#GECKO IPHONE TOOLKIT MAC SOFTWARE#

All of the results from their scanning were indexed in a dashboard that included the HTTP status code, headers, response body, and screenshot of the accessible web servers under the various domains owned by Apple that we’d refer to over the engagement. Both Ben and Tanner were the experts here, so they began figuring out what all Apple owned that was accessible to us. The first step in hacking Apple was figuring out what to actually target. Even though there was no guarantee regarding payouts nor an understanding of how the program worked, everyone said yes, and we began hacking on Apple. In order to make the project more fun I sent a few messages to hackers I'd worked with in the past and asked if they'd like to work together on the program. At the time I had never worked on the Apple bug bounty program so I didn't really have any idea what to expect but decided why not try my luck and see what I could find. This caught my attention as an interesting opportunity to investigate a new program which appeared to have a wide scope and fun functionality. Zero-day in Sign in with Apple - bounty $100k - Bhavuk Jain May 30, 2020Īfter finishing the article, I did a quick Google search and found their program page where it detailed Apple was willing to pay for vulnerabilities 'with significant impact to users' regardless of whether or not the asset was explicitly listed in scope. This was surprising to me as I previously understood that Apple's bug bounty program only awarded security vulnerabilities affecting their physical products and did not payout for issues affecting their web assets. While scrolling through Twitter sometime around July I noticed a blog post being shared where a researcher was awarded $100,000 from Apple for discovering an authentication bypass that allowed them to arbitrarily access any Apple customer account. They were typically remediated within 1-2 business days (with some being fixed in as little as 4-6 hours). These severities were assessed by us for summarization purposes and are dependent on a mix of CVSS and our understanding of the business related impact.Īs of October 6th, 2020, the vast majority of these findings have been fixed and credited. There were a total of 55 vulnerabilities discovered with 11 critical severity, 29 high severity, 13 medium severity, and 2 low severity reports.

#GECKO IPHONE TOOLKIT MAC SOFTWARE#

Sam Curry ( Brett Buerhaus ( Ben Sadeghipour ( Samuel Erb ( Tanner Barnes ( our engagement, we found a variety of vulnerabilities in core portions of their infrastructure that would've allowed an attacker to fully compromise both customer and employee applications, launch a worm capable of automatically taking over a victim's iCloud account, retrieve source code for internal Apple projects, fully compromise an industrial control warehouse software used by Apple, and take over the sessions of Apple employees with the capability of accessing management tools and sensitive resources.Between the period of July 6th to October 6th myself, Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes worked together and hacked on the Apple bug bounty program.

Gecko iphone toolkit mac