During our engagement, we found a variety of vulnerabilities in core portions of their infrastructure that would’ve allowed an attacker to fully compromise both customer and employee applications, launch a worm capable of automatically taking over a victim’s iCloud account, retrieve source code for internal Apple projects, fully compromise an industrial control warehouse software used by Apple, and take over the sessions of Apple employees with the capability of accessing management tools and sensitive resources.
There were a total of 55 vulnerabilities discovered with 11 critical severity, 29 high severity, 13 medium severity, and 2 low severity reports. These severities were assessed by us for summarization purposes and are dependent on a mix of CVSS and our understanding of the business related impact.
As of October 6th, 2020, the vast majority of these findings have been fixed and credited. They were typically remediated within 1-2 business days (with some being fixed in as little as 4-6 hours).
Definitely a speedy response by Apple, but seeing the severity of the vulnerabilities found, that seems hardly surprising – the hackers even managed to get access to the source code for iOS, macOS, and other Apple projects.
Our proof of concept for this report was demonstrating we could read and access Apple’s internal maven repository which contained the source code for what appeared to be hundreds of different applications, iOS, and macOS.
You can bet that they haven’t been the only one snooping around in there.
“fully compromise an industrial control warehouse software used by Apple”
Depending on what that software was used for it could possibly worse than a source code leak. Just think of something like what Stuxnet did.