Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zero-day in Sign in with Apple

bhavukjain.com

Post reply on HN
Print view View original

81–90 of 280 posts

Re: Zero-day in Sign in with Apple

#81

Post by enitihas »

outime wrote: post #76

Wow, I'm in shock. How could Apple let this one slip in? When I was a junior fullstack I had to design a very similar system and this was one of the very basic checks that I had in mind back then. I don't know how could anyone excuse this very basic bug in such critical service.

Apple has let all sorts of things slip in which seem unbelievable.

e.g https://news.ycombinator.com/item?id=15800676 and

https://news.ycombinator.com/item?id=15828767

So I don't get shocked anymore seeing Apple security issues.

Re: Zero-day in Sign in with Apple

#82

Post by phamilton »

zemnmez wrote: post #32
phamilton wrote: post #22

> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. > $100,000 That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore…

> I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. The token described in this disclosure is an OpenID Connect 1.0 Token. OIDC is a state of the art AuthN protocol that supersets OAuth with additional security controls. It's used by Google, Facebook and Twitch amongst others. I'd do more analysis, but the author leaves off the most important part here (not sure why) ht…

My understanding is that the token itself is fine and within spec. But they altered the flow to accept an email address in one of the request payloads which opened the door for spoofing the email address. I've never seen an OAuth or OpenID flow that relied on the payload for identity.

Re: Zero-day in Sign in with Apple

#83

Post by snazz »

saagarjha wrote: post #70
snazz wrote: post #64

Earlier quoted context omitted.

Oh, for sure. I should clarify that I meant that they received the iPhones under an NDA, not that they reported bugs under an NDA (aside from the 90-day disclosure to get any bounties).

Word on the street suggests they don’t exist: https://twitter.com/thegrugq/status/1236264193906495488

I guess it's unrealistic to assume that their supply chain would be secure enough for these that no one would have heard anything.

Re: Zero-day in Sign in with Apple

#84

Post by matchbok »

NicoJuicy wrote: post #30

Perhaps slightly related that finding Apple zero days was less bounty award than finding Android zero days. I think we can wrap up the security and anonymous part that Apple has been claiming for their overpriced devices.

Overpriced? The average android phones cost the same as iPhone. That argument is tried and not relevant anymore.

Plus, iPhones actually work longer than a year.

Re: Zero-day in Sign in with Apple

#85

Post by yreg »

cfors wrote: post #49

Wow. That's almost inexcusable, especially due to the requirement of forcing iOS apps to implement this. If they didn't extend the window (from originally April 2020 -> July 2020) so many more apps would have been totally exploitable from this. After this, they should remove the requirement of Apple Sign in. How do you require an app to implement this with such a ridiculous zero day?

I believe the deadline is June 30. [0]

[0] - https://developer.apple.com/news/?id=03262020b

Re: Zero-day in Sign in with Apple

#86

Post by phamilton »

snazz wrote: post #64
saagarjha wrote: post #61

Earlier quoted context omitted.

1. Still never heard of anyone getting them and 2. that’s worse than useless.

Oh, for sure. I should clarify that I meant that they received the iPhones under an NDA, not that they reported bugs under an NDA (aside from the 90-day disclosure to get any bounties).

I'm fine with pre-release bugs being reported under an NDA. If pre-release bugs are publicly disclosed that is arguably a punishment for companies who seek that validation early in the cycle rather than later.

Re: Zero-day in Sign in with Apple

#87

Post by saagarjha »

snazz wrote: post #83
saagarjha wrote: post #70

Earlier quoted context omitted.

Word on the street suggests they don’t exist: https://twitter.com/thegrugq/status/1236264193906495488

I guess it's unrealistic to assume that their supply chain would be secure enough for these that no one would have heard anything.

Right. You can find pictures of actual internal devices all over the internet (supposedly some people will even sell them to you), so it's quite strange to not hear anything about these. With Apple going after Corellium, I think many researchers are thankful for the various exploits we've had recently that have kept iPhone open.

Re: Zero-day in Sign in with Apple

#88

Post by harpratap »

alwillis wrote: post #36
oauea wrote: post #24

Earlier quoted context omitted.

Fortunately some rando site or SaaS app doesn't have the leverage to force me to implement additional garbage! Apple does, and did. I'm still surprised that this didn't trigger an antitrust investigation like when Microsoft abused their monopoly to push internet explorer. This is exactly the same thing, if not worse.

I'm still surprised that this didn't trigger an antitrust investigation like when Microsoft abused their monopoly to push internet explorer. This is exactly the same thing, if not worse. Um… no. Microsoft gave Internet Explorer away for free when Netscape was selling their browser to businesses, an obvious attempt to undermine Netscape. They also threatened to cancel the Windows 95 licenses for companies like HP that…

> Even in the United States, Apple isn’t a monopoly with about 40% market share.

This is a non argument. A Duopoly is no reason to not being able to behave like a monopoly. If you don't play by Apple's or Google's rules you essentially lose 50% of the market.

Re: Zero-day in Sign in with Apple

#89

Post by saagarjha »

enitihas wrote: post #77
tyrion wrote: post #74

How is this something that can happen? I mean, the only responsibility of an "authentication" endpoint is to release a JWT authenticating the current user. At least from the writeup, the bug seems so simple that it is unbelievable that it could have passes a code review and testing. I suspect things were maybe not as simple as explained here, otherwise this is at the same incompetence level as storing passwords in pl…

Apple has had more simple "unbelievable" bugs, e.g https://news.ycombinator.com/item?id=15800676 (Anyone can login as root without any technical effort required) And to top it off ( https://news.ycombinator.com/item?id=15828767 ) Apple keeps having all sorts of very simple "unbelievable" bugs.

More recent example of Apple "undoing" patches: https://www.synacktiv.com/posts/exploit/return-of-the-ios-sa...

Re: Zero-day in Sign in with Apple

#90

Post by Areading314 »

_23sd wrote: post #78
thephyber wrote: post #65

Earlier quoted context omitted.

I’m of the mind that just about any security bug is “excusable” if it passed a good faith effort by a qualified security audit team and the development process is in place to minimize such incidents. The problem I have is that I can’t tell what their processes are beyond the generic wording on this page[1] [1] support.apple.com/guide/security/introduction-seccd5016d31/web

Even if there was clear evidence that this system underwent a proper security audit, with a failure this basic you would have to ask why it didn't work. What is going on inside Apple that brought them to the point of releasing a lock that simply opens with any key, despite the efforts of their state of the art lock design process and qualified lock auditors?

Writing some test cases for "can anyone generate a valid token" or "does an invalid token allow access" should be the first thing to do when writing an auth system.
Post reply on HN