Bhavuk Jain got a $100,000 reward from Apple after he hacked the tech giant’s Sign in with Apple platform. The hacker is also a software security researcher and he gave details on how he compromised Apple’s security in a blog post.

According to a Digital Trends report, Apple has already patched the vulnerability which Jain uncovered in April 2020. Also, the company has told the hacker that they investigated and found that no cybercriminal had exploited this weakness before they fixed it.

On his blog post, Bhavuk Jain explains that all he needs to “takeover your account” is your Email ID. He adds that the bug also allowed him to take over a person’s full account on any website or app, even when the victim does not have a valid Apple ID. He calls it a “zero-day in Sign in with Apple” weakness.

Also read:
– Apple Rolls Out macOS 10.15.5 With Battery Health Management Feature
– Google And Apple Finally Roll Out COVID-19 Exposure Notification Software
– Important Facts About Hacktivists, Anonymous, As They Allegedly Return Amidst Protest For Late George Floyd

In explaining how he bypassed Apple’s security, which many hail as the best among other companies; Jain said the bug existed in Apple’s JWT (JSON Web Token). He wrote:

“I found I could request JWTs for any Email ID from Apple and when the signature of these tokens was verified using Apple’s public key, they showed as valid. This means an attacker could forge a JWT by linking any Email ID to it and gaining access to the victim’s account.”

Further, this vulnerability is very critical in that many app and website developers have integrated Sign in with Apple with their platforms. Jain mentioned Dropbox, Spotify, Airbnb, Giphy as some of the platforms that use this software. He, however, acknowledged that he did not test the mentioned applications. Yet he is certain that they were vulnerable to a full account takeover attack; if they didn’t use any other verification measure.

The $100,000 that Apple paid to Bhavuk Jain for discovering this vulnerability was under the company’s Apple Security Bounty program. This program rewards ethical hackers and developers who find weaknesses in Apple’s services.

For your daily dose of tech, lifestyle and trending content, make sure to follow Plat4om on Twitter @Plat4omLive, on Instagram @Plat4om, on LinkedIn at Plat4om, and on Facebook at Plat4om. You can also email us at info@plat4om.com. Finally, don’t forget to subscribe to our YouTube channel HERE.