These include multi-factor authentication and automatic account lock-outs after more than five successive failed login attempts. This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities, I publicly disclosed it so apple will patch it.Īpple currently employs several publicly known security methods to prevent brute force attacks on iCloud account credentials. The tool, called “iDict” and currently hosted at GitHub, claims to utilize a “painfully obvious” bug in Apple’s iCloud security infrastructure and has been released to force Apple to act on the issue.Ī 100% Working iCloud Apple ID Dictionary attack that bypasses Account Lockout restrictions and Secondary Authentication on any account. An individual using the handle “Pr0x13” announced late Thursday the release of what is purported to be a “100 percent” effective method of cracking individual iCloud account login credentials. 'This bug is painfully obvious and was only a matter of time before it was privately used for malicious or nefarious activities,' he said in the tool's description.Īpple was relatively quick to act and started enforcing rate limiting for log-in attempts done with iDict a day after the tool became available.Hackers are ringing in the new year with another public threat to Apple’s online iCloud service. Pr0x13 claims that he made iDict public in order to draw attention to the problem and force Apple to fix it.

Online services like iCloud typically limit the number of failed log-in attempts per account in order to prevent brute-force attacks, but Pr0x13 allegedly found a way to bypass those protections. By default the tool came with a file - also called a dictionary - containing 500 commonly used passwords, but the list could have easily been extended.

It worked by trying out a large number of passwords for the targeted Apple IDs. The problem came to light after a proof-of-concept attack tool called iDict was released on GitHub in early January.ĭeveloped by a user who uses the online alias Pr0x13, the tool was described as '100% Working iCloud Apple ID Dictionary attack that bypasses Account Lockout restrictions and Secondary Authentication on any account.' Apple has fixed an issue that could have allowed attackers to launch brute-force attacks against iCloud users in order to guess their passwords.

Idict tool