Apple’s “Sign in with Apple” was found to have a vulnerability that would allow hackers to gain access to any account that was linked with the service. The vulnerability was discovered by Bhavuk Jain, an Indian security researcher who promptly reported to Apple. Apple investigated the matter, Apple did conclude the vulnerability to be real and awarded the researcher a sum of $10,000 as part of the bug-bounty program.
The vulnerability in question was around how Apple validated users “on the client-side before initiating a request from Apple’s authentication services.” A JSON Web token would be generated by the server which would be used by the third-party service to authenticate the user. The vulnerability would allow this token to be spoofed, leading to any malicious actor to gain access to a user’s account. "I found I could request JWTs for any Email ID from Apple, and when the signature of these tokens was verified using Apple's public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID and gaining access to the victim's account," Jain said in an Interview with The Hacker News. The vulnerability would impact even those users who chose to hide or not share their email IDs during the login process.
Apple had introduced Sign in With Apple last year at WWDC as a means of providing iOS users an alternative to having to use their Facebook or Google IDs to log into third-party applications. The need arose from the fact that Facebook and Google were leveraging these sign-in for advertising purposes and even going so far as to tracking user behaviour. Facebook was even accused of selling user data to third parties, and then there was the Cambridge Analytica scandal. Twitter too was accused of selling user data to the people behind Cambridge Analytica. Apple’s pitch with Sign in with Apple was that the service wouldn’t collect or track user behaviour. In fact, Apple even built an email anonymizer into the service, where users could opt to not share their e-mail IDs with the platform they were logging into. In the backend, Apple would create a bridge email ID which would forward any correspondence from the platform to the users’ actual email ID. Sign in with Apple would generate unique e-mail IDs for every service you sign into, provided you choose to not share your email ID with that service.
Apple has stated that the vulnerability in question has been patched by the company and that after verifying their server logs, say that no accounts were accessed illegitimately.