With all those high-profile third parties using Apple ID, what would happen if somebody stole/deleted/damaged my data/assets on Dropbox/Spotify/Airbnb/...?
Would I sue the provider who would sue Apple? But does Apple provide any guarantees to the relying parties? And if not and the only way is to depend on the reputation when choosing the ID providers you want to support, how would anyone want to support Apple ID after this? And could they not use it if Apple forces them to...?
Zero-day in Sign in with Apple
101–110 of 280 posts
Re: Zero-day in Sign in with Apple
#102Re: Zero-day in Sign in with Apple
#103I am hoping WWDC 2020 will have some great news and events that let us forget all the mistake they made in Catalina and incidents like this.
I am not sure if I am understanding the blog post correctly, because its simplicity is beyond ridiculous.
Re: Zero-day in Sign in with Apple
#104Earlier quoted context omitted.
Anecdotally, I upgraded my wife's iMac to Catalina and she's experiencing issues (rendering latency) she's never had before (hadn't upgraded the OS since buying it 4 years ago). I figured is was good to get on the latest and greatest for security reasons, now she wont let me touch her computer anymore.
I used to be on the latest and security camp as well. But after all these years I am starting to understand why people dont update. It is extremely frustrating. Especially when Catalina removes features that were working perfectly.
I’m still on High Sierra, most recent 10.13.6 security update was ~3 days ago.
I’ll upgrade when some piece of software I need to use requires it.
Re: Zero-day in Sign in with Apple
#105Earlier quoted context omitted.
I think the write up is so short because the bug is so simple. Send a POST to appleid.apple.com with an email address of your choice, and get back an auth token for that user. Use the auth token to log-in as that user. It's that simple.
Did it show what URL you had to send the request to? It looked to me like that was redacted. I'm guessing that that URL would have been in the developer documentation.
The URL has "X"s in it. I don't know if that means it is redacted or is variable.
Note that when they give the POST request, they say "Sample Request (2nd step)".
But what is step 2? The diagram above shows step 2 as a response, not a request. At least that's how I interpret an arrow pointing back toward the user. So the write-up conflicts with the diagram.
How do you resolve that conflict? One guess is that "Sample Request (2nd step)" should say "1st step" instead.
Another guess is that the arrow directions don't necessarily always indicate whether a step is a request or a response, so that step 1 could be a request and response, and step 2 could be another request and response that POSTs to a secret URL that was learned about in step 1. (This guess could make sense because the request is a JSON message with just the email field. There must be credentials somewhere, so either it's redacted or some kind of credentials were given another way, like in step 1.)
If this second guess is right, then a follow-on guess is that the crux of the bug is that in step 1, you sign in with a particular email, then Apple says "OK, now here's a secret URL to call to get a JWT token", and then in step 2, you change email, and it doesn't notice/care that you changed emails between step 1 and 2.
Re: Zero-day in Sign in with Apple
#106How is this something that can happen? I mean, the only responsibility of an "authentication" endpoint is to release a JWT authenticating the current user. At least from the writeup, the bug seems so simple that it is unbelievable that it could have passes a code review and testing. I suspect things were maybe not as simple as explained here, otherwise this is at the same incompetence level as storing passwords in pl…
Apple has had more simple "unbelievable" bugs, e.g https://news.ycombinator.com/item?id=15800676 (Anyone can login as root without any technical effort required) And to top it off ( https://news.ycombinator.com/item?id=15828767 ) Apple keeps having all sorts of very simple "unbelievable" bugs.
Last year (or maybe 2018?) my employer hired an external consultant to give engineers security trainings (all are optional, they provide a few sessions on different topics, and engineers can sign up for interested ones). In one of the sessions I signed up, during the pre-session chat (while waiting for everyone signed up show up in the conference room), the external trainer "casually" chatted about "if you have an Android phone, you should throw it out of the window right now and buy an iPhone instead". That's the point I lost all my respect to them.
(The session itself was ok-ish. It was some trainings about xsrf, nothing special either)
(That incident also triggered me to purchase a sheet of [citation needed] stickers from xkcd to put on my laptop, so the next time this kind of thing happens I can just point to the sticker on my laptop. But I didn't got a chance to do that yet since received the stickers)
Re: Zero-day in Sign in with Apple
#107" Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. " Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.
Yeah, doesn't this just mean they didn't detect misuse?
It's not clear because it's not a direct quote and Apple probably wasn't explicit about the difference. I wouldn't infer one way or the other from this sentence.
Re: Zero-day in Sign in with Apple
#108Earlier quoted context omitted.
Apple has really lost their touch, software quality has declined dramatically
Anecdotally, I upgraded my wife's iMac to Catalina and she's experiencing issues (rendering latency) she's never had before (hadn't upgraded the OS since buying it 4 years ago). I figured is was good to get on the latest and greatest for security reasons, now she wont let me touch her computer anymore.
Welcome to the late adopter group. Never upgrade, unless it is absolutely necessary.
Re: Zero-day in Sign in with Apple
#109Since this was an extremely simple exploit, I can't help but wonder if it was a purposeful one on Apple's part.
Apple has been spending a lot of money on a security-focused marketing campaign these past few years, and encouraging a high-price payout of $100k is sage marketing.
Re: Zero-day in Sign in with Apple
#110Earlier quoted context omitted.
Apple has had more simple "unbelievable" bugs, e.g https://news.ycombinator.com/item?id=15800676 (Anyone can login as root without any technical effort required) And to top it off ( https://news.ycombinator.com/item?id=15828767 ) Apple keeps having all sorts of very simple "unbelievable" bugs.
Last year (or maybe 2018?) my employer hired an external consultant to give engineers security trainings (all are optional, they provide a few sessions on different topics, and engineers can sign up for interested ones). In one of the sessions I signed up, during the pre-session chat (while waiting for everyone signed up show up in the conference room), the external trainer "casually" chatted about "if you have an An…
This was pretty true not long ago. It's still a notoriously short window for OEM software patches on Android, whereas Apple's first 64-bit phone, the 5s from Fall 2013 is still getting patches (May 20th was the last one, iOS 12.4.7)
Apple pioneered usable security with TouchID and the secure enclave; a lot of Android fingerprint readers were gimmicks for years, same with the face unlocks. https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...
They also invest piles of money into privacy https://apple.com/privacy (1 minute overview), https://apple.com/privacy/features (in-depth with links to whitepapers).
I imagine that's where your teacher was coming from.