SoylentNews is people
SoylentNews
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a bug in Sign in with Apple allowed me to do.
When Apple announced Sign in with Apple at the June 2019 worldwide developers conference, it called it a "more private way to simply and quickly sign into apps and websites." The idea was, and still is, a good one: replace social logins that can be used to collect personal data with a secure authentication system backed by Apple's promise not to profile users or their app activity.
One of the plus points that got a lot of attention at the time was the ability for a user to sign up with third-party apps and services without needing to disclose their Apple ID email address. Unsurprisingly, it has been pushed as being a more privacy-oriented option than using your Facebook or Google account.
Fast forward to April 2020, and a security researcher from Delhi uncovered a critical Sign in with Apple vulnerability that could allow an attacker to potentially take over an account with just an email ID. A critical vulnerability that was deemed important enough that Apple paid him $100,000 (£81,000) through its bug bounty program by way of a reward.
Considering the level of embarrassment possible for basically leaving the front door unlocked, I'd say the reward was on the light side.
I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple's public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim's account.
(Score: 2) by JoeMerchant on Tuesday June 02 2020, @12:49PM (4 children)
Ah... seems like weak sauce to start with, but I see the commercial appeal. Craigslist and others have been doing similar things for a long time, but as a single server not an Oauth type stand-off.
Seems like anyone wanting to anonymize their e-mail communication with a 3rd party should just make a binary choice: anonymize yes/no? If yes, they shouldn't have anything to do with selection of the ID used to carry e-mails.
🌻🌻 [google.com]
(Score: 2) by TheRaven on Tuesday June 02 2020, @04:20PM (3 children)
sudo mod me up
(Score: 2) by JoeMerchant on Tuesday June 02 2020, @04:35PM (2 children)
Assumption #2 in security: anything that can be tampered with, will be.
I just finished an impromptu review of our software update functionality - had a request to try to use it as a backdoor to exfiltrate information to USB stick, that wasn't in the original design spec, but it seemed like something as powerful as a software update mechanism might be able to pull it off: if the user/attacker had the proper update signing key. Unfortunately for those hoping for a quick-fix to the problem du-jour, it appears that the software update function, as implemented, cannot be twisted to effectively become an arbitrary file export to USB mechanism unless it is actually used via its intended function: to update the device software.
Bottom line: in an ideal implementation, software only does what it was designed to do, nothing more. Any unintended functional scope is a potential security hole.
🌻🌻 [google.com]
(Score: 2) by TheRaven on Tuesday June 02 2020, @05:28PM (1 child)
sudo mod me up
(Score: 2) by JoeMerchant on Tuesday June 02 2020, @05:52PM
Hang on, I've heard this one before:
You're holding it wrong!
🌻🌻 [google.com]