Protect against iPhone password reset attacks: How-to

Protecting your iPhone from password reset attacks is crucial in today’s digital age. Malicious parties are taking advantage of vulnerabilities in the Apple ID password reset system to target users with iOS prompts and attempt to take over their accounts. Here are some steps you can take to safeguard your device against these attacks.

Recently, there have been reports of MFA bombing, a tactic where attackers flood your iPhone and other Apple devices with multiple prompts to reset your Apple ID password. This can be a deceptive scam that appears official, but it’s important to stay informed and cautious.

According to Krebs on Security, these attackers exploit the victim’s phone number to bombard them with MFA system prompts. It’s essential to be aware of this threat and take preventive measures.

---

Update 4/21/24: While Apple has addressed some of these issues, it’s still crucial to remain vigilant. Both users and Apple employees have reported instances of password reset prompts on their devices. It’s important to decline such prompts and be cautious.

Remember to decline any suspicious password reset prompts and avoid answering calls from unknown numbers, even if they claim to be from Apple Support. Attackers may try to extract personal information or verification codes to compromise your account.

If you continue to receive prompts despite taking precautions, consider changing your phone number associated with your Apple ID. This step may help stop the bombardment of reset prompts, although it may impact certain features like iMessage and FaceTime.

How to protect against iPhone password reset attacks

1. Decline, decline, decline

   • Always choose “Don’t Allow” when faced with reset password requests, even if they seem legitimate.
   • Attackers may try to wear you down by sending multiple prompts, so continue to decline and stay alert.
   • If you encounter a password reset prompt on the web, close the page immediately to avoid falling for phishing attempts.

2. Avoid answering phone calls

   • Be cautious of caller ID spoofing, where attackers mimic official numbers to deceive you.
   • Never share one-time passcodes with anyone, and decline suspicious calls.
   • If in doubt, call Apple directly to verify the legitimacy of the call.

3. Consider changing your phone number

   • If the prompts persist, changing your phone number linked to your Apple ID may halt the attacks.
   • Keep in mind that this action may affect certain Apple services, so weigh the pros and cons.

More details

The Apple ID password reset system has been under scrutiny for potential vulnerabilities that allow for such attacks. It’s crucial for Apple to address these issues promptly to protect users from malicious exploitation.

It’s essential to question the design of an authentication system that bombards users with password change requests without their consent. Apple needs to address this flaw in its systems to prevent further exploitation.

While Apple is working on resolving these concerns, it’s important for users to remain cautious and informed. The password reset scam has been a persistent issue for some time, highlighting the need for enhanced security measures.

If you have been targeted by such attacks, consider seeking advice from Apple or implementing additional security features like the Recovery Key. Stay vigilant and prioritize your digital safety in today’s evolving threat landscape.

Related:

Images by 9to5Mac