I'm glad the data leak has been fixed, but they did not acknowledge my efforts or even have the decency to respond to my emails, dms, or tweets.

I wrote a medium article on a lot more specific details of this incident.

https://jonathandata1.medium.com/the-dark-side-of-apple-allowing-a-10-000-user-data-leak-8cf31d504bb5

Author: Jonathan Scott Twitter: https://www.twitter.com/jonathandata1 Date Published: October 21st, 2021 Date Updated: December 17th, 2021

Background: I decompressed the DMG inside of iOS 15.0.2 (018-78120-011.dmg) the build name is Sky19A404.D63OS

Locations: Symbiotic Link: /usr/share/zoneinfo/iso3166.tab Direct Path: /usr/share/zoneinfo.default/iso3166.tab

I went back to read the code comments, and I could see that these code comments had nothing to do with the data that I was looking at on iso.org. As I began to traverse the site, I noticed that I was able to access restricted areas that have gone outside of the public domain.

This list includes international government, and major corporations PII.

the code manages resources that intentionally contain sensitive information, but the resources are unintentionally made accessible to unauthorized actors. In this case, the information exposure is resultant - i.e., a different weakness enabled the access to the information in the first place. Source: https://cwe.mitre.org/data/definitions/200.html

The argument can be made that this is not Apple's issue, this is an issue with ISO.org, and there is truth in both, but this data leak is 100% due to Apple backdooring data and intentionally exposing endpoints that are only available after properly paying for the data.

1. ISO.org did not write the code that references their after payment URL endpoint that leads to a URI PII leak, the author Paul Eggert has been affiliated with Apple for years.

2. ISO.org likely does not even know about their pay wall is being bypassed publicly and is being used as a reference link since they did not provide the code, or the inclusive file packaged into the DMG, later the ipsw.

3. ISO.org does have an issue to fix, but this may be something that they are already aware of, and could possibly already be fixing, this does not give Apple the right to publish code that bypasses ISO.orgs pay wall exposing a vulnerability in ISO.org's systems.

4. The data that is referenced in the iso3166.tab is paid data that lives behind a PAY WALL from ISO.org, reference: https://www.iso.org/standard/72483.html

6. I mentioned in my Twitter feed...Apple is back-dooring this data, bypassing ISO.org's paywall, and by back-dooring the data is knowingly exposing this URL endpoint

According to Apple's own compliance Statements, they hold the following ISO Certifications. 27001 and ISO 27018.

ISO 27018 specifically addresses the following points

• Accuracy and quality
• Accountability
• Information Security
• Privacy Compliance

https://support.apple.com/en-us/HT210897 Apple's ISO Certifications

https://www.bsigroup.com/en-GB/our-services/certification/certificate-and-client-directory/search-results/?searchkey=licence%253d649475%2526company%253dApple&licencenumber=IS%2520649475

https://www.bsigroup.com/en-GB/our-services/certification/certificate-and-client-directory/search-results/?searchkey=licence%253d673269%2526company%253dApple&licencenumber=PII%2520673269

Open Source code deserves just as much scrutiny as closed. Relying on code that was last updated in 2018 at best is irresponsible, dangerous, and harmful to the community. This lack of quality assurance has lead to a massive data breech, and leak. Open source usage and responsibility falls within Apple's ISO compliance standards, and if they were only to follow these standards, we would not be in this situation. The Log4J exploit has shown that open source code needs to be examined on a much higher level that is happening right now.

Supply chain attacks are top of mind for many IT teams, and an important piece of the puzzle is ensuring its integrity. Compliance is a key part of this, and as a result, organizations like the Linux Foundation sought a solution. The OpenChain Project was created as an effective certification for open source license compliance in the software supply chain. What it essentially does is strengthen the whole chain and ensure each section can be trusted and meets the standard of compliance set to earn the certification. The most recent OpenChain Specification is the ISO/IEC 5230:2020 which “specifies the key requirements of a quality open source license compliance program in order to provide a benchmark that builds trust between organizations exchanging software solutions comprised of open source software.”

Reference: https://www.trendmicro.com/pt_br/research/21/g/navigating-open-source-licensing-risk.html

I have been reporting this since iOS 15.0.2

"After examining your report we do not see any actual security implications with Apple products or services. This link is included in open source code as part of the ISO standard."

• I have sent direct messages to ISO.org on Twitter - No Response

• I have sent emails to ISO.org - No Response

• Media has reached out to Apple and ISO.ORG - No Response

https://leonlagreyentry.blog/apples-backdoor-security-15-0-2-exposed-iso-standard-leak/ https://cooltechzone.com/news/bad-qa-of-ios-15-0-2-led-to-comprehensive-exposure-of-iso-org