Zero-day in Sign in with Apple • Hacker News Board

Re: Zero-day in Sign in with Apple

#41

Post by ahupp » Sat, May 30, 2020, 5:07 PM UTC

gruez wrote: post #38

Is it me or is this writeup low on details? There are a couple of commenters saying that this is a great writeup, but all it amounts to is: 1. what sign in with apple is 2. sign in with apple is like oauth2 3. there's some bug (not explained) that allows JWTs to be generated for arbitrary emails 4. this bug is bad because you can impersonate anyone with it 5. I got paid $100k for it

It seems low on details because the exploit was incredibly simple. AFAICT you didn't have to do anything special to get the signed token, they just gave it out.

> Here on passing any email, Apple generated a valid JWT (id_token) for that particular Email ID.

Re: Zero-day in Sign in with Apple

#42

Post by big_youth » Sat, May 30, 2020, 5:08 PM UTC

saagarjha wrote: post #25

awinter-py wrote: post #15

my brain mis-parsed as: (sign in) with (apple zero day) which is kind of appealing

I did that too and wondered if they were finally offering a real bug bounty platform…

They have a bug bounty program: https://developer.apple.com/security-bounty/

I actually think they have a good approach. Rewarding major finds with good payouts and avoiding the flood of info and low level web app ‘bugs’.

Re: Zero-day in Sign in with Apple

#43

Post by ani-ani » Sat, May 30, 2020, 5:09 PM UTC

"Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability."

Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.

Re: Zero-day in Sign in with Apple

#44

Post by moralestapia » Sat, May 30, 2020, 5:09 PM UTC

$100,000 (!)

Props to Apple for raising the bar on bounties!

Re: Zero-day in Sign in with Apple

#45

Post by calimac » Sat, May 30, 2020, 5:10 PM UTC

Is the dev team that wrote that line of code fired?

Re: Zero-day in Sign in with Apple

#46

Post by antoncohen » Sat, May 30, 2020, 5:11 PM UTC

gruez wrote: post #38

Is it me or is this writeup low on details? There are a couple of commenters saying that this is a great writeup, but all it amounts to is: 1. what sign in with apple is 2. sign in with apple is like oauth2 3. there's some bug (not explained) that allows JWTs to be generated for arbitrary emails 4. this bug is bad because you can impersonate anyone with it 5. I got paid $100k for it

I think the write up is so short because the bug is so simple. Send a POST to appleid.apple.com with an email address of your choice, and get back an auth token for that user. Use the auth token to log-in as that user. It's that simple.

Re: Zero-day in Sign in with Apple

#47

Post by joering2 » Sat, May 30, 2020, 5:15 PM UTC

ani-ani wrote: post #43

" Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. " Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.

I stand corrected and removing my message now since my scenario wasn’t related to this zeroday bug.

Thank you to everyone who educated me.

Re: Zero-day in Sign in with Apple

#48

Post by neetdeth » Sat, May 30, 2020, 5:16 PM UTC

j4yav wrote: post #27

toomuchtodo wrote: post #21

Earlier quoted context omitted.

I still trust Apple over a rando site or SaaS app. No system is flawless.

I think I trust Apple over a random website too, but was adding an additional kind of sign in and forcing everyone to use it even needed in the first place?

I'm very willing to believe that this move was driven by actual user research. As a user, the last thing I want to do is create a user name and password for your app, click a link to validate my email, then enter my password again into some sort of cross platform widget that doesn't support keychain autofill. Unless it's an essential service like a bank or an airline, I'll probably opt out of using it.

I'm also very lazy when it comes to payment methods. Trying to order food and the app doesn't support Apple Pay? Delete it and do something else.

Clearly there are issues with the entrenchment of Apple at the center of all this, and these problems would be better solved with open standards, but the consistency and convenience makes an actual measurable benefit in the end user's daily life.

Re: Zero-day in Sign in with Apple

#49

Post by cfors » Sat, May 30, 2020, 5:17 PM UTC

Wow. That's almost inexcusable, especially due to the requirement of forcing iOS apps to implement this. If they didn't extend the window (from originally April 2020 -> July 2020) so many more apps would have been totally exploitable from this.

After this, they should remove the requirement of Apple Sign in. How do you require an app to implement this with such a ridiculous zero day?

Re: Zero-day in Sign in with Apple

#50

Post by saagarjha » Sat, May 30, 2020, 5:19 PM UTC

big_youth wrote: post #42

saagarjha wrote: post #25

Earlier quoted context omitted.

I did that too and wondered if they were finally offering a real bug bounty platform…

They have a bug bounty program: https://developer.apple.com/security-bounty/ I actually think they have a good approach. Rewarding major finds with good payouts and avoiding the flood of info and low level web app ‘bugs’.

I am well aware of the bug bounty program. I think it needs work.