Apple Pays Indian Developer 10k $ for Finding a Bug in ‘Sign in With Apple’ Process

Apple has reportedly paid an Indian developer $100,000 (roughly Rs. 75.3 lakh) for finding a critical bug in the ‘Sign in with Apple’ process on its devices. The 27-year-old developer named Bhavuk Jain had discovered a Zero Day bug in the ‘Sign in with Apple’ process that could have allowed hackers to gain access to the user’s account where they were trying to sign in. The Cupertino-based company acknowledged this bug and stated that it had investigated and patched it, adding that this flaw was not exploited.

What is ‘Sign in with Apple’?

Jain disclosed this flaw in Apple’s ‘Sign in with Apple’ process that he found in April, on May 30 through a blog post. The ‘Sign in with Apple’ feature was introduced in June last year. This feature allows Apple account holders to sing in to third part apps without having to share their email address. This is done by generating a JSON Web Token (JWT) containing information required by the third-party application to confirm the identity of the user. While this process was implemented to preserve user privacy, the Zero Day bug found by Jain exposes the user accounts to attacks.

Sign in with Apple bug

According to the blog post by Jain, it was found that while signing in with Apple, users are required to log-in to their Apple account, which is the first step. In the second step, however, it was found that there was no validation to check if the same user is requesting a JWT to login to a third party app. This, as explained by Jain, could allow a hacker takeover the user’s account by faking a JWT.

“I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account,” Jain said. The developer went on to state that the impact of this flaw is “quite critical” and that it could allow a full account takeover. This in turn, would give hackers access to a lot of personal user data that might include log in credentials, passwords, account details, and other such private information.

While not many apps support this sign in process, it is available for Dropbox, Giphy, Spotify, and Airbnb, among others. Additionally, several other apps have this feature but not as a mandate. However, it still puts users at risk and as per the blog post, Apple conducted its own investigation of its logs and stated that no account has been compromised due to this vulnerability. Jain was paid $100,000 (roughly Rs. 75.3 lakh) by Apple under its Apple Security Bounty program for discovering and reporting this vulnerability.

Recent Articles

Today I learned bats are trendsetters in tracking tech – The Verge

Look at these goofy little guys Look at this bats little backpack! Image: dulog Bats are elusive little creatures, which makes them the perfect subjects for scientists...

Brave browser now supports peer-to-peer IPFS protocol – Engadget

The protocol brings with it several advantages over HTTP. One of the big ones is that it promises to make browsing the web faster...

Today’s best tech deals: Lots of Switch games Fire HD tablets and more – Ars Technica

13 with 13 posters participating Today's Dealmaster includes a number of discounts on first-party Nintendo Switch games. While most of the deals don't reach the...

Samsung’s Galaxy Tab Active 3 now available in the US – The Verge

The Galaxy Tab Active 3 was first announced in September 2020 The Tab Active 3 is IP68 rated and, with the included case, can withstand...

Save $80 on the latest MacBook Pro with the M1 processor – The Verge

Plus, save big on Tidal and video games If you buy something from a Verge link, Vox Media may earn a commission. See our ethics...

Related Stories


Please enter your comment!
Please enter your name here