iCloud Possibly Suffered A Privacy Breach Last Year That Apple Kept a Secret

Similarly, when Twitter was hit by multiple vulnerabilities
(#1^[2], #2^[3], #3^[4]) in the last few months,
the social media company disclosed those incidents and informed its
affected users.

And Guess What? Google is going to shut down its social media
network Google+ in April this year after admitting two security flaws in
its platform that exposed private data of hundreds of thousands of
users to third-party developers.
^[5]

It turns out that Apple also possibly suffered a privacy breach
late last year due to a bug in its platform that might have exposed
some of your iCloud data to other users, but the company chose to
keep the incident secret… maybe because it was not worth to
disclose, or perhaps much more complicated.

Last week, Turkish security researcher Melih Sevim contacted
The Hacker News and claimed to have discovered a flaw in Apple
services that allowed him to view partial data, especially notes,
from random iCloud accounts as well as on targeted iCloud users
just by knowing their associated phone numbers.
^[6]

Melih confirmed The Hacker News that he discovered the alleged flaw
in October 2018, and then responsibly reported it to the Apple’s
security team with steps to reproduce the bug and a video
demonstration, showing how he was able to read personal iCloud data
from other Apple users without their knowledge.

Apple then immediately closed the ticket and buried the
lead.

A Mysterious iCloud Bug

Based upon Melih explanation, the alleged flaw resided in the way
Apple “internally” linked, either accidentally or intentionally, a
phone number saved in the billing information of an Apple ID to the
iCloud account on a device using the same phone number.

If Melih’s report is accurate, the next detail makes the issue
more serious…

Melih also confirmed The Hacker News that the text-box asking users
to enter a phone number was not validating the user input, thus
allowing an attacker even to save a single digit input.

Apple Acknowledged the Problem, But…

To confirm Melih’s bug and know the full extent of the incident, we
reached out to the Apple security team before publishing this
article.

In response to The Hacker News email and knowing that we are
working on a story, Apple acknowledged the bug report, saying “the
issue was corrected back in November,” without responding to some
other important questions, including for how many weeks the flaw
remained open, the estimated number of affected users (if any) and
if there is any evidence of malicious exploitation?

Well, that was weird, but not new…

Just yesterday, Apple temporarily took down its Group FaceTime
service after the public disclosure of a bug in
its video-calling app^[7]
that allows FaceTime users to hear or see other users before they
even pick up the call.

Later it turned out that Apple was apparently notified^[8]
of the FaceTime
eavesdropping bug^[9]
over a week ago by a
14-year-old^[10] boy before it made
headlines, but again, the Apple security team failed to communicate
promptly, leaving its millions of users unaware of the issue and at
risk.

If the suspected iCloud leak was minor, then Apple could have
confirmed us, but it’s silence over the report makes the incident
more suspicious.

We’ll update this story as we hear more.