Follow us

Update of a leak: Bad QA of iOS 15.0.2 led to comprehensive exposure of ISO.org

When Apple backdoors ISO.org paywall for their purposes but forget to clean up their code afterward

Updated: October 26, 2021 By Dmytro Cherkashyn

Samsung Galaxy Verizon Phone

Update 26.10.2021:

After additional investigation of initial exposure of ISO.org Content Server, we finally concluded that exposed information is not for public access.

For the time of investigation, we can search through very convenient internal search queries and observe:

  • 490k+ different documents
  • 120k+ emails
  • 5k+  different media files

By the way, look at the dates below. It seems that with COVID-19 and lockdowns, all internal and external events were postponed or canceled, so there are almost no photos after November 2020.

Screenshot of jpg photos exposed on iso.org

We were in contact with the hacker, who discovered this leak and received proof of him contacting both parties involved in the story but without any response or reaction.

Screenshot of hacker contacting both parties

We tried to communicate ISO.org too, but with the same zero results.

We can also confirm the exposure of private data of ISO.org members through unprotected Content Server, which was under question.

One may see on the screenshot, the data sample is limited to 10000 results for a query, but nobody limits the number of queries; thus, there can be much more PII data stored.

Screenshot of PII of ISO.org members

As Jonathan Scott has revealed 10/21/2021 in his GitHub repository, Apple iOS developers made a crucial mistake that led to a major data exposure in ISO.org

Official tweet of Jonathon Scott on his offical Twitter handle.

Image source – twitter.com

Code exposes backdoor that bypasses a paywall

A bad review of code in iOS 15.0.2 led to the exposure of the something being public repository of the ISO.org.

Piece of code from iOS 15.0.2 that exposed backdoor link

Image source – github.com

Jumping around the pages on the provided link, one can find a lot of interesting documents.

Exposed isotc.iso.org portal

But at the end, it is all public data, while any links to private areas are not accessible without proper authentication.

It is yet unclear if there are any paid documents and developing standards leaked.

Exposure of PII is not just a standard for free

As a sample, you can see the 10k records with usernames, first names, last names, and email addresses from all around the world. This data is associated with many governmental and international organizations.

Piece of code from iOS 15.0.2 that exposed backdoor link

Image source – github.com

About the Hacker

According to self-provided information, Jonathan Scott is one of the top hackers in the United States regarding hacking ethics.

His profile on HackerOne is still existing, but didn’t filled with any kind of data.

I was the #1 hacker in the USA for the last 90 days on Hackerone.com, and I was kicked out for speaking up about a data leak that was ignored, but yet fixed behind my back

                                                                                                            Jonathan Scott

Ethical issue

Since data provided by the hacker is valid and the mentioned service of ISO.org is still available, there are questions about ethical side of such disclosure remaining open.

The Cooltechzone explicitly discourage non-ethical disclosure of security issues. We are sure there is no data leak in this particular case.

Disclaimer:
The information provided here is only to raise awareness and not intended to provide any support to anybody for exploitation of vulnerable resources.
Tags: 
News
Editor-in-Chief
Dmytro Cherkashyn
Being a passionate security expert from Ukraine, Dmytro has passed through various security domains for the last 12 years, starting with the physical security of nuclear facilities and coming to operational technology cybersecurity for critical infrastructure in Germany.

Leave a comment

click to select

3 comments for Update of a leak: Bad QA of iOS 15.0.2 led to comprehensive exposure of ISO.org

User's picture
Wow? doesn't sound very good

Wow? doesn't sound very good to iPhone owners. What can be done in such a situation? does it threaten ordinary users? thanks

Anonymous's picture
This goes to further show the

This goes to further show the lack of attention that is being put into software quality assurance. I'm curious why no one reached back out to the hacker or cool tech zone? Is there any update on that? 10,000 is a lot!

Dmytro's picture
I think it shows generally

I think it shows generally approach to development process of products for consumers.
But more important, it is putting under attack any third-parties, which are in their order can be 2 tier delivery for other products.