A new tool submitted to GitHub claims to be able to perform password dictionary attacks on any iCloud account, seemingly able to evade detection from Apple’s rate-limiting security that is supposed to prevent such dictionary attacks from happening. In September, Apple reported it had closed one such hole that allowed brute-force attacks to occur. The sourcecode for the tool has been released onto GitHub. Upon inspection, the tool is really rather crude in its complexity. It simply tries every possible word in its 500-long word-list as the password for a given iCloud account email. This means whilst it will succeed “100%” at trying 500 times over, the tool is by no means guaranteed to succeed at cracking your password.
Any password that is not simply a word from the dictionary listed on this page is safe from this ‘hack’. Still, brute-force vulnerabilities are very important as many users do use plain dictionary words as their passwords. More determined hackers could also use the exploit to brute-force much more complex passwords, so the threat is very real. For instance, hackers with more resources could use a dramatically larger word list than the one posted on GitHub. Apple should be able to patch the hole soon, however. It is not a complicated hack — it appears to rely on pretending to be an iPhone device. For whatever reason, Apple’s servers allow these type of requests infinitely without locking password attempts after several requests.
EmoticonEmoticon