Apple’s latest iOS 17.3 update brings a host of new features, including collaborative playlists in Apple Music and a Unity wallpaper for Black History Month. Among the noteworthy additions is the stolen device protection feature, a response to a concerning trend uncovered by Joanna Stern and Nicole Nguyen in their investigation for the Wall Street Journal.
Thieves have been exploiting the passcode vulnerability on iPhones to steal money and access sensitive data stored securely on the device and its associated iCloud account. The passcode serves as a critical piece of information, enabling unauthorized access and changes to settings even when Face ID or Touch ID is active.
The method employed by iPhone thieves involves engaging with potential victims in social settings, such as bars, late at night. They strike up conversations, claiming they want to add the person on Snapchat. Utilizing the passcode as a fallback method, the thief convinces the individual to hand over their phone under the guise of entering contact details directly.
Once in possession of the passcode, the thief gains control over the device, enabling them to disable Find My iPhone, change the Apple ID password, and access sensitive information stored in iCloud Keychain, Safari autofill preferences, encrypted notes, and even make unauthorized Apple Pay transactions.
In response to this security concern, Apple has introduced stolen device protection in iOS 17.3. When enabled, certain actions, such as accessing stored passwords and credit cards, now require Face ID or Touch ID biometric authentication. Additionally, changing the Apple ID password, passcode, or turning off stolen device protection triggers a security delay, requiring users to wait for at least an hour before making critical changes.
This security measure aims to provide users with the opportunity to remotely wipe their device if it is stolen, ensuring that their data remains secure. While the hour-long delay may seem inconvenient, Apple acknowledges familiar locations, such as home or work, exempting users from the waiting period in these trusted environments.
Image credit: Unsplash
