this post was submitted on 15 Feb 2024
156 points (94.3% liked)

Apple

17370 readers
21 users here now

Welcome

to the largest Apple community on Lemmy. This is the place where we talk about everything Apple, from iOS to the exciting upcoming Apple Vision Pro. Feel free to join the discussion!

Rules:
  1. No NSFW Content
  2. No Hate Speech or Personal Attacks
  3. No Ads / Spamming
    Self promotion is only allowed in the pinned monthly thread

Lemmy Code of Conduct

Communities of Interest:

Apple Hardware
Apple TV
Apple Watch
iPad
iPhone
Mac
Vintage Apple

Apple Software
iOS
iPadOS
macOS
tvOS
watchOS
Shortcuts
Xcode

Community banner courtesy of u/Antsomnia.

founded 1 year ago
MODERATORS
MichelleG@lemmy.world
RoyalEngineering@lemmy.world
thisisdee@lemmy.world
156
First ever iOS trojan discovered — and it’s stealing Face ID data to break into bank accounts (www.tomsguide.com)
submitted 8 months ago by willya@lemmyf.uk to c/apple_enthusiast@lemmy.world
42 comments fedilink hide all child comments
 

cross-posted from: https://lemmyf.uk/post/5813538

First ever iOS trojan discovered — and it’s stealing Face ID data to break into bank accounts

you are viewing a single comment's thread
view the rest of the comments
[–] Lemming421@lemmy.world 21 points 8 months ago* (last edited 8 months ago) (1 children)

Ok, so not great, but not terrible.

Firstly you had to fall for social engineering to get the dodgy app via TestFlight. Later on, you had to fall for social engineering to get the dodgy app via you installing an MDM profile on your own device. In the future, you'll doubtless be able to get socially engineered to sideload it.

Currently, in the UK (I don't know what this is like in other countries), we get regular prompts from our banks not to share one-time codes with anyone, not even bank employees. And not to transfer money to 'safe' accounts, even if someone claiming to be the bank or the police tell you to. They'll just need to update those to also say "We at Bank will never ask you to install test or special versions of our app, or update them anywhere other than the official Apple/Google app store".

This is a social engineering problem, not really an iOS (or Android) technical one.

EDIT: The article is suspiciously vague one one point:

Once installed on either an iPhone or an Android phone, GoldPickaxe can collect facial recognition data, identity documents and intercepted text messages, all to make it easier to siphon off funds from banking and other financial apps. To make matters worse, this biometric data is then used to create AI deepfakes to impersonate victims and access their bank accounts.

What 'facial recognition data' is it gathering, and how? As I understand it, FaceID is processed in a secure enclave, and regular apps don't have access to that - they send a 'verify this person' request, the phone itself triggers a FaceID scan, does the verification itself and sends back a 'yes, all good' reply to the app - the app itself does not get FaceID or biometric data. So unless it's just doing something like using the camera to take some photos or videos of the user, I'd like to know what the article is talking about there...

[–] chiisana@lemmy.chiisana.net 5 points 8 months ago* (last edited 8 months ago) (1 children)

Lazy journalism. The two variants showcases exactly how iOS is more secure and how much harder it is to get on the device as well as attempt to extract info.

Few quick points to answer questions outlined here:

  1. Android and iOS Variants behaves differently. Due to security measures (as outlined in this post itself) iOS variant cannot actually extract facial recognition data. Instead, it takes photos of user with prompts about shifting their face and blinking etc. The setup here is because Thailand’s central bank requires banks to perform facial recognition to withdraw larger sums of money. By stealing your face in multiple photos, they could build a deep fake of your face to be used in another device later.
  2. Due to the way security works on iOS, the iOS variant cannot exfiltrate SMS messages directly. There is simply no permission to do such. Instead, it tricks users into installing a SMS filtering extension “to prevent fraudulent SMS” — this allows attacker to read incoming SMS, but only from unknown numbers. The hopes here is that they could intercept your MFA received via SMS at a later date.

If anyone wants to do the full reading, it is available from Group-ib directly.

And yes, this further cements my thoughts about EU making a terrible move forcing Apple to enable side loading as it adds additional vectors for bad actors to get into a currently much more secure and harder to invade device.

[–] Nogami@lemmy.world 4 points 8 months ago* (last edited 8 months ago)

If (when) this allows iOS Trojans through side loading you better believe that Apple will throw it all back at the EUs doorstep. I’m gonna howl how idiots thought it would make things “better”.

Of course many of those people that “want side loading” don’t give two craps about users. They just wanna see Apple knocked down a peg because of their sad little lives.

Wanna make things better in a way that gets my approval, kill all subscription models and just pay for genuine software updates that need to be justified through the new features they add.