Wow, this is quite the elaborate scheme!
Apple 'Find My' network can be abused to steal keylogged passwords
Submitted 7 months ago by fne8w2ah@lemmy.world to technology@lemmy.world
Comments
Kidplayer_666@lemm.ee 7 months ago
whileloop@lemmy.world 7 months ago
[deleted]ndru@lemmy.world 7 months ago
Any platform has vulnerability to exploit to some degree. But this article is about piggybacking on the Find My Network to transmit data without actually compromising the network. It’s a clever technique, and worth reading more than the headline.
dave@feddit.uk 7 months ago
It’s very interesting but the article is a rehash of some 2-year-old work by others, and doesn’t really update anything, apart from saying that “apparently, Apple addressed this problem.” with no further clarification. Pretty low effort tbh.
ExLisper@linux.community 7 months ago
It’s not malware. They are talking abot physical keyloagger inserted into your keyboard. Real life hack possibility level: 0
cynar@lemmy.world 7 months ago
It’s not apple being hacked here. The network is just being abused to carry data out. It requires a compromised hardware device e.g. a hacked keyboard. You don’t even need to be using an apple device, it just piggybacks off of any nearby iPhones.
deegeese@sopuli.xyz 7 months ago
It’s really “Find My Phone” can be used as a sort of ubiquitous low bandwidth whisper network for sending back secrets from hidden devices.
hemmes@lemmy.world 7 months ago
This is another example of very specific situations in INFOSEC. It’s unlikely that you will become a victim to this key logger attack. And of course the title suggests that Apple’s Find My network is compromised. This is not the case. But it is being utilized, in this instance, against Apple’s rules and regulations.
The real hack here is that the victim had their keyboard modified or was given a compromised keyboard that broadcasts Bluetooth signals, that are then picked up on the Find My network. It could be transmitted via Cellular, Bluetooth, WiFi, audible sound, monitoring energy differentials, etc. It’s the HMI hardware that’s been compromised. Apple will likely develop updates to their Find My network, but the compromised keyboard could then be modified to use some other service or broadcast methods. Apple fixing the Find My network to recognize bad actors will not prevent this style of attack.
shrugal@lemm.ee 7 months ago
I think the main concern is how easy and ubiquitous it is, while also being pretty hard to detect. No other transmission method lends itself so perfectly to this kind of attack.
hemmes@lemmy.world 7 months ago
Not with Apple’s network anymore apparently. But if you read the original PoC from 2021 they said Amazon’s Echo devices have the same potential.
Ultimately even the researches indicate the slow and unreliable nature of the attack (which no longer works).