Feeds

Apple pulls iForgot password recovery system over security bug

Two-factors forward, one step back

Beginner's guide to SSL certificates

Updated Don't get too hammered this Friday night in case you wake up to find you've forgotten your Apple password, as Cupertino has been forced to pull down its iForget service due to an embarrassing new security flaw.

This was supposed to be a good week for Apple on the security front. On Tuesday the company fixed a password-bypass flaw in iOS with its latest 6.1.3 update, and Apple finished the week with the introduction of two-factor authentication for its users on Friday.

But then came a tip to The Verge of a flaw in the iForget password retrieval system. With just the email address and date of birth of an Apple user, you could get a password reset request granted using a modified URL in the date-of-birth box on the iForgot security web page. Done correctly, this would allow an attacker full access to iTunes and iCloud accounts.

Step-by-step instructions detailing how to carry out the low-skill hack were found online, and Apple moved quickly to pull down the iForget system by 1pm PT (10pm UTC) Friday. It is working to fix the fatal flaw, but until it does, don't forget your password.

"Apple takes customer privacy very seriously. We are aware of this issue, and working on a fix," said the company in a statement.

When news of the bug broke, some of the more – ahem – excitable members of the anti-Apple movement pointed out that the only way to get around the flaw was to use Cupertino's new two-factor security system, and wasn't that convenient timing. Apple's prompt iForget pull-down rather negates that argument but it won't stop those fond of tin-foil headwear from speculating. ®

Update

The security hole was fixed as of Friday night, and the iForgot web site is now up and running again.

Choosing a cloud hosting partner with confidence

More from The Register

next story
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
SMASH the Bash bug! Red Hat, Apple scramble for patch batches
'Applying multiple security updates is extremely difficult'
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
Desperate VXers enslave FREEZERS in DDoS bot
Updated Spike malware targets Asia
Heatmiser digital thermostat users: For pity's sake, DON'T SWITCH ON the WI-FI
A stranger turns up YOUR heat with default password 1234
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.