Zero-day in Sign in with Apple

Post by zenexer » Sat, May 30, 2020, 5:20 PM UTC

joering2 wrote: post #47

ani-ani wrote: post #43

" Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. " Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.

I stand corrected and removing my message now since my scenario wasn’t related to this zeroday bug. Thank you to everyone who educated me.

Post by snazz » Sat, May 30, 2020, 5:22 PM UTC

zenexer wrote: post #51

joering2 wrote: post #47

Earlier quoted context omitted.

I stand corrected and removing my message now since my scenario wasn’t related to this zeroday bug. Thank you to everyone who educated me.

This isn’t an information disclosure vulnerability that would allow someone to gain knowledge of new Apple IDs. It also doesn’t affect first-party applications. I can’t provide an explanation of the behavior you observed without more information, but I can reasonably conclude that the vulnerability here wasn’t the cause.

Post by snazz » Sat, May 30, 2020, 5:23 PM UTC

antoncohen wrote: post #46

gruez wrote: post #38

Is it me or is this writeup low on details? There are a couple of commenters saying that this is a great writeup, but all it amounts to is: 1. what sign in with apple is 2. sign in with apple is like oauth2 3. there's some bug (not explained) that allows JWTs to be generated for arbitrary emails 4. this bug is bad because you can impersonate anyone with it 5. I got paid $100k for it

I think the write up is so short because the bug is so simple. Send a POST to appleid.apple.com with an email address of your choice, and get back an auth token for that user. Use the auth token to log-in as that user. It's that simple.

Post by jtbayly » Sat, May 30, 2020, 5:25 PM UTC

joering2 wrote: post #47

ani-ani wrote: post #43

" Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. " Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.

I stand corrected and removing my message now since my scenario wasn’t related to this zeroday bug. Thank you to everyone who educated me.

Post by snazz » Sat, May 30, 2020, 5:26 PM UTC

saagarjha wrote: post #23

phamilton wrote: post #22

> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. > $100,000 That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore…

Apple supposedly marks certain beta builds with a bounty multiplier. I say supposedly because like their "research iPhones" they mentioned it in a presentation once and I never heard about it again.