Mike Peterson
A security researcher has explained how his investigation into Apple's CloudKit platform inadvertently brought down Siri Shortcuts earlier in 2021.
Frans Rosen, a bug bounty hunter for security firm Detectify, on Monday revealed that he had accidentally broke Shortcut sharing links while probing a misconfiguration in Apple's CloudKit system.
Earlier in 2021, Rosen said he was examining the security of Apple's services — and specifically CloudKit. Since many of Apple's own apps stored information in CloudKit databases, he was curious whether or not any specific app data could be modified by getting access to a public CloudKit container.
While investigating permissions in the CloudKit containers, he found several vulnerabilities related to iCrowd+, Apple News, and Shortcuts. At one point, he was able to delete a default zone without the proper permissions because of an Apple misconfiguration. That simple move, essentially, broke Shortcuts.
"All of them were gone. I now realized that the deletion did somehow work, but that the _defaultZone never disappeared," the researcher wrote. "When I tried sharing a new shortcut, it also did not work, at least not to begin with, most likely due to the record types also being deleted."
Rosen said he immediately reached out to Apple's security team, who told him to stop testing the system. The team then worked to resolve the issue, restoring Shortcuts and patching the problem by removing the options to delete or create public zones.
According to Rosen, the vulnerabilities did not allow him to access any private or user information. He was awarded a $28,000 bounty for his discovery by Apple's security team.
"Approaching CloudKit for bugs turned out to be a lot of fun, a bit scary, and a really good example of what a real deep-dive into one technology can result in when hunting bugs," Rosen said. "The Apple Security team was incredibly helpful and professional throughout the process of reporting these issues."
Christine McKee
William Gallagher
Amber Neely
Andrew O'Hara
Sponsored Content
Charles Martin
9 Comments
"Frans Rosen, a bug bounty hunter for security firm Detectify" and the title calls him a researcher? He's a hacker, plain and simple. True security researchers don't allow what they're doing to impact people outside their local testing net. I don't care if Apple gave him some money, I'd like to see how many people he affected so he can use that money to pay them for breaking the system.
To the editor: “ on Monday revealed that he had accidentally broken Shortcut sharing links” (note “broken”, not “broke”)
iCrowd+ ? :smiley: