Apple Touch ID Flaw Could Have Let Attackers Hijack iCloud Accounts
Hijack iCloud Accounts- Apple earlier this year fixed a security vulnerability in iOS and macOS
that could have potentially allowed an attacker to gain unauthorized access to a user’s iCloud account. Hijack iCloud Accounts
Uncovered in February by Thijs Alkemade, a security specialist at IT security firm Computest,
the flaw resided in Apple’s implementation of TouchID (or FaceID)
biometric feature that authenticated users to log in to websites on Safari, specifically those that use ID logins.
After the issue was reported to Apple through their responsible disclosure program, the iPhone maker addressed the vulnerability in a server-side update.
An Authentication Flaw – Hijack iCloud Accounts
The central premise of the flaw is as follows. When users try to sign in to a website that requires an ID,
a prompt is displayed to authenticate the login using Touch ID. Hijack iCloud Accounts
Doing so skips the two-factor authentication step since it already leverages a combination of factors for identification,
such as the device (something you have) and the biometric information (something you are).
As shown in the video demonstration, the iframe URL also contains two other parameters
But in the case where a user is validated using TouchID, the iframe is handled differently in that it communicates with the AuthKit daemon
To do this, the daemon communicates with an API on “gsa.apple.com,”
“Even though the client_id and redirect_uri were included in the data submitted to it by akd,
This means that an attacker could exploit a cross-site scripting vulnerability on any one of Apple’s subdomains to run a malicious snippet
Apple Setting Up Fake Hotspots to Take Over iCloud Accounts
In a separate scenario, the attack could be executed by embedding JavaScript on the web page that’s displayed when connecting to a
“A malicious Wi-Fi network could respond with a page with JavaScript which initiates OAuth as iCloud,”
“By setting up a fake hotspot in a location where users expect to receive a captive portal (for example at an airport, hotel or train station),
This is not the first time security issues have been found in Apple’s authentication infrastructure. In May, Apple patched a flaw impacting its
