6 ms·
> The Sign in with Apple works similarly to OAuth 2.0. > similarly I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky
by phamilton 6y ago
> The Sign in with Apple works similarly to OAuth 2.0.
> similarly
I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move.
> $100,000
That was a good bounty. Appropriate given scope and impact. But it would have been a lot cheaper to offer a pre-release bounty program. We (Remind) occasionally add unreleased features to our bounty program with some extra incentive to explore (e.g. "Any submissions related to new feature X will automatically be considered High severity for the next two weeks"). Getting some eyeballs on it while we're wrapping up QA means we're better prepared for public launch.
This particular bug is fairly run-of-the-mill for an experienced researcher to find. The vast majority of bug bounty submissions I see are simple "replay requests but change IDs/emails/etc". This absolutely would have been caught in a pre-release bounty program.
- saagarjha 6y agoApple supposedly marks certain beta builds with a bounty multiplier. I say supposedly because like their "research iPhones" they mentioned it in a presentation once and I never heard about it again.
- snazz 6y agoI'm guessing that the research iPhones were given to a very select group of security researchers with track records of reporting important vulnerabilities under some kind of NDA.
- saagarjha 6y ago1. Still never heard of anyone getting them and 2. that’s worse than useless.
- snazz 6y agoOh, for sure. I should clarify that I meant that they received the iPhones under an NDA, not that they reported bugs under an NDA (aside from the 90-day disclosure to get any bounties).
- saagarjha 6y agoWord on the street suggests they don’t exist: https://twitter.com/thegrugq/status/1236264193906495488 https://twitter.com/thegrugq/status/1236264193906495488
- snazz 6y agoI guess it's unrealistic to assume that their supply chain would be secure enough for these that no one would have heard anything.
- saagarjha 6y agoRight. You can find pictures of actual internal devices all over the internet (supposedly some people will even sell them to you), so it's quite strange to not hear anything about these. With Apple going after Corellium, I think many researchers are thankful for the various exploits we've had recently that have kept iPhone open.
- phamilton 6y agoI'm fine with pre-release bugs being reported under an NDA. If pre-release bugs are publicly disclosed that is arguably a punishment for companies who seek that validation early in the cycle rather than later.
- g_p 6y agoThis might be what you're referring to: From https://developer.apple.com/security-bounty/payouts/ https://developer.apple.com/security-bounty/payouts/ "Issues that are unique to designated developer or public betas, including regressions, can result in a 50% additional bonus if the issues were previously unknown to Apple."
- saagarjha 6y agoYes, that's it.
- zemnmez 6y ago> I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. The token described in this disclosure is an OpenID Connect 1.0 Token. OIDC is a state of the art AuthN protocol that supersets OAuth with additional security controls. It's used by Google, Facebook and Twitch amongst others. I'd do more analysis, but the author leaves off the most important part here (not sure why) https://openid.net/specs/openid-connect-core-1_0.html#IDToken https://openid.net/specs/openid-connect-core-1_0.html#IDToke...
- thephyber 6y agoThe important part is in the author’s article. The POST to the opened endpoint generates a valid JWT token for the email address in the payload, not for the one in the logged-in session. Everything else is extraneous.
- SV_BubbleTime 6y agoOh. Ok, so you did have to have an existing logged in session for any account, then could leverage that to get the token for another account by changing out the email?
- mazeltovvv 6y agoAh. So this creates a valid JWT for any email you want, but it is now associated with your own apple account?
- SV_BubbleTime 6y ago> but it is now associated with your own apple account? On the backend, maybe they can look up who requested a token at a time. But otherwise, no it doesn’t seem to be
- dodobirdlord 6y agoThis is certainly logged.