Apple Company Pays Indian Developer Rs. 75 Lakh for Finding a Bug in ‘Sign in With Apple’ Process
Apple Company are reportedly paid an Indian developer $100,000 (roughly Rs. 75.3 lakh) for finding a critical bug in the ‘Sign in with Apple’ process on its devices. The 27-year-old developer named Bhavuk Jain are discovered a Zero Day bug in the ‘Sign in with Apple’ process that could have allowed hackers to gain access to the user’s account where they were trying to sign in. These Cupertino-based company acknowledged this bug and stated that it had investigated and patched it, adding that this flaw was not exploited.
What is Sign in with Apple?
Bhavuk Jain disclosed this flaw in Apple’s ‘Sign in with Apple’ process that he found in April, on May 30 through a blog post. They ‘Sign in with Apple’ feature are introduced in June last year. This feature allows Apple account holders to sing in to third part apps without having to share their email address. This is done by generating a JSON Web Token (JWT) containing information required by the third-party application to confirm the identity of the user. In While this process was implemented to preserve user privacy, the Zero Day bug found by Jain exposes the user accounts to attacks.
Sign in with Apple bug
According to the blog post by Bhavuk Jain, they was found that while signing in with Apple, users are required to log-in to their Apple account, which is the first step. In the second step, however, they was found that there was no validation to check if the same user is requesting a JWT to login to a third party app. They are explained by Jain, could allow a hacker takeover the user’s account by faking a JWT.
They was found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. Its means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account,” Jain said. These developer went on to state that the impact of this flaw is “quite critical” and that it could allow a full account takeover. This turn, would give hackers access to a lot of personal user data that might include log in credentials, passwords, account details, and other such private information.
In While not many apps support this sign in process, it is available for Dropbox, Giphy, Spotify, & Airbnb, among others. Additionally, several other apps have this feature but not as a mandate. However, it still puts users at risk and as per the blog post, Apple conducted its own investigation of its logs and stated that no account has been compromised due to this vulnerability. Jain was paid $100,000 (roughly Rs. 75.3 lakh) by Apple under its Apple Security Bounty program for discovering and reporting this vulnerability.
