Frustrated developer drops 3 Zero-Day vulnerabilities affecting Apple iOS 15 after waiting for 6 Months, clearly upset with Apple’s handling of its Security Bounty program.
Habr, a Russian-based IT blog under the name IllusionOfChaos and Twitter handle @illusionofcha0s, expressed his frustration with Apple’s handling of vulnerability reports.
According to the developer, “I’ve reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page.”
He further said, “When I confronted them, they apologized, assured me it happened due to a processing issue, and promised to list it on the security content page of the next update. There have been three releases since then and they broke their promise each time.”
The developer said the vulnerability dump conforms with responsible disclosure practices, noting that Apple was informed and has done nothing. Though the programming blunders are not terribly dire, from what we can tell, they ought to be addressed at some point.
Earlier on Thursday, Apple released a patch for macOS Catalina to address a different zero-day. Ten days ago it went through a similar process in a bid to address a zero-click iMessage bug used to target human rights activists and other flaws.
Three Unpatch iOS Flaws:
- Gamed 0-day: This provides access to sensitive data such as Apple ID email address, full name, the associated Apple ID authentication token, read access to a shared contacts database, the speed dial database, and the Address Book.
- Nehelper Enumerate Installed Apps 0-day: This allows any user-installed app to determine whether any other app is installed.
- Nehelper Wi-Fi Info 0-day: This allows an app with location access permission to use Wi-Fi without the required entitlement.
Apple fixed a flaw called Analyticsd, it allowed user-installed apps to gain access to a shared set of analytics logs that contain medical data, device usage information, device accessory data, crash data, and language settings for viewed web pages.
The developer said, “All this data was being collected and available to an attacker even if ‘Share analytics’ was turned off in settings.”
While talking to The Register, Patrick Wardle, founder of free security project Objective See and director of research at security biz Synack said, “The bugs are neat, but unlikely to be widely exploited. Any app that attempted to (ab)use them would need to first be approved by Apple, via the iOS app store.”
He further said, “To me, the bigger takeaway is that Apple is shipping iOS with known bugs, noting that IllusionOfChaos claims to have reported the bugs months ago. “And that security researchers are so frustrated by the Apple Bug Bounty program they are literally giving up on it, turning down (potential) money, to post free bugs online.”
Wardle thinks the researcher’s critique of Apple’s Security Bounty program to be fair.
He further added, “Apple’s internal security team gets it, but at the higher up, cultural level, they’ve all drunk the Apple juice, and believe their way is the right way, and they don’t need any external help.”
Apple’s Security Bounty program, though rewarding to some developers, others shares the similar frustration expressed by IllusionOfChaos. Earlier Jeff Johnson, who runs app biz Lapcat Software expressing his frustrations said, “Talking to Apple Product Security is like talking to a brick wall.”
Google Warns Users How Hackers Can Make Malware Undetectable on Windows
Apple’s New iCloud Private Relay Service Leaks User’s Real IP Addresses
Cisco Released Patches 3 New Critical Flaws Affecting IOS XE Software