Phishing on the iPhone

The bad people are at it again.

This time, it is "phishing" <https://en.wikipedia.org/wiki/Phishing> on the iPhone--attempts to get you to give them your Apple account credentials. For clarity: This is not malware residing on your device; it is a message that came in piggyback with something else.

Occasionally, iPhone (or any iOS device) will need your credentials (ID and password), and will make its request by putting up a "slip" containing the notification. You may be able to dismiss without complying, but the request would return the next time the OS needed access to Apple services. We become accustomed to just doing what is needed without thinking about context--and this is what the jerks are counting on. They display such a request (looking more or less identical to the legitimate one), and we pass them our credentials (username and password).

The article below suggests that such request be dismissed immediately, but then one should go to System Settings to see if the request is there--and if so only there to supply the password being requested.

This would be similar to our _not_ using the convenient link in e-mail from [someone posing as] a bank; instead we use the links previously stored in our Contacts address books.

<https://krausefx.com/blog/ios-privacy-stealpassword-easily-get-the-users-apple-id-password-just-by-asking>

I hope this helps.

Mark_ 

15 October 2017 21:46 

Apple ID - Hacked

A few days ago, it was reported that a hacker group was claiming that they had obtained millions of Apple's user credentials: both usernames and passwords, apparently.

<http://bgr.com/2017/03/22/apple-iphone-and-icloud-accounts-hacked/>

<https://www.macrumors.com/2017/03/22/apple-responds-to-hack-threats/>

<https://motherboard.vice.com/en_us/article/hackers-we-will-remotely-wipe-iphones-unless-apple-pays-ransom>

<http://www.pcworld.com/article/3184476/security/leaked-icloud-credentials-obtained-from-third-parties-apple-says.html>

<https://www.theregister.co.uk/2017/03/22/supposed_apple_breach_ransom_threat/>

<http://www.zdnet.com/article/apple-icloud-ransom-what-you-need-to-know/>

We are advised to enable _two-factor authentication_ for login to Apple's services (iCloud, etc.).

Oddly, as of Friday morning 24 March 2017, a day or so after the hack was announced (and some allegedly stolen IDs confirmed), Apple's web site seems completely silent on the subject.  It is worth noting that in other places Apple has denied that _it_ was hacked; speculated that the materials came from elsewhere.

Even so, bad enough.  The suggestion is that users engage _two-factor authentication_ (2FA), which means that each time you log into an Apple service, a second device must be used to verify your identity.  

This is not the same as having to involve the second device each time a service is _used_; most of our interactions occur without having to log in again; a login session can persist for days or weeks.  (Consider your email client; it can silently check for mail in the background because it remains logged into the mail server over days or weeks or more.)

Even so, it can seem like a minor additional hassle, because it requires ready access to two modern Apple devices simultaneously.  A code will be sent to the "other" one, which must then be entered into the one being signed in.  I assume that the two must be on the same Apple ID (and that having the spouse's device/s on that ID could be even more problematic than it already is).  (Spouses should have their own Apple IDs, to keep network things from tangling.)

Engaging 2FA

------------

<https://9to5mac.com/2017/03/24/how-to-protect-your-icloud-account/>

• Modern devices (things that can run the latest Macintosh OS or iOS): <https://support.apple.com/en-us/HT204915>

• Less-modern (vintage; legacy) devices: <https://support.apple.com/en-us/HT204152>

We should all do this.  I will have made the change by the time the ink has dried on this post.

Mark_

24 March 2017

Apple-Centric Web Sites

Some of these contain Apple news (Macintosh and iOS [iPhone+]) and some contain user discussion forums; some have both.  This list is incomplete, and some items may be at least slightly stale.

• <http://www.apple.com>  Besides news and advertising, there are user help forums.

• <http://tidbits.com>  Longtime news and "tips" site.

• <http://www.macworld.com>  The "default" Macintosh magazine, for years.

• <http://www.cultofmac.com>  Some useful news, some breathless hyperbole (on both sides of the _Apple_ issue).

• <https://www.engadget.com/topics/apple/>  The successor to TUAW, The Unofficial Apple Web-Log.

• <https://www.macrumors.com>  News and forums.

• <https://9to5mac.com> 

• <http://opensourcemac.org>  Non-"brand" software.

• <https://en.wikipedia.org/wiki/Category:Macintosh_magazines>

• <http://mactracker.ca> Information on all models.  Wikipedia has similar information in detail.

• <http://lowendmac.com> Older hardware.

• <https://www.cnet.com/forums/mac-os/>  Forum.

• <https://en.wikipedia.org/wiki/Apple_community>  List of forums.

• <http://lifehacker.com>  Not Apple-centric as such, but they do have Macintosh and iPhone coverage of both news and tips.

• <http://www.howardforums.com/forumdisplay.php/115-Apple>  Longtime forum for Apple mobile products.  (Other mobile products are nearby, including cellular carriers.)

You may already know that the best way to locate specific information is to Internet-search for the wording of an error message, or for words related to the issue.

Mark_ 

24 March 2017