{"id":1405,"date":"2022-02-04T11:04:00","date_gmt":"2022-02-04T18:04:00","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=1405"},"modified":"2022-02-03T14:49:42","modified_gmt":"2022-02-03T21:49:42","slug":"how-a-bug-bounty-hunter-earned-100500-from-apple","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/02\/04\/how-a-bug-bounty-hunter-earned-100500-from-apple\/","title":{"rendered":"How a Bug Bounty Hunter Earned $100,500 from Apple"},"content":{"rendered":"\n<p>Apple has rewarded a record-breaking bounty of <strong>$100,500<\/strong> to a security researcher, who reported a bug that can gain unauthorized webcam access<sup>[1]<\/sup>.  The bug is known to exploit the security flaws within <strong>iCloud Sharing and Safari 15<\/strong>, which allowed attackers to also have access to every website ever visited by the victim.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img decoding=\"async\" data-src=\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Safari-iCloud-2-1024x512.jpg\" alt=\"\" class=\"wp-image-1416 lazyload\" width=\"768\" height=\"384\" data-srcset=\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Safari-iCloud-2-1024x512.jpg 1024w, https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Safari-iCloud-2-300x150.jpg 300w, https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Safari-iCloud-2-768x384.jpg 768w, https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Safari-iCloud-2.jpg 1200w\" data-sizes=\"(max-width: 768px) 100vw, 768px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 768px; --smush-placeholder-aspect-ratio: 768\/384;\" \/><figcaption>https:\/\/macosguides.net\/wp-content\/uploads\/2018\/04\/Safari-iCloud.jpg<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"who-found-this-bug\">Who Found this Bug?<\/h2>\n\n\n\n<p>The security researcher that found this bug is Ryan Pickren, who is a founder of proof-of-concept sharing platform  &#8220;BugPoC&#8221; and a former Amazon Web Services security engineer. This is not the first time that he has identified a flaw within the Safari Browser. Back in 2020,  he discovered that flaws in the Safari Browser can be used to snoop one&#8217;s iPhones, iPads, and Mac computers through cameras and microphones<sup>[2]<\/sup>. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-exactly-was-the-bug\">What exactly was the bug?<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"728\" height=\"534\" data-src=\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Apple-macOs-sharebear-attack.jpg\" alt=\"\" class=\"wp-image-1449 lazyload\" data-srcset=\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Apple-macOs-sharebear-attack.jpg 728w, https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-content\/uploads\/sites\/115\/2022\/02\/Apple-macOs-sharebear-attack-300x220.jpg 300w\" data-sizes=\"(max-width: 728px) 100vw, 728px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 728px; --smush-placeholder-aspect-ratio: 728\/534;\" \/><figcaption>https:\/\/securityaffairs.co\/wordpress\/127410\/hacking\/apple-macbook-webcam-microphone-hack.html\/attachment\/apple-macos-sharebear-attack<\/figcaption><\/figure>\n\n\n\n<p>According to Pickren, the vulnerability is centered around an app called <strong>&#8220;ShareBear&#8221;<\/strong>. ShareBear is an iCloud Sharing app that prompts users when they attempt to open a shared document file for the first time and only the first time. <strong>The most important thing about ShareBear in this context is that it only prompts the user the first time.<\/strong>  If the victim accepts the prompt, the attacker has permission to the file as long as the file is shared with the attacker, because the victim&#8217;s Mac would remember that it has accepted the file. Once the attacker has full permission to the file, the attacker can plant a polymorphic file onto the machine and remotely launch it at any moment<sup>[2]<\/sup>. Since the victim&#8217;s Mac recognizes the file and has already given permission to the attacker, the attacker can plant the polymorphic file without having the victim to allow this action. <\/p>\n\n\n\n<p>You might ask yourself what a polymorphic file is. <\/p>\n\n\n\n<p>A polymorphic file is a virus that can constantly mutate its code, making it extremely difficult for computers to detect the virus yet retain the same basic routines after every infection <sup>[3]<\/sup>.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>There are three steps involved in using Sharebear to download and open a web archive file<\/strong><sup>[2]<\/sup>.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Trick the victim into giving permission, so that the attcker can plant a polymorphic file<\/li><li>Turn an image file with .PNG format into an executable binary after the victim has agreed to open the file.<\/li><li>The executable binary generates an exploit chain that takes an advantage of other flaws discovered in Safari in order to take over the machine&#8217;s microphone, webcam , or even to access every local file in the system<sup>[2]<\/sup>.<\/li><\/ul>\n\n\n\n<p>Imagine yourself wanting to open a cute picture of your dog, well that picture is now an executable binary that your computer cannot detect.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"conclusion\">Conclusion<\/h2>\n\n\n\n<p>Apple has now fixed this behavior in\u00a0<strong>macOS Monterey 12.0.1<\/strong>. But, one thing we have to take note of is that an exploiter can use approved applications to do a malicious con and that one little flaw in the application can enable a pathway to the victim&#8217;s system.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"references\">References<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>https:\/\/thehackernews.com\/2022\/01\/apple-pays-100500-bounty-to-hacker-who.html<\/li><li>https:\/\/threatpost.com\/apple-bug-bounty-mac-webcam-hack\/178114\/<\/li><li>https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/Polymorphic-virus<\/li><\/ol>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple has rewarded a record-breaking bounty of $100,500 to a security researcher, who reported a bug that can gain unauthorized webcam access[1]. The bug is known to exploit the security flaws within iCloud Sharing and Safari 15, which allowed attackers to also have access to every website ever visited by the victim. Who Found this &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/02\/04\/how-a-bug-bounty-hunter-earned-100500-from-apple\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;How a Bug Bounty Hunter Earned $100,500 from Apple&#8221;<\/span><\/a><\/p>\n","protected":false},"author":364,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[15],"tags":[],"class_list":["post-1405","post","type-post","status-publish","format-standard","hentry","category-cpsc-329-602-w22","entry"],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Sean Choi","author_link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/author\/sean-choi\/"},"_links":{"self":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/1405","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/users\/364"}],"replies":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/comments?post=1405"}],"version-history":[{"count":8,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/1405\/revisions"}],"predecessor-version":[{"id":1503,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/posts\/1405\/revisions\/1503"}],"wp:attachment":[{"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/media?parent=1405"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/categories?post=1405"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/wp-json\/wp\/v2\/tags?post=1405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}