Zero-day in Sign in with Apple
bhavukjain.com
Zero-day in Sign in with Apple
1–10 of 280 posts
Re: Zero-day in Sign in with Apple
#2What's amazing is that Apple gets away with claiming their computers are "secure by design." https://www.apple.com/business/docs/site/AAW_Platform_Securi...
There's nothing inherent in their design that guarantees security.
Re: Zero-day in Sign in with Apple
#3What's amazing is that Apple gets away with claiming their computers are "secure by design." https://www.apple.com/business/docs/site/AAW_Platform_Securi... There's nothing inherent in their design that guarantees security.
But for some reason I have never had to remove malware from my parents’ iOS or macOS devices.
Re: Zero-day in Sign in with Apple
#4What's amazing is that Apple gets away with claiming their computers are "secure by design." https://www.apple.com/business/docs/site/AAW_Platform_Securi... There's nothing inherent in their design that guarantees security.
This software security issue in Sign In With Apple was unrelated to the security of Apple's hardware platform.
Re: Zero-day in Sign in with Apple
#5> This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not.
The headline makes me think the entire problem lies with Apple, when that’s not the case.
Re: Zero-day in Sign in with Apple
#6> This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not. The headline makes me think the entire problem lies with Apple, when that’s not the case.
This seems very much like Apple’s bug, to the extent that they paid out a $100k bug bounty?
Re: Zero-day in Sign in with Apple
#7> This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not. The headline makes me think the entire problem lies with Apple, when that’s not the case.
This seems very much like Apple’s bug, to the extent that they paid out a $100k bug bounty?
Really?
> ...affected third-party applications which were using it and didn’t implement their own additional security measures.
Re: Zero-day in Sign in with Apple
#8What's amazing is that Apple gets away with claiming their computers are "secure by design." https://www.apple.com/business/docs/site/AAW_Platform_Securi... There's nothing inherent in their design that guarantees security.
Literally every system in the world has flaws, no matter how secure. We just don't know about these bugs yet.
Re: Zero-day in Sign in with Apple
#9Earlier quoted context omitted.
This seems very much like Apple’s bug, to the extent that they paid out a $100k bug bounty?
Really? > ...affected third-party applications which were using it and didn’t implement their own additional security measures.
That there were ways of mitigating it (I'd assume verifying email addresses out of band?) doesn't mean it's not Apple's problem when their authentication system can be tricked to confirm false identities, when its entire purpose is confirming identities.
Re: Zero-day in Sign in with Apple
#10> I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account.
Great writeup there. Looks like a Apple JWT bug and the verification went through despite it being 'signed' and 'tamperproof'. Clearly its footguns allowed this to happen, thus JWTs is the gift that keeps on giving to researchers.
What did I just outline days before? [0]. Just don't use JWTs, there are already secure alternatives available.