Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day in Sign in with Apple

bhavukjain.com

Post reply on HN
Print view View original

11–20 of 280 posts

Re: Zero-day in Sign in with Apple

#11

Post by Kikawala »

jagged-chisel wrote: post #7
saagarjha wrote: post #6

Earlier quoted context omitted.

This seems very much like Apple’s bug, to the extent that they paid out a $100k bug bounty?

Really? > ...affected third-party applications which were using it and didn’t implement their own additional security measures.

Is everyone in this thread only going to read the first two paragraphs of the article and skip the rest of it?

> I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account.

Re: Zero-day in Sign in with Apple

#13

Post by arkadiyt »

rvz wrote: post #10

> I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account. Great writeup there. Looks like a Apple JWT bug and the verification went through despite it being 'signed' and 'tamperproof'. Clearly its footgun…

No one should be using JWT but it's unfair to blame JWT here. Apple wasn't verifying the supplied email address belonged to the signed in user - that's completely outside of the token format they chose.

Re: Zero-day in Sign in with Apple

#14

Post by pquerna »

jagged-chisel wrote: post #7
saagarjha wrote: post #6

Earlier quoted context omitted.

This seems very much like Apple’s bug, to the extent that they paid out a $100k bug bounty?

Really? > ...affected third-party applications which were using it and didn’t implement their own additional security measures.

This allowed you to forge an attestation of user identity from Apple for any App that was setup to consume it. Apple is acting as an IdP for its consumer ecosystem. It's definitely their problem.

Third-party applications really have no recourse but to trust the signed JWT. That is just how OAuth2/OIDC works.

User impersonation against an IdP is a serious security issue. 100k is cheap.

The bug was basically on the IdP's "consent screen". Instead of using the email from the active logged in account, it allowed the attack to POST in any email they wanted.

Obviously not having the bug would be great. Apple could do "more", and layer on more things on top of OAuth, like a proof of key extension (DPoP) on the flow: https://tools.ietf.org/html/draft-fett-oauth-dpop-04

But if you have a bug like this, where you can edit your claims arbitrarily inside the IdP, extra security layers kinda don't matter.

Re: Zero-day in Sign in with Apple

#16

Post by tusharsoni »

Excellent writeup! About 4 months ago, I wrote a comment[0] on HN telling folks how Apple simply omitted the server-side validations from their WWDC videos. And given the lack of good documentation at the time, WWDC videos were what most developers were following.

Even then, the only "security" that developers had was that the attacker wouldn't know the victim's Apple userId easily. With this zero-day attack, it would have been trivial for many apps to get taken over.

[0] https://news.ycombinator.com/item?id=22172952

Re: Zero-day in Sign in with Apple

#17

Post by oauea »

Wow, I'm so glad that apple forced me to implement this broken garbage into my apps!

For those not aware, some time ago apple decided it would be a good idea to develop their own sing in system, and then force all apps on their store (that already support e.g. Google Account login) to implement it.

So they brought a huge amount of additional complexity in a large amount of apps, and then they fucked up security. Thank you apple!

Re: Zero-day in Sign in with Apple

#18

Post by aPoCoMiLogin »

jagged-chisel wrote: post #7
saagarjha wrote: post #6

Earlier quoted context omitted.

This seems very much like Apple’s bug, to the extent that they paid out a $100k bug bounty?

Really? > ...affected third-party applications which were using it and didn’t implement their own additional security measures.

Apple is an email authority in this case, and as third party you have to rely on their security. Same as with ssl certificate authority.

Re: Zero-day in Sign in with Apple

#20

Post by Lammy »

lotsofpulp wrote: post #3
fortran77 wrote: post #2

What's amazing is that Apple gets away with claiming their computers are "secure by design." https://www.apple.com/business/docs/site/AAW_Platform_Securi... There's nothing inherent in their design that guarantees security.

But for some reason I have never had to remove malware from my parents’ iOS or macOS devices.

[flagged]
Post reply on HN