Apple Mail flaw could pose risk to iCloud passwords

A researcher says he notified Apple in January but the flaw has yet to be patched

A flaw in Apple's iOS mail client could be used to trick someone into divulging their iCloud password.

A flaw in Apple's iOS mail client could be used to trick someone into divulging their iCloud password.

A security researcher says a vulnerability in Apple's mobile email application could be used to trick someone into divulging their iCloud password.

Prague-based Jan Soucek published proof-of-concept code that shows how he could send an email to someone with HTML code that resembles the iCloud login pop-up window. Soucek then receives an email containing the password.

The vulnerability allows remote HTML content to be loaded in an email, which replaces the content of the email message. Soucek wrote he then built a functional password collector using HTML and CSS. He also published a demonstration video.

He found the bug in January and notified Apple. The bug wasn't fixed in iOS 8.1.2, "therefore I decided to publish the proof of concept code here," he wrote. Apple officials did not immediately comment.

Soucek rigged the exploit code so that the bogus iCloud authentication window is only displayed once, which reduces suspicion, he wrote.

Apple has taken steps to strengthen the security of iCloud accounts after ones belonging to many celebrities were compromised last year.

The celebrity iCloud accounts may have been accessed after hackers guessed their usernames and passwords, possibly by answering the security questions Apple poses if someone loses their password.

It's also possible the celebrities fell victim to phishing attacks, which makes Soucek's finding even more worrying.

With iCloud credentials, it is possible to download the entire contents of an account to a new device, including photographs, text messages, call logs, address books, calendars and other information depending on what a person has chosen to store on iCloud.

Even if iCloud credentials are compromised, Apple has put other defenses in place. It now offers two-factor authentication and sends notifications when a new device is used to access an account or a password is changed.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags ApplesecurityExploits / vulnerabilities

More about AppleApple.Twitter

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place