Apple Pays Indian Developer 10k $ for Finding a Bug in ‘Sign in With Apple’ Process

Apple has reportedly paid an Indian developer $100,000 (roughly Rs. 75.3 lakh) for finding a critical bug in the ‘Sign in with Apple’ process on its devices. The 27-year-old developer named Bhavuk Jain had discovered a Zero Day bug in the ‘Sign in with Apple’ process that could have allowed hackers to gain access to the user’s account where they were trying to sign in. The Cupertino-based company acknowledged this bug and stated that it had investigated and patched it, adding that this flaw was not exploited.

What is ‘Sign in with Apple’?

Jain disclosed this flaw in Apple’s ‘Sign in with Apple’ process that he found in April, on May 30 through a blog post. The ‘Sign in with Apple’ feature was introduced in June last year. This feature allows Apple account holders to sing in to third part apps without having to share their email address. This is done by generating a JSON Web Token (JWT) containing information required by the third-party application to confirm the identity of the user. While this process was implemented to preserve user privacy, the Zero Day bug found by Jain exposes the user accounts to attacks.

Sign in with Apple bug

According to the blog post by Jain, it was found that while signing in with Apple, users are required to log-in to their Apple account, which is the first step. In the second step, however, it was found that there was no validation to check if the same user is requesting a JWT to login to a third party app. This, as explained by Jain, could allow a hacker takeover the user’s account by faking a JWT.

“I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account,” Jain said. The developer went on to state that the impact of this flaw is “quite critical” and that it could allow a full account takeover. This in turn, would give hackers access to a lot of personal user data that might include log in credentials, passwords, account details, and other such private information.

While not many apps support this sign in process, it is available for Dropbox, Giphy, Spotify, and Airbnb, among others. Additionally, several other apps have this feature but not as a mandate. However, it still puts users at risk and as per the blog post, Apple conducted its own investigation of its logs and stated that no account has been compromised due to this vulnerability. Jain was paid $100,000 (roughly Rs. 75.3 lakh) by Apple under its Apple Security Bounty program for discovering and reporting this vulnerability.

Recent Articles

AMD Might Benefit From Nvidia’s Mishaps – Gizmodo

Nvidias RTX 3070 officially hits retail stores tomorrow. After the fiasco that was the RTX 3080 release, actual buyers will hopefully be able to...

In a first researchers extract secret key used to encrypt Intel CPU code – Ars Technica

55 with 41 posters participating Researchers have extracted the secret key that encrypts updates to an assortment of Intel CPUs, a feat that could have...

Vizio and LG’s next-gen-ready OLED TVs are up to $500 off at Best Buy – The Verge

Plus, Sonys WH-1000XM4 are also back down to their lowest price If you buy something from a Verge link, Vox Media may earn a commission....

Samsung’s mobile sales are up 51 percent over last year’s numbers – Engadget

According to Samsung, despite the pandemic profits in its mobile business are up sharply from the dip it experienced in 2019. That’s thanks to...

Yamaha’s THR30IIA is a wireless amp for acoustic guitar players – Engadget

On the top of the amp, you’ll find a three-way stereo imager switch, bass, middle and treble adjustment knobs. There are also AUX, headphone...

Related Stories

LEAVE A REPLY

Please enter your comment!
Please enter your name here