my brain mis-parsed as: (sign in) with (apple zero day) which is kind of appealing
I think they were missing a colon, like one of those old-time jokes:
Sign in with Apple: zero day flaw
Zero-day in Sign in with Apple
91–100 of 280 posts
Re: Zero-day in Sign in with Apple
#92How is this something that can happen? I mean, the only responsibility of an "authentication" endpoint is to release a JWT authenticating the current user. At least from the writeup, the bug seems so simple that it is unbelievable that it could have passes a code review and testing. I suspect things were maybe not as simple as explained here, otherwise this is at the same incompetence level as storing passwords in pl…
Apple has really lost their touch, software quality has declined dramatically
does it really matter though?
Re: Zero-day in Sign in with Apple
#93> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. > $100,000 That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore…
> I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. The token described in this disclosure is an OpenID Connect 1.0 Token. OIDC is a state of the art AuthN protocol that supersets OAuth with additional security controls. It's used by Google, Facebook and Twitch amongst others. I'd do more analysis, but the author leaves off the most important part here (not sure why) ht…
I think it's actually the OIDC access token and not the ID token. The OIDC spec does not mandate any structure for the access token, but letting it be a JWT isn't out-of-spec.
Re: Zero-day in Sign in with Apple
#94> I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account. Great writeup there. Looks like a Apple JWT bug and the verification went through despite it being 'signed' and 'tamperproof'. Clearly its footgun…
No one should be using JWT but it's unfair to blame JWT here. Apple wasn't verifying the supplied email address belonged to the signed in user - that's completely outside of the token format they chose.
> No one should be using JWT
What??
Re: Zero-day in Sign in with Apple
#95How is this something that can happen? I mean, the only responsibility of an "authentication" endpoint is to release a JWT authenticating the current user. At least from the writeup, the bug seems so simple that it is unbelievable that it could have passes a code review and testing. I suspect things were maybe not as simple as explained here, otherwise this is at the same incompetence level as storing passwords in pl…
Apple has really lost their touch, software quality has declined dramatically
Anecdotally, I upgraded my wife's iMac to Catalina and she's experiencing issues (rendering latency) she's never had before (hadn't upgraded the OS since buying it 4 years ago). I figured is was good to get on the latest and greatest for security reasons, now she wont let me touch her computer anymore.
Re: Zero-day in Sign in with Apple
#96> This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not. The headline makes me think the entire problem lies with Apple, when that’s not the case.
This one rests squarely on Apple, as it was their auth service that contained the bug.
While an application could potentially (not that I know exactly how in this case) further verify the received token, that verification is exactly what an authentication service is supposed to provide, hence the responsibility absolutely rests on Apple who provides the service.
Re: Zero-day in Sign in with Apple
#97" Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability. " Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.
they used this tool grep. look it up. /s
Re: Zero-day in Sign in with Apple
#98Perhaps slightly related that finding Apple zero days was less bounty award than finding Android zero days. I think we can wrap up the security and anonymous part that Apple has been claiming for their overpriced devices.
Overpriced? The average android phones cost the same as iPhone. That argument is tried and not relevant anymore. Plus, iPhones actually work longer than a year.
And what is the root cause of a minority of Android phones raising their prices every year :)
Plus I have my Android phone for 3 years now.
The one before that was for 4 years old and priced at 345 €.
At least use a counter argument that is correct.
Re: Zero-day in Sign in with Apple
#99Am I understanding the article right: the endpoint would accept any email address and generate a valid JWT without verifying the caller owned the email address?
If so, what extra validation did Apple add to patch the bug?
Re: Zero-day in Sign in with Apple
#100Earlier quoted context omitted.
Apple has really lost their touch, software quality has declined dramatically
Anecdotally, I upgraded my wife's iMac to Catalina and she's experiencing issues (rendering latency) she's never had before (hadn't upgraded the OS since buying it 4 years ago). I figured is was good to get on the latest and greatest for security reasons, now she wont let me touch her computer anymore.
I used to be on the latest and security camp as well. But after all these years I am starting to understand why people dont update.
It is extremely frustrating. Especially when Catalina removes features that were working perfectly.