Apple Touch ID Flaw Could Have Let Attackers Hijack iCloud Accounts

Apple earlier this year fixed a security
vulnerability in iOS and macOS that could have potentially
allowed an attacker to gain unauthorized access to a user’s iCloud
account.

Uncovered in February by Thijs
Alkemade^[2], a security specialist
at IT security firm Computest, the flaw resided in Apple’s
implementation of TouchID (or FaceID) biometric feature that
authenticated users to log in to websites on Safari, specifically
those that use Apple ID logins.

After the issue was reported to Apple through their responsible
disclosure program, the iPhone maker addressed the vulnerability in
a server-side
update^[3].

An Authentication Flaw

The central premise of the flaw is as follows. When users try to
sign in to a website that requires an Apple ID, a prompt is
displayed to authenticate the login using Touch ID. Doing so skips
the two-factor authentication step since it already leverages a
combination of
factors for identification, such as the device (something you
have) and the biometric information (something you are).

Contrast this during logins to Apple domains (e.g. “icloud.com”)
the usual way with an ID and password, wherein the website embeds
an iframe pointing to Apple’s login validation server
(“https://idmsa.apple.com”), which handles the authentication
process.

A shown in the video
demonstration, the iframe URL also contains two other
parameters — a “client_id” identifying the service (e.g., iCloud)
and a “redirect_uri” that has the URL to be redirected to after
successful verification.

But in the case where a user is validated using TouchID, the
iframe is handled differently in that it communicates with the
AuthKit daemon (akd) to handle the biometric authentication and
subsequently retrieve a token (“grant_code”) that’s used by the
icloud.com page to continue the login process.

To do this, the daemon communicates with an API on
“gsa.apple.com,” to which it sends the details of the request and
from which it receives the token.

The security flaw discovered by Computest resides in the
aforementioned gsa.apple.com API, which made it theoretically
possible to abuse those domains to verify a client ID without
authentication.

“Even though the client_id and redirect_uri were included in the
data submitted to it by akd, it did not check that the redirect URI
matches the client ID,” Alkemade noted. “Instead, there was only a
whitelist applied by AKAppSSOExtension on the domains. All domains
ending with apple.com, icloud.com and icloud.com.cn were
allowed.”

This means that an attacker could exploit a cross-site scripting
vulnerability on any one of Apple’s subdomains to run a malicious
snippet of JavaScript code that can trigger a login prompt using
the iCloud client ID, and use the grant token to obtain a session
on icloud.com.

Setting Up Fake Hotspots to Take Over iCloud Accounts

In a separate scenario, the attack could be executed by embedding
JavaScript on the web page that’s
displayed when connecting to a Wi-Fi network for the first time
(via “captive.apple.com”), thus allowing an attacker access to a
user’s account by just accepting a TouchID prompt from that page.

“A malicious Wi-Fi network could respond with a page with
JavaScript which initiates OAuth as iCloud,” Alkemade said^[7]. “The user receives a
TouchID prompt, but it’s very unclear what it implies. If the user
authenticates on that prompt, their session token will be sent to
the malicious site, giving the attacker a session for their account
on iCloud.”

“By setting up a fake hotspot in a location where users expect
to receive a captive portal (for example at an airport, hotel or
train station), it would have been possible to gain access to a
significant number of iCloud accounts, which would have allowed
access to backups of pictures, location of the phone, files and
much more,” he added.

This is not the first time security issues have been found in
Apple’s authentication infrastructure. In May, Apple patched a
flaw^[8] impacting its “Sign in
with Apple” system that could have made it possible for remote
attackers to bypass authentication and take over targeted users’
accounts on third-party services and apps that have been registered
using Apple’s sign-in option.

^[1][4][5][6]