How to Safeguard Against iPhone Password Reset Attacks

There's been a concerning trend in iPhone security lately: the increase in
iPhone password reset attacks, also called "MFA bombing." This sneaky
tactic floods users with iOS prompts through the Apple ID password reset
system, attempting to gain control of their accounts. As a result, Apple
users should enhance their defenses against these deceptive schemes.

MFA bombing, also known as MFA fatigue or push bombing, involves
overwhelming victims with numerous official iOS password reset prompts.
According to Krebs on Security, malicious actors exploit this vulnerability
by sending over a hundred multi-factor authentication (MFA) prompts to the
victim's iPhone and other Apple devices using their phone number, forcing
them to reset their Apple ID password.

Despite Apple's efforts to address the issue, occasional attacks still
occur, highlighting the persistent risk. Personal anecdotes, such as
encountering password reset prompts on iPhones and Macs, demonstrate the
prevalence of this threat.

Here are steps to protect yourself from iPhone password reset attacks:

Say no to password resets.
Always choose "Don't Allow" when facing official-looking reset requests to
thwart attackers.

Be careful with incoming calls.
Given the rise in call spoofing, avoid sharing personal information or
one-time codes over the phone to protect against scammers. If uncertain,
refrain from answering and contact Apple through trusted channels.

Change your phone number if needed.
If you're continuously receiving prompts, think about temporarily changing
the phone number connected to your Apple ID. Keep in mind that this could
impact iMessage and FaceTime functionalities.

https://www.bolnews.com/latest/2024/04/how-to-safeguard-against-iphone-password-reset-attacks/

On 2024-04-24 10:59, Gelato wrote:
> How to Safeguard Against iPhone Password Reset Attacks
>
> There's been a concerning trend in iPhone security lately: the increase in
> iPhone password reset attacks, also called "MFA bombing." This sneaky
> tactic floods users with iOS prompts through the Apple ID password reset
> system, attempting to gain control of their accounts. As a result, Apple
> users should enhance their defenses against these deceptive schemes.
>
> MFA bombing, also known as MFA fatigue or push bombing, involves
> overwhelming victims with numerous official iOS password reset prompts.

This is a bit stale as an issue.
Other than breezy media announcements I've not heard of anyone actually
struck by this attack.

--
“Patriotism is when love of your own people comes first;
nationalism, when hate for people other than your own comes first.”
- Charles de Gaulle.