A Basic iPhone Feature Helps Criminals Steal Your Entire Digital Life

[question everything]

(snip)

Similar stories are piling up in police stations around the country. Using a remarkably low-tech trick, thieves watch iPhone owners tap their passcodes, then steal their targets’ phones—and their digital lives. The thieves are exploiting a simple vulnerability in the software design of over one billion iPhones active globally. It centers on the passcode, the short string of numbers that grants access to a device; and passwords, generally longer alphanumeric combinations that serve as the logins for different accounts.

With only the iPhone and its passcode, an interloper can within seconds change the password associated with the iPhone owner’s Apple ID. This would lock the victim out of their account, which includes anything stored in iCloud. The thief can also often loot the phone’s financial apps since the passcode can unlock access to all the device’s stored passwords.

(snip)

A similar vulnerability exists in Google’s Android mobile operating system. However, the higher resale value of iPhones makes them a far more common target, according to law-enforcement officials. “Our sign-in and account-recovery policies try to strike a balance between allowing legitimate users to retain access to their accounts in real-world scenarios and keeping the bad actors out,” a Google spokesman said.

(snip)

Groups of two or three thieves would go to a bar and befriend victims, often asking them to open up Snapchat or some other social-media platform, said Sgt. Robert Illetschko, the lead investigator on the case. During that interaction they would try to observe the victim unlocking the iPhone with the passcode, he said. If they didn’t catch the passcode at first, they might have tried to get the victim to hand them the phone for a photo and then subtly turn it off before handing it back, he added. After an iPhone is restarted, a passcode is required to unlock it.

More..

https://archive.is/3lpNT#selection-491.158-491.163

[PoindexterOglethorpe]

1. Makes me very glad that I only use my phone for voice calls or texting.

I don't have any other anything on my phone. There are benefits to being a Luddite.

[question everything]

2. I use it to log into sited like DU, check on the next snow but no link at all to any financial info

I don't use the Cloud at all. Not even at home.

[PoindexterOglethorpe]

7. I use my desktop computer to log in here.

Sometimes my laptop, when I'm traveling. Also don't use the Cloud. I am a bit of a Luddite.

[Silent3]

3. Since my iPhone has Face ID...

...it would be a very rare event that someone would catch me entering my passcode in public.

[edisdead]

5. Right? Or fingerprint id

Also we should let people know that thieves are now hip to people keeping a spare house key under a mat or rock near the front door….

[emulatorloo]

4. Rupert Murdoch's Wall Street Journal? I remember his phone hacking scandal in the UK

News International phone hacking scandal

https://en.wikipedia.org/wiki/News_International_phone_hacking_scandal

The News International phone hacking scandal was a controversy involving the now-defunct News of the World and other British newspapers owned by Rupert Murdoch. Employees of the newspaper were accused of engaging in phone hacking, police bribery, and exercising improper influence in the pursuit of stories. Whilst investigations conducted from 2005 to 2007 appeared to show that the paper's phone hacking activities were limited to celebrities, politicians, and members of the British royal family, in July 2011 it was revealed that the phones of murdered schoolgirl Milly Dowler, relatives of deceased British soldiers, and victims of the 7 July 2005 London bombings had also been hacked. The resulting public outcry against News Corporation and its owner Rupert Murdoch led to several high-profile resignations, including that of Murdoch as News Corporation director, Murdoch's son James as executive chairman, Dow Jones chief executive Les Hinton, News International legal manager Tom Crone, and chief executive Rebekah Brooks. The commissioner of London's Metropolitan Police Service (MPS), Sir Paul Stephenson, also resigned. Advertiser boycotts led to the closure of the News of the World on 10 July 2011, after 168 years of publication.[1] Public pressure forced News Corporation to cancel its proposed takeover of the British satellite broadcaster BSkyB.

The prime minister David Cameron announced on 6 July 2011 that a public inquiry, known as the Leveson Inquiry, would look into phone hacking and police bribery by the News of the World, consider the wider culture and ethics of the British newspaper industry and that the Press Complaints Commission would be replaced "entirely".[1][2] A number of arrests and convictions followed, most notably of the former News of the World managing editor Andy Coulson.

Murdoch and his son, James, were summoned to give evidence at the Leveson Inquiry. Over the course of his testimony, Rupert Murdoch admitted that a cover-up had taken place within the News of the World to hide the scope of the phone hacking.[3] On 1 May 2012, a parliamentary select committee report concluded that Murdoch "exhibited wilful blindness to what was going on in his companies and publications" and stated that he was "not a fit person to exercise the stewardship of a major international company".[4] On 3 July 2013, Channel 4 News broadcast a secret tape from earlier that year, in which Murdoch dismissively claims that investigators were "totally incompetent" and acted over "next to nothing" and excuses his papers' actions as "part of the culture of Fleet Street".[5]

[NJCher]

8. Banks are so aggressive about

Their apps. They act like it’s a crime to not have their app.

I don’t want the damned thing. Why would I want to do banking on an app when I can use my computer?

[gopiscrap]

9. I still have a flip phone

I am not even sure if you can track it it is so old

[usonian]

10. This is called "shoulder surfing"

Thieves cannot read your passcode if you use touch-id or face-id.
So to prevent this attack vector, use the above, and never type your passcode where anyone can see you, should the phone demand it (they do once in a while, even with biometric ID, and always on restart.)

The rest the video is valid, but getting that passcode is vastly harder if it’s never seen in public.

My recommendation. Also, to stay out of bars.

[Initech]

11. I use Android + Firefox + uBlock Origin + AVG.

You can never have too much protection these days!