Follow us

Update of a leak: Bad QA of iOS 15.0.2 led to comprehensive exposure of

When Apple backdoors paywall for their purposes but forget to clean up their code afterward

Updated: October 26, 2021 By Dmytro Cherkashyn

Samsung Galaxy Verizon Phone

Update 26.10.2021:

After additional investigation of initial exposure of Content Server, we finally concluded that exposed information is not for public access.

For the time of investigation, we can search through very convenient internal search queries and observe:

  • 490k+ different documents
  • 120k+ emails
  • 5k+  different media files

By the way, look at the dates below. It seems that with COVID-19 and lockdowns, all internal and external events were postponed or canceled, so there are almost no photos after November 2020.

Screenshot of jpg photos exposed on

We were in contact with the hacker, who discovered this leak and received proof of him contacting both parties involved in the story but without any response or reaction.

Screenshot of hacker contacting both parties

We tried to communicate too, but with the same zero results.

We can also confirm the exposure of private data of members through unprotected Content Server, which was under question.

One may see on the screenshot, the data sample is limited to 10000 results for a query, but nobody limits the number of queries; thus, there can be much more PII data stored.

Screenshot of PII of members

As Jonathan Scott has revealed 10/21/2021 in his GitHub repository, Apple iOS developers made a crucial mistake that led to a major data exposure in

Official tweet of Jonathon Scott on his offical Twitter handle.

Image source –

Code exposes backdoor that bypasses a paywall

A bad review of code in iOS 15.0.2 led to the exposure of the something being public repository of the

Piece of code from iOS 15.0.2 that exposed backdoor link

Image source –

Jumping around the pages on the provided link, one can find a lot of interesting documents.

Exposed portal

But at the end, it is all public data, while any links to private areas are not accessible without proper authentication.

It is yet unclear if there are any paid documents and developing standards leaked.

Exposure of PII is not just a standard for free

As a sample, you can see the 10k records with usernames, first names, last names, and email addresses from all around the world. This data is associated with many governmental and international organizations.

Piece of code from iOS 15.0.2 that exposed backdoor link

Image source –

About the Hacker

According to self-provided information, Jonathan Scott is one of the top hackers in the United States regarding hacking ethics.

His profile on HackerOne is still existing, but didn’t filled with any kind of data.

I was the #1 hacker in the USA for the last 90 days on, and I was kicked out for speaking up about a data leak that was ignored, but yet fixed behind my back

                                                                                                            Jonathan Scott

Ethical issue

Since data provided by the hacker is valid and the mentioned service of is still available, there are questions about ethical side of such disclosure remaining open.

The Cooltechzone explicitly discourage non-ethical disclosure of security issues. We are sure there is no data leak in this particular case.

The information provided here is only to raise awareness and not intended to provide any support to anybody for exploitation of vulnerable resources.
Dmytro Cherkashyn
Being a passionate security expert from Ukraine, Dmytro has passed through various security domains for the last 12 years, starting with the physical security of nuclear facilities and coming to operational technology cybersecurity for critical infrastructure in Germany.

Leave a comment

click to select

5 comments for Update of a leak: Bad QA of iOS 15.0.2 led to comprehensive exposure of

Anonymous's picture
Jonathandata1 is a fraud

He grinded the lowest of the low fruit on Hackerone on a program that literally accepts anything as a bug, just so he could say he's a "Top Hacker". The "exposed URL" is completely public information. This article mentions this fact, but the title suggests the complete opposite.

You should update this article to point out his antics clearly, as he is now using this very article to legitimize his fraudulent research.

Anonymous's picture
This does NOT expose anyone's

This does NOT expose anyone's iPhone or iPad to ANY vulnerability. This was found in an open source tool that Apple includes. This same URL exists in any product using that tool. This is meant to needlessly scare iPhone users and somehow promote the eliteness of this so called "hacker". No iPhone's were harmed during this...

User's picture
Wow? doesn't sound very good

Wow? doesn't sound very good to iPhone owners. What can be done in such a situation? does it threaten ordinary users? thanks

Anonymous's picture
This goes to further show the

This goes to further show the lack of attention that is being put into software quality assurance. I'm curious why no one reached back out to the hacker or cool tech zone? Is there any update on that? 10,000 is a lot!

Dmytro's picture
I think it shows generally

I think it shows generally approach to development process of products for consumers.
But more important, it is putting under attack any third-parties, which are in their order can be 2 tier delivery for other products.