Fake passcode entry screen?
I have a iPhone SE 2020 and have fingerprint enabled for the home button. The sensor is flakey sometimes - not recognizing my print - so I’m used to seeing the Enter Passcode screen pop up when the sensor glitches. I use a complex passcode so I get the alpha-numeric keyboard and text-entry box instead of the numeric keypad. But it’s been operating smoothly for a few months.
A few days ago, the fingerprint sensor glitched briefly while using Apple Pay in a store. The circular fingerprint image showed on the payment screen - and I could see the lines not filling in red. I tried again and the payment processed.
At the next store, when I presented my phone to the reader, there was no response. I’ll mention that I usually don’t have my phone open when I use Apple Pay. I just hold my locked phone to the reader, press on the home button, and the phone unlocks and opens Wallet in one smooth action. But there was no response - no haptic feedback. After a few seconds, I was prompted to enter my passcode. The message read “Your passcode is required to use Wallet” - which seem reasonable. So I entered my passcode and presented the phone again and the payment processed.
But as I left the store, I realized there was something different about the passcode screen. Usually there is a heading “Enter Passcode” with a message underneath in smaller typeface - all of which is centered. But this screen only had the message, “Your passcode is required to use Wallet” — and it was left-justified. I don’t know how a captured passcode might be used by a remote hacker, but I stopped to check my password manager app, found it still signed in needing only fingerprint/passcode to open — and I promptly signed out (kicking myself, because I usually leave it needing password to open). When I got home, I checked my Passcode/TouchID settings and found everything as it should be. Later on I went out again and Apple Pay worked normally. However, I did have another fingerprint glitch when unlocking the phone to do something else. So I restarted the phone (it usually sorts that out) and it’s been OK since. I tried to put the odd passcode entry screen out of my mind…
…until I saw an article on the morning of April 1 urging iPhone users to update to iOS15.4.1 immediately to address a critical vulnerability. Then alarm bells rang. I installed the update AND changed my passcode. But I’m still worried about the passcode screen that appeared when I attempted to make a payment and there was no response. Once again, the message was left-justified rather than centered, and there was no Enter Passcode title above. It was, however, set up for entering an alphanumeric passcode.
Your passcode is required
to use Wallet
At the time this happened, my phone was still on iOS15.4. I really hope that was a legitimate passcode screen just missing some styling….but if it was a fake, what might a remote attacker be able to do with a captured passcode?
iPhone SE, iOS 15