{"id":113597,"date":"2020-05-30T21:10:07","date_gmt":"2020-05-30T21:10:07","guid":{"rendered":"https:\/\/appleinsider.com\/articles\/20\/05\/30\/sign-in-with-apple-bug-discovery-earns-developer-100000"},"modified":"2020-05-30T21:10:07","modified_gmt":"2020-05-30T21:10:07","slug":"sign-in-with-apple-bug-discovery-earns-developer-100000","status":"publish","type":"post","link":"https:\/\/sickgaming.net\/blog\/2020\/05\/30\/sign-in-with-apple-bug-discovery-earns-developer-100000\/","title":{"rendered":"Sign in with Apple bug discovery earns developer $100,000"},"content":{"rendered":"
<\/div>\n

Details of a now-patched vulnerability in the “Sign in with Apple” account authentication have been revealed, a zero-day that could have allowed an attacker to take control of a user’s account. <\/p>\n

\n

Launched in 2019, “Sign in with Apple<\/a>” is intended to be a more privacy-focused alternative to website and app log-in systems powered by Facebook and Google accounts. By minimizing the amount of a user’s data that is used for authentication and account creation, the API also helped reduce the amount of tracking Facebook and Google performed on users, in turn making it more private. <\/p>\n<\/div>\n

\n

Disclosed<\/a> on Saturday by security-focused developer Bhavuk Jain, a zero-day vulnerability in Sign in with Apple had the potential to let an attacker gain access to, and fully take over, a user’s account on a third-party application. According to Jain, the bug would have enabled a change in control of the application’s user account, regardless of whether the user had a valid Apple ID or not. <\/p>\n<\/div>\n

\n

The way Sign in with Apple functions is that it relies on either a JSON Web Token (JWT) or a code generated by Apple’s servers, with the latter used to generate a JWT if it doesn’t exist. While authorizing, Apple provides users with options to either share or hide their Apple Email ID with the third-party app, with a user-specific Apple relay email ID created for the latter selection. <\/p>\n<\/div>\n

\n

After a successful authorization, Apple produces a JWT, which contains the email ID, and is used by the third-party application to log the user in. <\/p>\n<\/div>\n

\n

Jain discovered in April it was possible to request a JWT for any email ID, and when the signature of the token is verified using Apple’s public key, they are deemed to be valid. In effect, an attacker could create a JWT through this process, and gain access to the victim’s account. <\/p>\n<\/div>\n

\n

As Apple mandates the inclusion of Sign in with Apple in apps with other social-based login systems, the attack had a very broad base of apps that it was theoretically effective against. An investigation by Apple’s security team determined the vulnerability has not been used in any attacks. <\/p>\n<\/div>\n

\n

Jain responsibly disclosed the flaw to Apple, which led to an award from Apple’s bug bounty program<\/a> worth $100,000. Apple has since patched the vulnerability, but it isn’t clear exactly how yet.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Details of a now-patched vulnerability in the “Sign in with Apple” account authentication have been revealed, a zero-day that could have allowed an attacker to take control of a user’s account. Launched in 2019, “Sign in with Apple” is intended to be a more privacy-focused alternative to website and app log-in systems powered by Facebook […]<\/p>\n","protected":false},"author":2,"featured_media":113598,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57],"tags":[],"class_list":["post-113597","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apple-insider"],"_links":{"self":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/113597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/comments?post=113597"}],"version-history":[{"count":0,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/113597\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media\/113598"}],"wp:attachment":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media?parent=113597"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/categories?post=113597"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/tags?post=113597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}