When Apple backdoors ISO.org paywall for their purposes but forget to clean up their code afterward
Update 26.10.2021:
After additional investigation of initial exposure of ISO.org Content Server, we finally concluded that exposed information is not for public access.
For the time of investigation, we can search through very convenient internal search queries and observe:
By the way, look at the dates below. It seems that with COVID-19 and lockdowns, all internal and external events were postponed or canceled, so there are almost no photos after November 2020.
We were in contact with the hacker, who discovered this leak and received proof of him contacting both parties involved in the story but without any response or reaction.
We tried to communicate ISO.org too, but with the same zero results.
We can also confirm the exposure of private data of ISO.org members through unprotected Content Server, which was under question.
One may see on the screenshot, the data sample is limited to 10000 results for a query, but nobody limits the number of queries; thus, there can be much more PII data stored.
As Jonathan Scott has revealed 10/21/2021 in his GitHub repository, Apple iOS developers made a crucial mistake that led to a major data exposure in ISO.org
Image source – twitter.com
A bad review of code in iOS 15.0.2 led to the exposure of the something being public repository of the ISO.org.
Image source – github.com
Jumping around the pages on the provided link, one can find a lot of interesting documents.
But at the end, it is all public data, while any links to private areas are not accessible without proper authentication.
It is yet unclear if there are any paid documents and developing standards leaked.
As a sample, you can see the 10k records with usernames, first names, last names, and email addresses from all around the world. This data is associated with many governmental and international organizations.
Image source – github.com
According to self-provided information, Jonathan Scott is one of the top hackers in the United States regarding hacking ethics.
His profile on HackerOne is still existing, but didn’t filled with any kind of data.
I was the #1 hacker in the USA for the last 90 days on Hackerone.com, and I was kicked out for speaking up about a data leak that was ignored, but yet fixed behind my back
Jonathan Scott
Since data provided by the hacker is valid and the mentioned service of ISO.org is still available, there are questions about ethical side of such disclosure remaining open.
The Cooltechzone explicitly discourage non-ethical disclosure of security issues. We are sure there is no data leak in this particular case.
Leave a comment
He grinded the lowest of the low fruit on Hackerone on a program that literally accepts anything as a bug, just so he could say he's a "Top Hacker". The "exposed URL" is completely public information. This article mentions this fact, but the title suggests the complete opposite.
You should update this article to point out his antics clearly, as he is now using this very article to legitimize his fraudulent research.
This does NOT expose anyone's iPhone or iPad to ANY vulnerability. This was found in an open source tool that Apple includes. This same URL exists in any product using that tool. This is meant to needlessly scare iPhone users and somehow promote the eliteness of this so called "hacker". No iPhone's were harmed during this...
Wow? doesn't sound very good to iPhone owners. What can be done in such a situation? does it threaten ordinary users? thanks
This goes to further show the lack of attention that is being put into software quality assurance. I'm curious why no one reached back out to the hacker or cool tech zone? Is there any update on that? 10,000 is a lot!
I think it shows generally approach to development process of products for consumers.
But more important, it is putting under attack any third-parties, which are in their order can be 2 tier delivery for other products.
