Apple Pays Researcher $100,000 for Critical Vulnerability

Apple has fixed a flaw in the Sign in with Apple feature that could have enabled attackers to break into user accounts for third-party services.

Apple has paid security researcher Bhavuk Jain $100,000 for the discovery of a critical flaw in its Sign in with Apple feature. The now-patched vulnerability, if exploited, could have let attackers bypass authentication and take over user accounts for third-party applications.
The feature was
introduced
in iOS 13 as a faster and more private means of signing into apps and websites. Instead of authenticating with social accounts or filling out forms, users can log in with Apple ID and Apple will provide developers with a random ID. Even when asked for a name or email address, users can share a random email address to keep their personal email private.
Back in April, Jain found a critical bug in Sign in with Apple that affected the third-party apps using it without implementing their own security protections. This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not, he explains in a blog post detailing the vulnerability.
In addition to paying Jain a bounty, Apple conducted an investigation into its server logs and confirmed this flaw was not used to compromise any user accounts.
Sign in with Apple works similarly to OAuth 2.0. There are two ways to authenticate a user: with a JSON Web Token (JWT) or a code generated by the Apple server, which is then used to create a JWT which is then used to validate a users identity. When granting authorization, Apple gives users the option to share their Apple Email ID with a third-party application. If a user decides to hide his or her Email ID, Apple generates a user-specific Apple relay Email ID to share with the app.
Depending on what the user selects, after successful authorization, Apple creates a JWT containing the relay Email ID. This is then used by the third-party application to authenticate the user. Jain discovered that while Apple asks users to log in to their Apple account before generating the request, it did not validate if a JWT request came from the same user account before logging them in.
I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apples public key, they showed as valid, Jain writes in his
blog post
. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victims account.
Jain
confirmed
with The Hacker News that this vulnerability could be exploited for users who had chosen to hide their email ID from third-party applications. An attacker could also use this vulnerability to create a new user account with the victims Apple ID, he adds.
In his writeup, Jain says the impact of this bug is quite critical because it could enable full account takeover if exploited. Many developers have integrated Sign in with Apple because its mandatory for applications that support authentication via other social apps. Popular apps that use the feature include Dropbox, Spotify, Airbnb, and Giphy. These apps were not tested, Jain says, but they could have been vulnerable to account takeover if there were no other security measures in place when verifying a user.
Related Content:
10 iOS Security Tips to Lock Down Your iPhone
Abandoned Apps May Pose Security Risk to Mobile Devices
How Enterprises Are Developing and Maintaining Secure Applications
A Rogues Gallery of MacOS Malware

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that really bad day in cybersecurity. Click for
more information and to register
.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Apple Pays Researcher $100,000 for Critical Vulnerability