Sign in with Apple vulnerability allowed unauthorised access to linked accounts

By Digit NewsDesk | Published on 31 May 2020
Sign in with Apple vulnerability allowed unauthorised access to linked accounts
HIGHLIGHTS

Sign in with Apple vulnerability discovered by Indian researcher.

Vulnerability would have allowed unauthorised access to linked accounts.

Apple has patched the vulnerability.

Advertisements

Access Open Source Technology

Innovate w/ IBM and Discover New Open Source Technology Today. Learn More.

Click here to know more

Apple’s “Sign in with Apple”  was found to have a vulnerability that would allow hackers to gain access to any account that was linked with the service. The vulnerability was discovered by Bhavuk Jain, an Indian security researcher who promptly reported to Apple. Apple investigated the matter, Apple did conclude the vulnerability to be real and awarded the researcher a sum of $10,000 as part of the bug-bounty program.

The vulnerability in question was around how Apple validated users “on the client-side before initiating a request from Apple’s authentication services.” A JSON Web token would be generated by the server which would be used by the third-party service to authenticate the user. The vulnerability would allow this token to be spoofed, leading to any malicious actor to gain access to a user’s account. "I found I could request JWTs for any Email ID from Apple, and when the signature of these tokens was verified using Apple's public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID and gaining access to the victim's account," Jain said in an Interview with The Hacker News. The vulnerability would impact even those users who chose to hide or not share their email IDs during the login process.

Apple had introduced Sign in With Apple last year at WWDC as a means of providing iOS users an alternative to having to use their Facebook or Google IDs to log into third-party applications. The need arose from the fact that Facebook and Google were leveraging these sign-in for advertising purposes and even going so far as to tracking user behaviour. Facebook was even accused of selling user data to third parties, and then there was the Cambridge Analytica scandal. Twitter too was accused of selling user data to the people behind Cambridge Analytica. Apple’s pitch with Sign in with Apple was that the service wouldn’t collect or track user behaviour. In fact, Apple even built an email anonymizer into the service, where users could opt to not share their e-mail IDs with the platform they were logging into. In the backend, Apple would create a bridge email ID which would forward any correspondence from the platform to the users’ actual email ID. Sign in with Apple would generate unique e-mail IDs for every service you sign into, provided you choose to not share your email ID with that service.

Apple has stated that the vulnerability in question has been patched by the company and that after verifying their server logs, say that no accounts were accessed illegitimately.

logo
Digit NewsDesk

The guy who answered the question 'What are you doing?' with 'Nothing'.

Digit caters to the largest community of tech buyers, users and enthusiasts in India. The all new Digit in continues the legacy of Thinkdigit.com as one of the largest portals in India committed to technology users and buyers. Digit is also one of the most trusted names when it comes to technology reviews and buying advice and is home to the Digit Test Lab, India's most proficient center for testing and reviewing technology products.

We are about leadership-the 9.9 kind! Building a leading media company out of India.And,grooming new leaders for this promising industry.

DMCA.com Protection Status