Researcher Claims Apple Downplayed Severity of iCloud Account Takeover Vulnerability

guest · Jun 22, 2021

Researcher Claims Apple Downplayed Severity of iCloud Account Takeover Vulnerability
June 22, 2021
https://www.securityweek.com/resear...everity-icloud-account-takeover-vulnerability

The issue, researcher Laxman Muthiyah says, was a bypass of the various security measures Apple has in place to prevent attempts to brute force the ‘forgot password’ functionality for Apple accounts.

The vulnerability was reported to Apple on July 1, 2020, and a patch was rolled out in April 2021. The researcher claimed Apple did not notify him when it fixed the issue.
Furthermore, the tech giant told him that only “a very small minority of accounts were ever at risk, and extremely few Apple device users were vulnerable.”

“This attack only works against Apple ID accounts that have never been used to log in on a password protected iPhone, iPad, or Mac,” the company said, downplaying the researcher’s assessment that all iCloud accounts would be at risk.
Click to expand...

According to Muthiyah, the company attempted to hide the fact that the vulnerability was critical and even changed a related support page. He believes the change was made in October 2020, following his inquiry on the vulnerability.

Apple offered the researcher an $18,000 bug bounty reward, but he refused it, saying that the company significantly downplayed the impact of the flaw, and that it should have awarded him $100,000 or even as much as $350,0000.
Click to expand...

Log in or Sign up

Researcher Claims Apple Downplayed Severity of iCloud Account Takeover Vulnerability

guest Guest

Log in or Sign up

Researcher Claims Apple Downplayed Severity of iCloud Account Takeover Vulnerability

guest Guest

Useful Searches