Erik van Straten<p><span class="h-card" translate="no"><a href="https://hachyderm.io/@rmondello" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>rmondello</span></a></span> : the Apple passkey vulnerability that I reported last year, got worse; it now also works on Apple's own ID server.</p><p>This means that, under specific circumstances, *anyone* can log in to <a href="https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=992b008db1a63b0ce3eb77a87d2d37b37e4fbc768dcbc1279386dd6fce827761&rv=2&path=%2Freports%2FOE19476493072" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">idmsa.apple.com/IDMSWebAuth/si</span><span class="invisible">gnin?appIdKey=992b008db1a63b0ce3eb77a87d2d37b37e4fbc768dcbc1279386dd6fce827761&rv=2&path=%2Freports%2FOE19476493072</span></a> using their AppleID passkey *WITHOUT* providing a passcode or biometry.</p><p>Conditions:</p><p>a) iOS 17.5 (for some reason this does *not* work on iPadOS 16.7.8)</p><p>• Settings > Passwords > Password Options:<br>b) Autofill Passwords and Passkeys: enabled<br>c) iCloud Keychain: enabled</p><p>• Settings > Touch ID & Passcode:<br>d) Password Autofill: disabled (this cannot be enabled without TouchID or FaceID enabled, but with, it can be disabled)</p><p>e) A website that supports (*) WebAuthn "Conditional UI" (<a href="https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Conditional-UI" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/w3c/webauthn/wiki/E</span><span class="invisible">xplainer:-WebAuthn-Conditional-UI</span></a>), i.e. when tapping in a User-ID field leads to an attempted passkey based login.</p><p>(*) Provided that the specific website does not prevent this vulnerability in any way (see the github note at the end).</p><p>This works in Safari, Edge and Firefox (but not in Chrome), and anyone should be able to reproduce this:</p><p>1) Ensure that the conditions a) .. d) mentioned above are met;</p><p>2) Open <a href="https://security.apple.com/reports/OE19476493072" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.apple.com/reports/OE1</span><span class="invisible">9476493072</span></a></p><p>3) When asked to log in using your AppleID, tap the X at the top right of the box;</p><p>4) Tap in the field "Email or phone number";</p><p>5) A gray box with a blue button labeled <<< Use "yourID@icloud.com" may pop up from the bottom of the screen, or the keyboard with said choice at the top. If it does, tap it: you will be logged on using your AppleID passkey, without providing any authentication;</p><p>6) If this does not work, tap 'Done' and retry 3. Note: I'm not sure, it may be neccessary to log in *once* using your passcode. Close the browser to log out and start from 1).</p><p>Note that most people will not be authorized to read the contents of my report from last June (in <a href="https://security.apple.com/reports/OE19476493072" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.apple.com/reports/OE1</span><span class="invisible">9476493072</span></a>), but they *will have* logged in.</p><p>Github.com seems to prevent this vulnerability from manifesting. After tapping the user-ID field, the gray box with the (passkey login) blue button pops up which I can tap *without* authentication. However, github then says: "Unable to sign in with your passkey. Please sign in with your password."<br>However, if change d) by setting "Password Autofill" to enabled (which requires biometrical auth to be configured), then "Conditional UI" login to github.com works as expected.</p><p>Final note why this *is* a vulnerability: many people *do not* use biometric authentication to unlock their iDevices, either because they believe it to be unreliable, insecure and/or a privacy risk.</p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@timcappalli" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>timcappalli</span></a></span> <span class="h-card" translate="no"><a href="https://fosstodon.org/@passkeysdev" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>passkeysdev</span></a></span> </p><p><a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Passkeys</span></a> <a href="https://infosec.exchange/tags/Passkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Passkey</span></a> <a href="https://infosec.exchange/tags/ApplePasskeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ApplePasskeys</span></a> <a href="https://infosec.exchange/tags/iOSPasskeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iOSPasskeys</span></a> <a href="https://infosec.exchange/tags/iPadOSPasskeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iPadOSPasskeys</span></a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/iOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iOS</span></a> <a href="https://infosec.exchange/tags/iPadOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iPadOS</span></a> <a href="https://infosec.exchange/tags/Immature" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Immature</span></a> <a href="https://infosec.exchange/tags/Complexity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Complexity</span></a></p>