Washington, DC - As Apple expands its reach in the Enterprise sector, it’s important that everyone using iOS or macOS understands that there are still risks inherent with Apple products. For years, Apple has enjoyed a sterling reputation in regards to security. There even existed a persistent myth, up until recently, that Apple products couldn’t be hacked. That’s patently false.
And while Apple does take security extremely seriously, that’s a double-edged sword. It also makes Apple IDs (and exploits) more valuable. That, in turn, makes Apple users more attractive targets for capable hackers. After all, there’s more money to be made there.
According to Top10VPN’s most recent Dark Web Market Price Index, Apple ID Data trades at around $15 per account. As we covered in our look at 2018 Cybercrime Statistics, that kind of data usually goes for around $3.
“It’s clear from our research that Apple users are the most appealing targets for online scammers,” Simon Migliano, head of research at Top10VPN, told Computer World. “Ready-made phishing pages for Apple IDs, along with config files for password crackers, go for more than double the near-uniform rate of $2.07 for the vast majority of other brands.”
While Apple products do boast strong security posture, platform security is only part of a larger whole. Enterprises, especially, should also be investing in network, device, location-based and user security to help combat phishing, spoofing and more complex, multi-vector attempts (which are becoming increasingly common).
Overall, attacks targeting Apple platforms are up. According to MalwareBytes, malware attacks on Macs climbed 270 percent last year.
Why do Cyber Criminals prefer targeting Apple users?
As we’ve already discussed, Apple users are more lucrative targets from standpoint of how much stolen data can fetch. As we’ve also touched on, it’s more profitable to sell Apple exploits and hacking products than it is selling tools and exploits for other platforms. But those are likely symptoms of something deeper.
That could be attributable to a number of factors, but arguably the biggest comes from the costs associated with deploying Apple devices. It’s no bargain. So, logically, it’s going to be wealthier companies and individuals who invest in Apple. That can mean a number of things, at an individual level it makes for a better potential target for fraud. It’s hard to extort someone or trick them into forking over a lot of money if they don’t have a lot of money to begin with. But an Apple user? The odds are better they’ll have something to take.
There’s also potentially greater interest in the information that these Apple systems have access to, specifically at the Enterprise level where a stolen ID could net you access to a company’s cloud.
Should Apple users be concerned?
Concerned may not be the best word. Aware? Vigilant?
Apple has, historically, been extremely secure. And the company is aware of threats to its systems and is constantly working on patches and updates to keep its users safe. Case in point, Apple just released a set of new tools to help defend against phishing. But Apple, on its own, can’t do everything required to keep you safe. A lot of that comes down to the person using the device.
We’ve covered it before and repeat it all the time: the biggest threat to your organization’s cybersecurity is your own employees. And according to a recent study, 70% of US workers don’t know or understand cybersecurity best practices.
And that’s exactly what a lot of these cyber criminals are counting on. Because all of Apple’s security and protections aside, it’s trivially easy to compromise any system when you can trick the user. There are very few technical safeguards that protect against social engineering. So that should be one of the first things companies look at when securing Apple devices: training the people who use them. Those employees are you first, and sometimes only line of defense against phishing and spoofing.
There is a trend in which attackers design extremely complex multi-vector attacks in which individual exploits are personalized for each person at a company or other target entity in order to establish enough overall data through a sequence of attacks with which to penetrate enterprise systems.
This is high-level social engineering and if you aren’t training your employees to spot it, or at the very least be suspicious, you’re potentially setting your organization up for problems.
“I would urge any business using Apple products should urgently review their policies regarding use of Apple devices, particularly mobile, in the workplace, with particular focus on login security, proper separation of corporate and personal data and ensuring staff are trained to recognize phishing attempts,” said Migliano. “In fact, every Apple user should be aware that they are being targeted over and above users of other platforms and protect themselves accordingly.”
Security Best Practices for Apple Users
Here’s a list of some security best practices that should be implemented by all Apple users, regardless whether you’re Enterprise, SMB or just an individual user:
- Use a strong, unique password and make sure to enable two-factor authentication
- Never click on a link from an email unless you can confirm the sender and the message’s authenticity
- Never log in to any service using an emailed link, navigate to the page manually in your browser
- Never log in to any service (financial, confidential or even just social media) on public WiFi
- Make sure to stay up to date with the latest updates and patches that Apple releases
Additionally, if your organization has a BYOD (Bring Your Own Device) policy that allows employees to bring personal devices that will have access to your network, you will need to apply appropriate safeguards, such as Mobile Device Management, and in the form of specific security configurations on a device-by-device basis.
Obviously, it’s probably not a great feeling for Apple users when they realize that the target on their backs is significantly larger than the ones on their Windows counterparts. Or who knows, maybe it makes the Apple club feel even more exclusive. Either way, there’s no need to worry as long as you keep your safeguards up and stay vigilant about social engineering and attempts to trick you into divulging your personal data.
