed PACMAN as a way to guess the pointer authentication signature, bypassing this critical security mechanism. Researchers say PACMAN exploits a hardware mechanism, so a software patch won't be able to fix it.

Computing

Researchers find new vulnerability with Apple Silicon chips

A Macbook Pro sits in the dark, illuminated by its own screen.

Researchers have released details of an Apple Silicon vulnerability dubbed "Augury." However, it doesn't seem to be a huge issue at the moment.

Jose Rodrigo Sanchez Vicarte from the University of Illinois at Urbana-Champaign and Michael Flanders of the University of Washington published their findings of a flaw within Apple Silicon. The vulnerability itself is due to a flaw in Apple's implementation of the Data-Memory Dependent Prefetcher (DMP).