© 2022 CoolTechZone - Latest tech news,
product reviews, and analyses.

If you purchase via links on our site, we may receive affiliate commissions.

Update of a leak: Bad QA of iOS 15.0.2 led to comprehensive exposure of ISO.org

5

Update 26.10.2021:

After additional investigation of initial exposure of ISO.org Content Server, we finally concluded that exposed information is not for public access.

For the time of investigation, we can search through very convenient internal search queries and observe:

  • 490k+ different documents
  • 120k+ emails
  • 5k+  different media files

By the way, look at the dates below. It seems that with COVID-19 and lockdowns, all internal and external events were postponed or canceled, so there are almost no photos after November 2020.

Screenshot of jpg photos exposed on iso.org

We were in contact with the hacker, who discovered this leak and received proof of him contacting both parties involved in the story but without any response or reaction.

Screenshot of hacker contacting both parties

We tried to communicate ISO.org too, but with the same zero results.

We can also confirm the exposure of private data of ISO.org members through unprotected Content Server, which was under question.

One may see on the screenshot, the data sample is limited to 10000 results for a query, but nobody limits the number of queries; thus, there can be much more PII data stored.

Screenshot of PII of ISO.org members

As Jonathan Scott has revealed 10/21/2021 in his GitHub repository, Apple iOS developers made a crucial mistake that led to a major data exposure in ISO.org

Official tweet of Jonathon Scott on his offical Twitter handle.

Image source – twitter.com

Code exposes backdoor that bypasses a paywall

A bad review of code in iOS 15.0.2 led to the exposure of the something being public repository of the ISO.org.

Piece of code from iOS 15.0.2 that exposed backdoor link

Image source – github.com

Jumping around the pages on the provided link, one can find a lot of interesting documents.

Exposed isotc.iso.org portal

But at the end, it is all public data, while any links to private areas are not accessible without proper authentication.

It is yet unclear if there are any paid documents and developing standards leaked.

Exposure of PII is not just a standard for free

As a sample, you can see the 10k records with usernames, first names, last names, and email addresses from all around the world. This data is associated with many governmental and international organizations.

Piece of code from iOS 15.0.2 that exposed backdoor link

Image source – github.com

About the Hacker

According to self-provided information, Jonathan Scott is one of the top hackers in the United States regarding hacking ethics.

His profile on HackerOne is still existing, but didn’t filled with any kind of data.

I was the #1 hacker in the USA for the last 90 days on Hackerone.com, and I was kicked out for speaking up about a data leak that was ignored, but yet fixed behind my back

                                                                                                            Jonathan Scott

Ethical issue

Since data provided by the hacker is valid and the mentioned service of ISO.org is still available, there are questions about ethical side of such disclosure remaining open.

The Cooltechzone explicitly discourage non-ethical disclosure of security issues. We are sure there is no data leak in this particular case.

Disclaimer:
The information provided here is only to raise awareness and not intended to provide any support to anybody for exploitation of vulnerable resources.

Comments

Anonymous
Anonymous
prefix 7 months ago
This does NOT expose anyone's iPhone or iPad to ANY vulnerability. This was found in an open source tool that Apple includes. This same URL exists in any product using that tool. This is meant to needlessly scare iPhone users and somehow promote the eliteness of this so called "hacker". No iPhone's were harmed during this...
Anonymous
Anonymous
prefix 7 months ago
He grinded the lowest of the low fruit on Hackerone on a program that literally accepts anything as a bug, just so he could say he's a "Top Hacker". The "exposed URL" is completely public information. This article mentions this fact, but the title suggests the complete opposite.



You should update this article to point out his antics clearly, as he is now using this very article to legitimize his fraudulent research.
User
User
prefix 11 months ago
Wow? doesn't sound very good to iPhone owners. What can be done in such a situation? does it threaten ordinary users? thanks
Anonymous
Anonymous
prefix 10 months ago
This goes to further show the lack of attention that is being put into software quality assurance. I'm curious why no one reached back out to the hacker or cool tech zone? Is there any update on that? 10,000 is a lot!
Dmytro
Dmytro
prefix 11 months ago
I think it shows generally approach to development process of products for consumers.

But more important, it is putting under attack any third-parties, which are in their order can be 2 tier delivery for other products.
Leave a Reply

Your email address will not be published. Required fields are marked

Cool Tech ZoneCyber Security Labs & News