{"id":47134,"date":"2025-03-19T15:16:02","date_gmt":"2025-03-19T19:16:02","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=47134"},"modified":"2025-09-09T10:42:12","modified_gmt":"2025-09-09T14:42:12","slug":"apple-passwords-phishing-vulnerability","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/03\/19\/apple-passwords-phishing-vulnerability\/","title":{"rendered":"Apple Passwords Phishing Vulnerability"},"content":{"rendered":"

Arin Waichulis<\/a> (Hacker<\/a> News<\/a>, MacRumors<\/a>):<\/p>\n

It’s now been revealed that a serious HTTP bug left Passwords users vulnerable to phishing attacks for nearly three months, from the initial release of iOS 18 until the patch in iOS 18.2.<\/p>

Security researchers at Mysk<\/a> first discovered the flaw after noticing that their iPhone’s App Privacy Report<\/a> showed Passwords had contacted a staggering 130 different websites over insecure HTTP traffic. This prompted the duo to investigate further, finding that not only was the app fetching account logos and icons over HTTP—it also defaulted to opening password reset pages using the unencrypted protocol. “This left the user vulnerable: an attacker with privileged network access could intercept the HTTP request and redirect the user to a phishing website,” Mysk told 9to5Mac<\/em>.<\/p>

[…]<\/p>

However, it becomes a problem when the attacker is connected to the same network as the user (i.e. Starbucks, airport, or hotel Wi-Fi) and intercepts the initial HTTP request before it redirects.<\/p>

[…]<\/p>

While this was quietly patched in December<\/a> of last year, Apple only just disclosed<\/a> it in the last 24 hours.<\/p><\/blockquote>\n\n

Mysk<\/a>:<\/p>\n

“Unfortunately, this issue didn’t qualify for a bounty because it didn’t meet the impact criteria or fall into any of the eligible categories”<\/p><\/blockquote>\n\n

Mysk<\/a>:<\/p>\n

Yes, it feels like doing charity work for a $3 trillion company. We didn’t do this primarily for money, but this shows how Apple appreciates independent researchers. We had spent a lot of time since September 2024 trying to convince Apple this was a bug.<\/p><\/blockquote>\n\n

Previously:<\/p>\n