Apple paid 100 thousand dollars. for finding a vulnerability in the Sign in with Apple service

Log in with Apple is a new login method that was meant to protect our privacy. Apple has just paid 100,000 dollars. to the developer who found a hole in it.

Apple in iOS 13 introduced a new method of user authorization in mobile applications. From now on, instead of providing software developers with your data or logging in with services such as Facebook or Google, you can use the Log In with Apple service and protect your privacy .

Although some doubt is raised by the fact that Apple used a stick, not a carrot , to encourage developers, but the new solution boasted even Tim Cook’s biggest competitor . Thanks to it, service providers will never know the user’s email address, which makes it easier to defend against spam.

Unfortunately, it turned out that an error appeared in the Log in with Apple service, which could result in the loss of access to data.

The matter was described by the author of the blog bhavukjain.com . He explained that it was enough to know the Email ID parameter to access the online service using Log in with Apple. The developer detected this zero-day vulnerability as early as April and it affected all sites using this login method that did not implement additional security on their side.

In the blog entry, the developer explains that the vulnerability was related to the user authorization method. It uses either the JSON web token (JSON Web Token, JWT), or codes generated on Apple servers, on the basis of which JWT was created. This works similar to the OAuth 2.0 method, and the way the Cupertino company solution works is explained in the diagram:

What was the error in Sign in with Apple ?

The developer explains that in a situation where the user decides to hide his Apple ID from the service provider, Apple generates an Email ID for the needs of this one application. Then JWT is generated, which contains the Email ID parameter, and online services use it for authorization.

It turned out that in April it was possible to request JWT for any Apple Email ID and verify the token signature using a public key. If someone got to know the Email ID, they could get an artificially generated JSON web token and gain full access to the account.

It’s so good that Apple explains that zero-day has never been used, and the error in the Apple Log In service has already been patched. In addition, the person reporting this zero-day boasted that the company awarded her with a prize of 100,000. dollars. as part of the Apple Security Bounty program.

Apple paid 100 thousand dollars. for finding a vulnerability in the Sign in with Apple service

https://ift.tt/3eUmb6w



from WordPress https://ift.tt/3cobUg9

Comments

Post a Comment

Popular posts from this blog

Astronomers observe a record collision of two black holes. The collision created an object that researchers had been looking for for years

Image
Astronomers have likely discovered the most massive collision of two black holes ever recorded. The chaotic connection of the two objects took place about 7 billion years ago, and now we have received the signal emitted at that time. Thanks to the LIGO and Virgo instruments, researchers were able to observe the birth of one of the most sought-after objects in the universe. Two actors took part in the performance: a black hole with a mass of 66 solar masses and a second black hole with a mass of about 85 solar masses. The two black holes approached each other, orbiting each other at the end at a rate of several times a second, until a collision occurred, during which powerful ripples of space-time were emitted, which spread out across the universe at the speed of light. In the collision, a black hole with a mass of 142 solar masses was formed. This is an extremely important discovery for astronomers. So far, researchers have been able to detect and indirectly observe black holes t...
Read more

link collection

https://www.zotero.org/groups/2544200/industrialvalve https://www.xptech.games/2019/12/valve-says-half-life-alyx-will-be-one.html?showComment=1597998098486#c1158433795511040620 https://www.writing.com/main/portfolio/view/catwz123 https://www.worldtradersdirectory.com/author/josiahmieo/ https://ift.tt/32Zpd43 https://www.warriorforum.com/members/globewz.html https://www.wantedly.com/users/140414559 https://www.w3.org/users/125385 https://www.vocabulary.com/profiles/B15J95JMLY0FLC https://www.vingle.net/zhshzhun12 https://www.viki.com/users/larsonsherylhwbe2_953/about https://www.universalhunt.com/articles/different-types-of-valves-and-their-importance/45135 https://www.turnkeylinux.org/user/1304106 https://www.tumblr.com/blog/coldwz https://www.triptipedia.com/user/gatevalve https://www.tripadvisor.in/Profile/Global61298668051 https://www.thegreatapps.com/profile/ntgd-valve-co-ltd https://www.ted.com/profiles/22785548 https://www....
Read more

Redmi Smart Band review: Value for money – Gadgets Now

Back in 2014, Xiaomi announced its first fitness band called Mi Band and it was also among the first brands to bring affordable yet functional fitness bands in Indian market. The Mi Band was a trendsetter in many ways which planted the idea of buying an inexpensive fitness tracking device. The company recently launched Redmi Smart Band at the price of Rs 1,599, a first under the Redmi series and it comes with lots of features such as 14 days battery life, biggest display in its segment, touch screen, heart rate sensor, bunch of workout modes, notifications and more. We have been using this fitness band for a while now and here’s our review of Redmi Smart Band. Redmi Smart Band: Design and display Just like smartphones, fitness band’s design has also gone monotonous. Most of them look almost the same and Redmi Smart Band is no different. It has got the typical fitness band look and that’s not a bad thing. Few things are better left untouched. Despite that Xiaomi has managed to d...
Read more