Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:10 PM
Connect Directly

Apple Pays Researcher $100,000 for Critical Vulnerability

Apple has fixed a flaw in the "Sign in with Apple" feature that could have enabled attackers to break into user accounts for third-party services.

Apple has paid security researcher Bhavuk Jain $100,000 for the discovery of a critical flaw in its "Sign in with Apple" feature. The now-patched vulnerability, if exploited, could have let attackers bypass authentication and take over user accounts for third-party applications.

The feature was introduced in iOS 13 as a faster and more private means of signing into apps and websites. Instead of authenticating with social accounts or filling out forms, users can log in with Apple ID and Apple will provide developers with a random ID. Even when asked for a name or email address, users can share a random email address to keep their personal email private.

Back in April, Jain found a critical bug in Sign in with Apple that affected the third-party apps using it without implementing their own security protections. "This bug could have resulted in a full account takeover of user accounts on that third party application irrespective of a victim having a valid Apple ID or not," he explains in a blog post detailing the vulnerability.

In addition to paying Jain a bounty, Apple conducted an investigation into its server logs and confirmed this flaw was not used to compromise any user accounts.

Sign in with Apple works similarly to OAuth 2.0. There are two ways to authenticate a user: with a JSON Web Token (JWT) or a code generated by the Apple server, which is then used to create a JWT which is then used to validate a user's identity. When granting authorization, Apple gives users the option to share their Apple Email ID with a third-party application. If a user decides to hide his or her Email ID, Apple generates a user-specific Apple relay Email ID to share with the app.

Depending on what the user selects, after successful authorization, Apple creates a JWT containing the relay Email ID. This is then used by the third-party application to authenticate the user. Jain discovered that while Apple asks users to log in to their Apple account before generating the request, it did not validate if a JWT request came from the same user account before logging them in.

"I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple's public key, they showed as valid," Jain writes in his blog post. "This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim's account."

Jain confirmed with The Hacker News that this vulnerability could be exploited for users who had chosen to hide their email ID from third-party applications. An attacker could also use this vulnerability to create a new user account with the victim's Apple ID, he adds.

In his writeup, Jain says the impact of this bug is "quite critical" because it could enable full account takeover if exploited. Many developers have integrated Sign in with Apple because it's mandatory for applications that support authentication via other social apps. Popular apps that use the feature include Dropbox, Spotify, Airbnb, and Giphy. These apps were not tested, Jain says, but they could have been vulnerable to account takeover if there were no other security measures in place when verifying a user.

Related Content:

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...