| 2021-10-21 | [Apple](https://apple.com/), [@apple](https://github.com/apple) | [Denis Tokarev](https://twitter.com/illusionofcha0s), [@illusionofchaos](https://github.com/illusionofchaos) | DMCA Takedowns of Mirror | iOS App Developer & Security Researcher [Denis Tokarev (illusionofchaos)](https://github.com/illusionofchaos) has developed an interesting relationship with Apple since early 2021. The researcher participated in Apple's Bug Bounty program in hope's of receiving a payout for his research having submitted the details between March 10 and May 4 of 2021. Four months later, Tokarev published his (Disclosure of four 0-day iOS vulnerabilities and his opinion of the [Apple Security Bounty Program](https://habr.com/en/post/579714/). To this day, Tokarev is still not listed on the [Apple Security Advisory for iOS 14.7 and iPadOS 14.7 security advisory.](https://support.apple.com/en-us/HT212601). In his words, "_When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time._" Frustrated with the lackluster **communication** between Apple's illusive security team, Tokarev eventually published his Proofs of Concept on GitHub: ["iOS gamed exploit (fixed in 15.0.2)"](https://github.com/illusionofchaos/ios-gamed-0day), a redacted ["Analyticsd pre-14.7 exploit"](https://github.com/illusionofchaos/ios-analyticsd-pre14.7-exploit), ["nehelper enumerate installed apps 0-day (iOS 15.0)"](https://github.com/illusionofchaos/ios-nehelper-enum-apps-0day), and ["Nehelper Wifi Info 0-day (iOS 15.0)"](https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day). A Jailbreak community member, [@rllbe](https://github.com/rllbe), released a [patch exclusively for Jailbroken devices named entitlementfix](https://www.reddit.com/r/jailbreak/comments/pvaztb/free_release_entitlementfix_workaround_for_the_3/). This is great for Jailbroken phones but does not help the millions of regular iPhones which are still vulnerable to attacks, namely information disclosure. Valued at $100,000 or more on the Example/Dummy Bounty payout page, or perhaps an exponentially higher value on the grey market, Tokarev has yet to receive a bounty, nor recognition, other than an email from Apple stating that they made an error in crediting his research. Apple silently patched one of the exploits in July with the release of iOS 14.7. To add to the already difficult relationship, Tokarev discovered and mirrored a helpful website with API documentation named "Atlas" for research purposes. ["Atlas is developed and maintained by the Hardware Test Engineering (HWTE) Software Platform group."](https://web.archive.org/web/20211019101209/http://101.132.96.154/) The repository [is currently serving the DMCA takedown notice Apple sent him](https://github.com/illusionofchaos/apple-atlas-docs). What makes this takedown unique is that the fact that the original server is still live; Tokarev mirrored a documentation resource, which is very common procedure on GitHub. Along with the GitHub DMCA notice, Tokarev [had multiple tweets also taken down](https://twitter.com/illusionofcha0s/status/1450588596407259139). The DMCA content removal [takedown notices on GitHub are publicly etched into GitHub's DMCA repository](https://github.com/github/dmca/blob/master/2021/10/2021-10-18-apple.md); the [Lumen database copy can be viewed here](https://lumendatabase.org/notices/25498447). The researcher was also [locked out of his Twitter account at one point](https://twitter.com/illusionofcha0s/status/1450902601864732679/photo/1). As per DMCA submission rules on Twitter, the firm representing Apple, swears, "_under penalty of perjury,_" that the the documentation is Apple's copyright. What makes this case seem targeted is that **only** Tokarev's content has been DMCA'ed by Apple- absolutely no other reply, public tweet, or image containing the IP address has apparently been removed from Twitter. [An archive of the alleged offending content page, while still live, is archived.](https://web.archive.org/web/20211019101209/http://101.132.96.154/). On October 25, 2021, [@apple](https://github.com/apple) eventually added the contribution, in Analytics affecting iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation). It was issued CVE-2021-30871 and the impact statement was, "A local attacker may be able to access analytics data." NIST analysts scored the bug [5.5 CVSS MEDIUM](https://nvd.nist.gov/vuln/detail/CVE-2021-30871).|
0 commit comments