Zero-day in Sign in with Apple • Hacker News Board

Re: Zero-day in Sign in with Apple

#61

Post by saagarjha » Sat, May 30, 2020, 5:31 PM UTC

snazz wrote: post #59

saagarjha wrote: post #23

Earlier quoted context omitted.

Apple supposedly marks certain beta builds with a bounty multiplier. I say supposedly because like their "research iPhones" they mentioned it in a presentation once and I never heard about it again.

I'm guessing that the research iPhones were given to a very select group of security researchers with track records of reporting important vulnerabilities under some kind of NDA.

1. Still never heard of anyone getting them and 2. that’s worse than useless.

Re: Zero-day in Sign in with Apple

#62

Post by thephyber » Sat, May 30, 2020, 5:31 PM UTC

ani-ani wrote: post #43

" Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. " Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.

It depends what the fix was. If the fix was just to add a validation check to the POST endpoint to validate that the logged in user session matched the payload (and session data was comprehensively logged/stored), this may be verifiable.

There are obviously lots hypotheticals for which this might not be verifiable.

Re: Zero-day in Sign in with Apple

#63

Post by saagarjha » Sat, May 30, 2020, 5:33 PM UTC

jtbayly wrote: post #60

saagarjha wrote: post #25

Earlier quoted context omitted.

I did that too and wondered if they were finally offering a real bug bounty platform…

I’m not a security researcher, but this guy got paid $100k. Seems to be working?

One example of a bug being fixed and a researcher being paid does not mean it works, generally.

Re: Zero-day in Sign in with Apple

#64

Post by snazz » Sat, May 30, 2020, 5:33 PM UTC

saagarjha wrote: post #61

snazz wrote: post #59

Earlier quoted context omitted.

I'm guessing that the research iPhones were given to a very select group of security researchers with track records of reporting important vulnerabilities under some kind of NDA.

1. Still never heard of anyone getting them and 2. that’s worse than useless.

Oh, for sure. I should clarify that I meant that they received the iPhones under an NDA, not that they reported bugs under an NDA (aside from the 90-day disclosure to get any bounties).

Re: Zero-day in Sign in with Apple

#65

Post by thephyber » Sat, May 30, 2020, 5:34 PM UTC

cfors wrote: post #49

Wow. That's almost inexcusable, especially due to the requirement of forcing iOS apps to implement this. If they didn't extend the window (from originally April 2020 -> July 2020) so many more apps would have been totally exploitable from this. After this, they should remove the requirement of Apple Sign in. How do you require an app to implement this with such a ridiculous zero day?

I’m of the mind that just about any security bug is “excusable” if it passed a good faith effort by a qualified security audit team and the development process is in place to minimize such incidents.

The problem I have is that I can’t tell what their processes are beyond the generic wording on this page[1]

[1] support.apple.com/guide/security/introduction-seccd5016d31/web

Re: Zero-day in Sign in with Apple

#66

Post by _23sd » Sat, May 30, 2020, 5:34 PM UTC

fermienrico wrote: post #8

fortran77 wrote: post #2

What's amazing is that Apple gets away with claiming their computers are "secure by design." https://www.apple.com/business/docs/site/AAW_Platform_Securi... There's nothing inherent in their design that guarantees security.

Literally every system in the world has flaws, no matter how secure. We just don't know about these bugs yet.

"Every system in the world has flaws" and "it's a serious problem that one of the world's most important software vendors, that markets itself as the most secure, keeps releasing products with flaws that would have been discovered in a very basic audit" are not incompatible statements..

Re: Zero-day in Sign in with Apple

#67

Post by zemnmez » Sat, May 30, 2020, 5:35 PM UTC

tusharsoni wrote: post #16

Excellent writeup! About 4 months ago, I wrote a comment[0] on HN telling folks how Apple simply omitted the server-side validations from their WWDC videos. And given the lack of good documentation at the time, WWDC videos were what most developers were following. Even then, the only "security" that developers had was that the attacker wouldn't know the victim's Apple userId easily. With this zero-day attack, it woul…

your original post has several replies explaining why this is not a security issue. the token you ultimately get is a signed concatenation of 3 base64 encoded fields, and unless you decided to manually separate and decode these without verification (instead of doing the easy thing, just using a standard OIDC library) you would not have any user data that could ultimately result in a security issue

Re: Zero-day in Sign in with Apple

#68

Post by broooder » Sat, May 30, 2020, 5:38 PM UTC

You didn’t make enough money.

Re: Zero-day in Sign in with Apple

#69

Post by yalogin » Sat, May 30, 2020, 5:38 PM UTC

Wow that’s a really simple bug. Kudos to the OP to even try that. Most people would just look elsewhere thinking Apple of all companies would get such a basic thing right.

Re: Zero-day in Sign in with Apple

#70

Post by saagarjha » Sat, May 30, 2020, 5:40 PM UTC

snazz wrote: post #64

saagarjha wrote: post #61

Earlier quoted context omitted.

1. Still never heard of anyone getting them and 2. that’s worse than useless.

Oh, for sure. I should clarify that I meant that they received the iPhones under an NDA, not that they reported bugs under an NDA (aside from the 90-day disclosure to get any bounties).

Word on the street suggests they don’t exist: https://twitter.com/thegrugq/status/1236264193906495488