iOS 17.4.1 Revision

[nickyr]

For anyone who has updated their iPhone to 17.4.1 or iPad to iPad OS 17.4.1, there is a further "revision" update. It's only available if you plug your phone into your mac, and is an entire re-install of the OS (around 8GB).

It's to combat this latest phishing attack whereby you get bombarded with requests to change your password, culminating in a phone call purporting to be from Apple Support.

I've not seen a thread relating to this, but apologies if there is one already there.

 

[Raz0rEdge]

Where did you read about this "revision" and this suggestion. The password reset issue was reported a recently and there isn't any specific update that addresses it.

This re-install wouldn't specifically help that issue since it's not what's happening.

Just so we all know what's happening, if you have MFA enabled on your device, each login attempt prompts for the code, an attacker obviously doesn't have that code, so they just keep trying to login/reset your Apple ID account. When it gets locked out, you start getting notifications to reset your password on all connected devices.

The attacker will continue this for a while and then with information gathered about you from public websites, they give you a call pretending to be Apple Support and now will try to reset your password, but then you're asked to give them the MFA code that pops up. Through this, they can likely again access to your Apple ID.

An iOS update won't do this, since it's more of an issue with Apple ID and MFA enabled.

 

[IWT]

culminating in a phone call purporting to be from Apple Support.

This concerns me. I've never heard of Apple Support, or any other Apple source, phoning a user.

May I ask how you confirmed that this call was from Apple?

Ian

 

[Raz0rEdge]

It's not from Apple Support, as you are correct that Apple wouldn't contact anyone. However, the scammer/phisher claims to be from Apple Support with enough info about (your name, addresses, etc.) to seem legitimate.

The goal is to get into your account through social engineering.

Social engineering is by far the most effective and easiest way for bad actors to gain access.

 

[nickyr]

I heard it addresses the issue from a chap called Zollotch on YouTube

 

[Raz0rEdge]

Sounds like that chap is misinformed. Since this issue isn't specifically on the iPhone. It would appear on your Mac, iPad, etc.

 

[MacInWin]

Actually, I followed up and connected my iPhone 15 to my MBP with a USB cable, opened FInder and asked if there was an update. The phone was alreadt at 14.4.1, but it did report a new update was available. So, I went ahead with it. It backed up my entire iPhone, then did a download of the update and installed it. No problems. It changed the build number, I think. It's now 21E237.

In any event, it did work, and although the backup took a long time, wasn't difficult to do.

 

[IWT]

Jake, I followed your adventure and attached my iPhone 15 Pro to the Mac, as I usually do anyway. And, yes, there was an update, but only if you "asked" ie clicked on "Check for Update".

And the Build Number is the same as yours.

But, hey, what a long time it took.................agggghhh...........about an hour and 15 minutes.

When finished, it tells you that "this update includes improvements and bug fixes for your iPhone"

Strange that that the only way to get this update seems to require a USB cable link to the Mac.

Anyway, thank you for the "heads up".

Ian

 

[MacInWin]

Ian, I think I also saw something about a firmware update mixed in. The long time was for the backup, which it did not ask about before making it, and which took the long time. I don't want my backups on my internal drive, so once the update was done, I deleted it, but then found that TM had taken a snapshot that included the backup, so even after deleting the backup, the drive still showed the space taken up by the snapshot. That should clear in a day or so, once TM purges the older backups, but it would have been nice for it to ask first.

 

[Slydude]

For some reason, this update hasn't popped for me yet. My build number is still one back at 21E236, I think.

 

[MacInWin]

For some reason, this update hasn't popped for me yet. My build number is still one back at 21E236, I think.

Apparently, Sly, it only appears if you use the USB connection and Finder to look for the update. In other words, not an over-the-air update.

 

[IWT]

I think I also saw something about a firmware update mixed in

Correct. I forgot to mention that.

Ian

 

[IWT]

For some reason, this update hasn't popped for me yet. My build number is still one back at 21E236, I think.

Jake's right. There is no warning or indication that this mixed update and firmware update is waiting for you. I got my info from Jake and, yes, it's all there if you connect your iPhone to your Mac. Very strange.

Ian

 

[Rod]

I think this is connected to the thread I started here: Can I change my existing Apple ID email address to a new @icloud address?

And the article that prompted that thread from Mac Rumors Forums re KrebsOnSecurity report here:

Warning: Apple Users Targeted in Phishing Attack Involving Rapid Password Reset Requests

Phishing attacks taking advantage of Apple's password reset feature have become increasingly common, according to a report from KrebsOnSecurity....

www.macrumors.com

However, I had been considering changing my long standing gmail address that I originally used to set up my Apple ID to a dedicated @icloud.com address.
That gmail address is my first email address, back before @me.com, @mac.com ect. Of course over the years it has been compromised multiple times in data breaches, I don't even bother to check "have I been pwned" any more.
So, I've created a new @icloud.com address and after the mandatory 30 day wait I intend to swap my email address from gmail for my Apple ID.

 

[Rod]

Thanks to everyone that posted for the informative info. I checked my iPhone updates via cable connection on my MBP and below is what I found.



Update running now.

 

[Rod]

DISASTER: I ran the update as instructed but got this at the install stage.


The phone is now in DFU stage requiring a restore.

 

[MacInWin]

DISASTER: I ran the update as instructed but got this at the install stage.

View attachment 39345
The phone is now in DFU stage requiring a restore.

Hmmm, I didn't see that at all. Just a full backup (taking forever) and then software updated and reboot. Did it back up before it ran the update?

 

[Rod]

No too sure. Restore using Finder failed:



Stuck in a loop with this. Currently using iMazing to reinstall iOS 17.4.1 which gives you the opportunity to erase the phone first prior to instal.

 

[Rod]

Fingers crossed this works. Should then be able to restore from iMazing backup.

 

[Rod]

UPDATE: Well, you gotta love iMazing. It failed to download iOS 17.4.1 from Apple Servers. So, after minute or two I get a a notification that, as an alternative iMazing would restore from the most recent backup and it did just that. iPhone restarted and my Lock screen reappeared, logged in and all back to normal. All data retained.
Attempting to use Finder for the same operation failed due to the "unknown error" loop. The only option I got was to Update & Restore but update could not be applied. I did try twice.

Big sigh of relief..., thank you iMazing.