Now Patched 'Sign in With Apple' Bug Left Users Open to Attack

Researcher Bhavuk Jain in April discovered a critical Sign in With Apple vulnerability that could have resulted in a takeover of some user accounts. The bug was specific to third party apps that used Sign in With Apple and didn't implement additional security measures.

SigninwithApple e1590865553423
Jain notes that Sign in With Apple works by authenticating a user through a JWT (JSON Web Token) or a code that's generated by Apple's server. Apple then gives users the option to share either the email tied to their Apple ID or a private relay email address,which creates a JWT that's used to log in a user.

Jain then discovered that once JWTs for both Apple ID emails and private relay email addresses were requested and the token's signature was verified using Apple's public key, it "showed as valid." Should the bug have not been discovered, a JWT could be created and used to gain access to one's account.

In an interview with The Hacker News, Jain spoke about the severity of the bug:

The impact of the this vulnerability was quite critical as it could have allowed a full account takeover. Many developers have integrated Sign in with Apple since it is mandatory for applications that support other social logins. To name a few that use Sign in with Apple - Dropbox, Spotify, Airbnb, Giphy (now acquired by Facebook).

According to Jain, Apple conducted an investigation and concluded that no accounts were compromised using this method before the vulnerability was patched. Jain was paid $100,000 by Apple under its Apple Security Bounty Program for reporting the bug.

Top Rated Comments

SBlue1 Avatar
10 months ago
100,000? Well deserved. :)
Score: 13 Votes (Like | Disagree)
B4U Avatar
10 months ago
Are we getting numb with the constant SW issues that Apple is having lately?
Score: 11 Votes (Like | Disagree)
Peace Avatar
10 months ago
I’m getting burned out on timmys security problems .

windows is looking better
Score: 10 Votes (Like | Disagree)
I7guy Avatar
10 months ago

I’m getting burned out on timmys security problems .

windows is looking better
Windows is better? Sure windows is as tight as a drum as far as that goes.

Just keep patching them Timmy.
Score: 7 Votes (Like | Disagree)
cmaier Avatar
10 months ago

I don't care.

I'm done updating.

I'm sick and tired of my phone being artificially slowed.

I'm back to using Linux for things that need to be secure, like banking, etc.
You know this wasn’t a bug in the client software or operating system, right?
Score: 5 Votes (Like | Disagree)
konqerror Avatar
10 months ago

If it was unexploited and has been patched, there's not much of a story here… except to other businesses that might consider Sign In With Apple.
Bugs are a symptom, not the flaw. The constant stream of problems coming out from Apple shows their software development and QA processes are severely flawed.
Score: 5 Votes (Like | Disagree)

Top Stories

whatsapp privacy banner

WhatsApp Reveals What Happens to Users Who Don't Agree to Upcoming Privacy Policy Changes

Sunday February 21, 2021 1:11 am PST by
WhatsApp has revealed how it will gradually limit the features available to accounts held by users who do not accept the platform's impending privacy policy changes, due to come into effect on May 15. WhatsApp's new banner explaining the privacy policy changes According to an email seen by TechCrunch to one of its merchant partners, WhatsApp said it will "slowly ask" users who have not yet...
new airpods leaked image 52audios

Alleged Leaked Image Claims to Show Third-Generation AirPods and Case

Sunday February 21, 2021 2:49 am PST by
A new image claims to offer our first real world look at Apple's next-generation AirPods. The image, shared by 52audio, showcases both AirPods and the charging case for what the site claims to be the third iteration of the wireless earbuds. 52audio has in the past shared images claiming to showcase different parts of the third-generation AirPods. Most notably, the site in November shared...
2021 mbp sd slot feature2

Kuo: New MacBook Pro Models With HDMI Port and SD Card Reader to Launch Later This Year

Monday February 22, 2021 8:52 pm PST by
Apple plans to release two new MacBook Pro models equipped with an HDMI port and SD card reader in the second half of 2021, according to analyst Ming-Chi Kuo, who outlined his expectations in a research note obtained by MacRumors. The return of an SD card reader was first reported by Bloomberg's Mark Gurman last month. "We predict that Apple's two new MacBook Pro models in 2H21 will have...
mac security privacy

Apple Takes Step to Prevent Further Spread of 'Silver Sparrow' Malware on Macs

Monday February 22, 2021 6:13 am PST by
Over the weekend, we reported on the second known piece of malware compiled to run natively on M1 Macs. Given the name "Silver Sparrow," the malicious package is said to leverage the macOS Installer JavaScript API to execute suspicious commands. After observing the malware for over a week, however, security firm Red Canary did not observe any final payload, so the exact threat to users remains a...
iphone 12 pro display video

BOE Rumored to Supply iPhone 13 Display Panels After iPhone 12 Failures

Monday February 22, 2021 9:54 am PST by
Display manufacturer BOE will be one of the main suppliers of OLED panels for iPhone 13 models, according to a new report today from Taiwan's Economic Daily News. BOE is said to be working with touch panel manufacturer General Interface Solution (GIS), part of the Hon Hai Group to develop OLED panels. Multiple iPhone 12 rumors suggested that BOE would supply some panels for the devices,...
pink squares macos

Apple Investigating Issue With 'Pink Squares' Appearing on Displays Connected to M1 Mac Mini

Sunday February 21, 2021 11:08 am PST by
In an internal memo this week, obtained by MacRumors, Apple informed service providers that it is aware of and investigating an issue that may result in "pink squares or pixels" appearing on displays connected to an M1 Mac mini. Image via Twitter user @FatihVidyograf This issue has been reported by users across the Apple Support Communities, MacRumors Forums, and Reddit since the M1 Mac mini...
Top Stories 47 Feature

Top Stories: More iOS 14.5 Beta Changes, iPhone 13 Rumors, Apple Watch Charging Issue Fixed

Saturday February 20, 2021 6:00 am PST by
Apple is continuing to tweak things during the iOS 14.5 beta testing period, and it looks like there will be some nice changes coming in the update when it's released to the public in a month or so. This week also saw the release of a watchOS bug fix update for Series 5 and Series SE owners, addressing a serious issue where their watches may not charge after entering Power Reserve mode,...
google chrome macos big sur

Chrome Used 10X More RAM Than Safari on macOS Big Sur in Recent Test [Updated]

Saturday February 20, 2021 12:52 pm PST by
Under normal and lightweight web browsing, Google Chrome uses 10x more RAM than Safari on macOS Big Sur, according to a test conducted by Flotato creator Morten Just (via iMore). In a blog post, Just outlines that he put both browsers to the test in two scenarios on the latest version of macOS. The first test was conducted on a virtual machine, and the second on a 2019 16-inch MacBook Pro...
m1 mac mini

M1 Mac Users Report Excessive SSD Wear

Tuesday February 23, 2021 7:07 am PST by
Over the past week, some M1 Mac users have been reporting alarming SSD health readings, suggesting that these devices are writing extraordinary amounts of data to their drives (via iMore). Across Twitter and the MacRumors forums, users are reporting that M1 Macs are experiencing extremely high drive writes over a short space of time. In what appear to be the most severe cases, M1 Macs are sai...
maxresdefault

Revisiting Apple's MagSafe Leather Wallet After 3 Months of Usage

Saturday February 20, 2021 8:04 am PST by
Back in November when Apple's MagSafe-compatible Leather Wallet first launched, MacRumors videographer Dan took a look at the accessory and ended up disliking it because of the weak magnetic connection. Dan kept using the Leather Wallet despite its flaws, and after three months with the accessory, his opinion has changed and he wanted to share some new thoughts on it. Subscribe to the ...