Recent 'MFA Bombing' Attacks Targeting Apple Users

Original Article ↗ Hacker News Discussion ↗

Apple’s password-reset “push” prompts are being abused in large-scale MFA fatigue attacks, where iCloud users are spammed with reset requests and then targeted by spoofed “Apple Support” calls to trick them into handing over codes. Commenters criticize Apple’s lack of rate limiting, confusing UX, and reliance on easily discoverable identifiers like phone numbers, while debating trade‑offs between usability and stricter options such as hardware security keys, recovery keys, and in‑person identity proofing. The thread highlights broader concerns that SMS- and push-based authentication are fragile, that many major services repeat these patterns, and that users are left balancing account recoverability against the risk of permanent lockout.

Apple’s MFA and Account Recovery Design

  • Many criticize Apple’s security key support: you can’t reliably disable all other 2FA paths, and trusted devices can still be used in some flows.
  • Security keys are treated similarly to trusted devices; a trusted device can remove a key, so keys can expand rather than shrink the attack surface.
  • Push-based MFA and password-reset prompts can be spammed; watch “quiet”/focus modes don’t always suppress them, raising both annoyance and fat‑finger risk.

Recovery Keys, Lockout Risk, and Backups

  • Recovery keys and Advanced Data Protection are seen as strong defenses and a way to prevent Apple (or coerced Apple) from accessing data.
  • Big concern: lose the recovery key and all trusted devices and you’re permanently locked out.
  • Users propose various backup schemes: paper copies in safes or safe deposit boxes, geographically separated stashes, encrypted files, secret-sharing, or trusted recovery contacts.
  • Debate over whether this is acceptable self‑custody risk or too harsh for typical users.

How the Attack Actually Works

  • Clarified by commenters: tapping “Allow” on the reset prompt does not directly hand the account to attackers; it lets the user reset on their own device, often via a code shown locally.
  • Attackers then call with spoofed Apple Support numbers and try to socially engineer the code or new password.
  • Some criticize the original article for implying that an accidental tap alone could compromise the account; later edits added nuance.

Rate Limiting and UX Defenses

  • Many are surprised Apple allows rapid, repeated reset attempts and unbounded push prompts.
  • Suggested mitigations: exponential backoff, OS‑level suppression, “bombed mode” with extra confirmation, or blocking obviously abusive flows.
  • Others warn strict per‑user rate limits can be turned into denial‑of‑service against account recovery.

Phone Numbers, SMS, and Identity

  • Strong sentiment that phone numbers and SMS are poor as identifiers and 2FA: public, SIM‑swappable, and now often central to digital identity.
  • Counterpoint: in some financial settings, SMS attacks were rarely observed compared to phishing and password reuse; device loss complicates stronger factors for the mass market.

Broader Themes

  • Push MFA is widely disliked; many prefer entering codes.
  • Hardware tokens (YubiKeys/HSMs) are advocated by some, but others see cost/complexity and limited benefit if trusted devices remain.
  • Underlying frustration: trillion‑dollar companies ship easily abusable flows, and users are expected to carry the security burden amid a constant background of digital crime.