Apple Pays Indian Developer 10k $ for Finding a Bug in ‘Sign in With Apple’ Process

Apple has reportedly paid an Indian developer $100,000 (roughly Rs. 75.3 lakh) for finding a critical bug in the ‘Sign in with Apple’ process on its devices. The 27-year-old developer named Bhavuk Jain had discovered a Zero Day bug in the ‘Sign in with Apple’ process that could have allowed hackers to gain access to the user’s account where they were trying to sign in. The Cupertino-based company acknowledged this bug and stated that it had investigated and patched it, adding that this flaw was not exploited.

What is ‘Sign in with Apple’?

Jain disclosed this flaw in Apple’s ‘Sign in with Apple’ process that he found in April, on May 30 through a blog post. The ‘Sign in with Apple’ feature was introduced in June last year. This feature allows Apple account holders to sing in to third part apps without having to share their email address. This is done by generating a JSON Web Token (JWT) containing information required by the third-party application to confirm the identity of the user. While this process was implemented to preserve user privacy, the Zero Day bug found by Jain exposes the user accounts to attacks.

Sign in with Apple bug

According to the blog post by Jain, it was found that while signing in with Apple, users are required to log-in to their Apple account, which is the first step. In the second step, however, it was found that there was no validation to check if the same user is requesting a JWT to login to a third party app. This, as explained by Jain, could allow a hacker takeover the user’s account by faking a JWT.

“I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account,” Jain said. The developer went on to state that the impact of this flaw is “quite critical” and that it could allow a full account takeover. This in turn, would give hackers access to a lot of personal user data that might include log in credentials, passwords, account details, and other such private information.

While not many apps support this sign in process, it is available for Dropbox, Giphy, Spotify, and Airbnb, among others. Additionally, several other apps have this feature but not as a mandate. However, it still puts users at risk and as per the blog post, Apple conducted its own investigation of its logs and stated that no account has been compromised due to this vulnerability. Jain was paid $100,000 (roughly Rs. 75.3 lakh) by Apple under its Apple Security Bounty program for discovering and reporting this vulnerability.

Recent Articles

Facebook’s earliest employees say Zuckerberg’s inaction on Trump posts is ‘cowardly’

Nearly three dozen of Facebook's earliest employees wrote an open letter addressing Facebook's leadership Wednesday calling for the company to rethink its inaction...

Physicists Have Created the Most Sensitive Strain Sensor Ever Made

Scanning Electron Microscopy (SEM) Image of G-balls under high magnification. Credit: University of Sussex

Amazon said to be considering $2 billion stake in Bharti Airtel

The strange big tech arms race in the Indian telecoms sector looks set to escalate further if Amazon buys a major stake...

UK government reported to be tapping up NEC for 5G network help

As part of a general rethink of the Huawei situation, the UK government seems to have decided it needs to do more...

Inside the Origins and Rating Systems of PUBG’s Ranked Mode

The essential PUBG experience of dropping into a classic battleground with friends, surviving, and dominating the map, has taken on new meaning...

Related Stories

LEAVE A REPLY

Please enter your comment!
Please enter your name here